## Automatically generated incremental diff
## From:   linux-2.6.8-rc2
## To:     linux-2.6.8-rc3
## Robot:  $Id: make-incremental-diff,v 1.12 2004/01/06 07:19:36 hpa Exp $

diff -urN linux-2.6.8-rc2/Documentation/DMA-mapping.txt linux-2.6.8-rc3/Documentation/DMA-mapping.txt
--- linux-2.6.8-rc2/Documentation/DMA-mapping.txt	2004-06-15 22:19:28.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/DMA-mapping.txt	2004-08-03 15:21:28.631394488 -0700
@@ -222,14 +222,14 @@
 	struct pci_dev *pdev;
 
 	...
-	if (pci_set_dma_mask(pdev, PLAYBACK_ADDRESS_BITS)) {
+	if (!pci_set_dma_mask(pdev, PLAYBACK_ADDRESS_BITS)) {
 		card->playback_enabled = 1;
 	} else {
 		card->playback_enabled = 0;
 		printk(KERN_WARN "%s: Playback disabled due to DMA limitations.\n",
 		       card->name);
 	}
-	if (pci_set_dma_mask(pdev, RECORD_ADDRESS_BITS)) {
+	if (!pci_set_dma_mask(pdev, RECORD_ADDRESS_BITS)) {
 		card->record_enabled = 1;
 	} else {
 		card->record_enabled = 0;
diff -urN linux-2.6.8-rc2/Documentation/IPMI.txt linux-2.6.8-rc3/Documentation/IPMI.txt
--- linux-2.6.8-rc2/Documentation/IPMI.txt	2004-06-15 22:18:52.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/IPMI.txt	2004-08-03 15:21:29.014410200 -0700
@@ -442,6 +442,7 @@
 
   modprobe ipmi_watchdog timeout=<t> pretimeout=<t> action=<action type>
       preaction=<preaction type> preop=<preop type> start_now=x
+      nowayout=x
 
 The timeout is the number of seconds to the action, and the pretimeout
 is the amount of seconds before the reset that the pre-timeout panic will
@@ -472,6 +473,10 @@
 If start_now is set to 1, the watchdog timer will start running as
 soon as the driver is loaded.
 
+If nowayout is set to 1, the watchdog timer will not stop when the
+watchdog device is closed.  The default value of nowayout is true
+if the CONFIG_WATCHDOG_NOWAYOUT option is enabled, or false if not.
+
 When compiled into the kernel, the kernel command line is available
 for configuring the watchdog:
 
@@ -480,6 +485,7 @@
 	ipmi_watchdog.preaction=<preaction type>
 	ipmi_watchdog.preop=<preop type>
 	ipmi_watchdog.start_now=x
+	ipmi_watchdog.nowayout=x
 
 The options are the same as the module parameter options.
 
diff -urN linux-2.6.8-rc2/Documentation/MSI-HOWTO.txt linux-2.6.8-rc3/Documentation/MSI-HOWTO.txt
--- linux-2.6.8-rc2/Documentation/MSI-HOWTO.txt	2004-06-15 22:18:38.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/MSI-HOWTO.txt	2004-08-03 15:21:29.107414015 -0700
@@ -3,13 +3,14 @@
 			10/03/2003
 	Revised Feb 12, 2004 by Martine Silbermann
 		email: Martine.Silbermann@hp.com
+	Revised Jun 25, 2004 by Tom L Nguyen
 
 1. About this guide
 
-This guide describes the basics of Message Signaled Interrupts(MSI), the
-advantages of using MSI over traditional interrupt mechanisms, and how
-to enable your driver to use MSI or MSI-X. Also included is a Frequently
-Asked Questions.
+This guide describes the basics of Message Signaled Interrupts (MSI),
+the advantages of using MSI over traditional interrupt mechanisms,
+and how to enable your driver to use MSI or MSI-X. Also included is
+a Frequently Asked Questions.
 
 2. Copyright 2003 Intel Corporation
 
@@ -35,7 +36,7 @@
 the MSI/MSI-X capability structure in its PCI capability list. The
 device function may implement both the MSI capability structure and
 the MSI-X capability structure; however, the bus driver should not
-enable both, but instead enable only the MSI-X capability structure.
+enable both.
 
 The MSI capability structure contains Message Control register,
 Message Address register and Message Data register. These registers
@@ -86,35 +87,62 @@
 support for better interrupt performance.
 
 Using MSI enables the device functions to support two or more
-vectors, which can be configure to target different CPU's to
+vectors, which can be configured to target different CPU's to
 increase scalability.
 
 5. Configuring a driver to use MSI/MSI-X
 
 By default, the kernel will not enable MSI/MSI-X on all devices that
-support this capability. The CONFIG_PCI_USE_VECTOR kernel option
+support this capability. The CONFIG_PCI_MSI kernel option
 must be selected to enable MSI/MSI-X support.
 
-5.1 Including MSI support into the kernel
+5.1 Including MSI/MSI-X support into the kernel
 
-To allow MSI-Capable device drivers to selectively enable MSI (using
-pci_enable_msi as described below), the VECTOR based scheme needs to
-be enabled by setting CONFIG_PCI_USE_VECTOR.
+To allow MSI/MSI-X capable device drivers to selectively enable
+MSI/MSI-X (using pci_enable_msi()/pci_enable_msix() as described
+below), the VECTOR based scheme needs to be enabled by setting
+CONFIG_PCI_MSI during kernel config.
 
 Since the target of the inbound message is the local APIC, providing
-CONFIG_PCI_USE_VECTOR is dependent on whether CONFIG_X86_LOCAL_APIC
-is enabled or not.
+CONFIG_X86_LOCAL_APIC must be enabled as well as CONFIG_PCI_MSI.
 
-int pci_enable_msi(struct pci_dev *)
+5.2 Configuring for MSI support
+
+Due to the non-contiguous fashion in vector assignment of the
+existing Linux kernel, this version does not support multiple
+messages regardless of a device function is capable of supporting
+more than one vector. To enable MSI on a device function's MSI
+capability structure requires a device driver to call the function
+pci_enable_msi() explicitly.
+
+5.2.1 API pci_enable_msi
+
+int pci_enable_msi(struct pci_dev *dev)
 
 With this new API, any existing device driver, which like to have
-MSI enabled on its device function, must call this explicitly. A
-successful call will initialize the MSI/MSI-X capability structure
-with ONE vector, regardless of whether the device function is
+MSI enabled on its device function, must call this API to enable MSI
+A successful call will initialize the MSI capability structure
+with ONE vector, regardless of whether a device function is
 capable of supporting multiple messages. This vector replaces the
 pre-assigned dev->irq with a new MSI vector. To avoid the conflict
 of new assigned vector with existing pre-assigned vector requires
-the device driver to call this API before calling request_irq(...).
+a device driver to call this API before calling request_irq().
+
+5.2.2 API pci_disable_msi
+
+void pci_disable_msi(struct pci_dev *dev)
+
+This API should always be used to undo the effect of pci_enable_msi()
+when a device driver is unloading. This API restores dev->irq with
+the pre-assigned IOAPIC vector and switches a device's interrupt
+mode to PCI pin-irq assertion/INTx emulation mode.
+
+Note that a device driver should always call free_irq() on MSI vector
+it has done request_irq() on before calling this API. Failure to do
+so results a BUG_ON() and a device will be left with MSI enabled and
+leaks its vector.
+
+5.2.3 MSI mode vs. legacy mode diagram
 
 The below diagram shows the events, which switches the interrupt
 mode on the MSI-capable device function between MSI mode and
@@ -124,121 +152,274 @@
 	|	     | <===============	| 			 |
 	| MSI MODE   |	  	     	| PIN-IRQ ASSERTION MODE |
 	| 	     | ===============>	|			 |
- 	 ------------	free_irq      	 ------------------------
+ 	 ------------	pci_disable_msi  ------------------------
 
-5.2 Configuring for MSI support
 
-Due to the non-contiguous fashion in vector assignment of the
-existing Linux kernel, this version does not support multiple
-messages regardless of the device function is capable of supporting
-more than one vector. The bus driver initializes only entry 0 of
-this capability if pci_enable_msi(...) is called successfully by
-the device driver.
+Figure 1.0 MSI Mode vs. Legacy Mode
+
+In Figure 1.0, a device operates by default in legacy mode. Legacy
+in this context means PCI pin-irq assertion or PCI-Express INTx
+emulation. A successful MSI request (using pci_enable_msi()) switches
+a device's interrupt mode to MSI mode. A pre-assigned IOAPIC vector
+stored in dev->irq will be saved by the PCI subsystem and a new
+assigned MSI vector will replace dev->irq.
+
+To return back to its default mode, a device driver should always call
+pci_disable_msi() to undo the effect of pci_enable_msi(). Note that a
+device driver should always call free_irq() on MSI vector it has done
+request_irq() on before calling pci_disable_msi(). Failure to do so
+results a BUG_ON() and a device will be left with MSI enabled and
+leaks its vector. Otherwise, the PCI subsystem restores a device's
+dev->irq with a pre-assigned IOAPIC vector and marks released
+MSI vector as unused.
+
+Once being marked as unused, there is no guarantee that the PCI
+subsystem will reserve this MSI vector for a device. Depending on
+the availability of current PCI vector resources and the number of
+MSI/MSI-X requests from other drivers, this MSI may be re-assigned.
+
+For the case where the PCI subsystem re-assigned this MSI vector
+another driver, a request to switching back to MSI mode may result
+in being assigned a different MSI vector or a failure if no more
+vectors are available.
 
 5.3 Configuring for MSI-X support
 
-Both the MSI capability structure and the MSI-X capability structure
-share the same above semantics; however, due to the ability of the
-system software to configure each vector of the MSI-X capability
-structure with an independent message address and message data, the
-non-contiguous fashion in vector assignment of the existing Linux
-kernel has no impact on supporting multiple messages on an MSI-X
-capable device functions. By default, as mentioned above, ONE vector
-should be always allocated to the MSI-X capability structure at
-entry 0. The bus driver does not initialize other entries of the
-MSI-X table.
-
-Note that the PCI subsystem should have full control of a MSI-X
-table that resides in Memory Space. The software device driver
-should not access this table.
-
-To request for additional vectors, the device software driver should
-call function msi_alloc_vectors(). It is recommended that the
-software driver should call this function once during the
+Due to the ability of the system software to configure each vector of
+the MSI-X capability structure with an independent message address
+and message data, the non-contiguous fashion in vector assignment of
+the existing Linux kernel has no impact on supporting multiple
+messages on an MSI-X capable device functions. To enable MSI-X on
+a device function's MSI-X capability structure requires its device
+driver to call the function pci_enable_msix() explicitly.
+
+The function pci_enable_msix(), once invoked, enables either
+all or nothing, depending on the current availability of PCI vector
+resources. If the PCI vector resources are available for the number
+of vectors requested by a device driver, this function will configure
+the MSI-X table of the MSI-X capability structure of a device with
+requested messages. To emphasize this reason, for example, a device
+may be capable for supporting the maximum of 32 vectors while its
+software driver usually may request 4 vectors. It is recommended
+that the device driver should call this function once during the
 initialization phase of the device driver.
 
-The function msi_alloc_vectors(), once invoked, enables either
-all or nothing, depending on the current availability of vector
-resources. If no vector resources are available, the device function
-still works with ONE vector. If the vector resources are available
-for the number of vectors requested by the driver, this function
-will reconfigure the MSI-X capability structure of the device with
-additional messages, starting from entry 1. To emphasize this
-reason, for example, the device may be capable for supporting the
-maximum of 32 vectors while its software driver usually may request
-4 vectors.
-
-For each vector, after this successful call, the device driver is
-responsible to call other functions like request_irq(), enable_irq(),
-etc. to enable this vector with its corresponding interrupt service
-handler. It is the device driver's choice to have all vectors shared
-the same interrupt service handler or each vector with a unique
-interrupt service handler.
-
-In addition to the function msi_alloc_vectors(), another function
-msi_free_vectors() is provided to allow the software driver to
-release a number of vectors back to the vector resources. Once
-invoked, the PCI subsystem disables (masks) each vector released.
-These vectors are no longer valid for the hardware device and its
-software driver to use. Like free_irq, it recommends that the
-device driver should also call msi_free_vectors to release all
-additional vectors previously requested.
-
-int msi_alloc_vectors(struct pci_dev *dev, int *vector, int nvec)
-
-This API enables the software driver to request the PCI subsystem
-for additional messages. Depending on the number of vectors
-available, the PCI subsystem enables either all or nothing.
+Unlike the function pci_enable_msi(), the function pci_enable_msix()
+does not replace the pre-assigned IOAPIC dev->irq with a new MSI
+vector because the PCI subsystem writes the 1:1 vector-to-entry mapping
+into the field vector of each element contained in a second argument.
+Note that the pre-assigned IO-APIC dev->irq is valid only if the device
+operates in PIN-IRQ assertion mode. In MSI-X mode, any attempt of
+using dev->irq by the device driver to request for interrupt service
+may result unpredictabe behavior.
+
+For each MSI-X vector granted, a device driver is responsible to call
+other functions like request_irq(), enable_irq(), etc. to enable
+this vector with its corresponding interrupt service handler. It is
+a device driver's choice to assign all vectors with the same
+interrupt service handler or each vector with a unique interrupt
+service handler.
+
+5.3.1 Handling MMIO address space of MSI-X Table
+
+The PCI 3.0 specification has implementation notes that MMIO address
+space for a device's MSI-X structure should be isolated so that the
+software system can set different page for controlling accesses to
+the MSI-X structure. The implementation of MSI patch requires the PCI
+subsystem, not a device driver, to maintain full control of the MSI-X
+table/MSI-X PBA and MMIO address space of the MSI-X table/MSI-X PBA.
+A device driver is prohibited from requesting the MMIO address space
+of the MSI-X table/MSI-X PBA. Otherwise, the PCI subsystem will fail
+enabling MSI-X on its hardware device when it calls the function
+pci_enable_msix().
+
+5.3.2 Handling MSI-X allocation
+
+Determining the number of MSI-X vectors allocated to a function is
+dependent on the number of MSI capable devices and MSI-X capable
+devices populated in the system. The policy of allocating MSI-X
+vectors to a function is defined as the following:
+
+#of MSI-X vectors allocated to a function = (x - y)/z where
+
+x = 	The number of available PCI vector resources by the time
+	the device driver calls pci_enable_msix(). The PCI vector
+	resources is the sum of the number of unassigned vectors
+	(new) and the number of released vectors when any MSI/MSI-X
+	device driver switches its hardware device back to a legacy
+	mode or is hot-removed.	The number of unassigned vectors
+	may exclude some vectors reserved, as defined in parameter
+	NR_HP_RESERVED_VECTORS, for the case where the system is
+	capable of supporting hot-add/hot-remove operations. Users
+	may change the value defined in NR_HR_RESERVED_VECTORS to
+	meet their specific needs.
+
+y =	The number of MSI capable devices populated in the system.
+	This policy ensures that each MSI capable device has its
+	vector reserved to avoid the case where some MSI-X capable
+	drivers may attempt to claim all available vector resources.
+
+z =	The number of MSI-X capable devices pupulated in the system.
+	This policy ensures that maximum (x - y) is distributed
+	evenly among MSI-X capable devices.
+
+Note that the PCI subsystem scans y and z during a bus enumeration.
+When the PCI subsystem completes configuring MSI/MSI-X capability
+structure of a device as requested by its device driver, y/z is
+decremented accordingly.
+
+5.3.3 Handling MSI-X shortages
+
+For the case where fewer MSI-X vectors are allocated to a function
+than requested, the function pci_enable_msix() will return the
+maximum number of MSI-X vectors available to the caller. A device
+driver may re-send its request with fewer or equal vectors indicated
+in a return. For example, if a device driver requests 5 vectors, but
+the number of available vectors is 3 vectors, a value of 3 will be a
+return as a result of pci_enable_msix() call. A function could be
+designed for its driver to use only 3 MSI-X table entries as
+different combinations as ABC--, A-B-C, A--CB, etc. Note that this
+patch does not support multiple entries with the same vector. Such
+attempt by a device driver to use 5 MSI-X table entries with 3 vectors
+as ABBCC, AABCC, BCCBA, etc will result as a failure by the function
+pci_enable_msix(). Below are the reasons why supporting multiple
+entries with the same vector is an undesirable solution.
+
+	- The PCI subsystem can not determine which entry, which
+	  generated the message, to mask/unmask MSI while handling
+	  software driver ISR. Attempting to walk through all MSI-X
+	  table entries (2048 max) to mask/unmask any match vector
+	  is an undesirable solution.
+
+	- Walk through all MSI-X table entries (2048 max) to handle
+	  SMP affinity of any match vector is an undesirable solution.
+
+5.3.4 API pci_enable_msix
+
+int pci_enable_msix(struct pci_dev *dev, u32 *entries, int nvec)
+
+This API enables a device driver to request the PCI subsystem
+for enabling MSI-X messages on its hardware device. Depending on
+the availability of PCI vectors resources, the PCI subsystem enables
+either all or nothing.
 
 Argument dev points to the device (pci_dev) structure.
-Argument vector is a pointer of integer type. The number of
-elements is indicated in argument nvec.
+
+Argument entries is a pointer of unsigned integer type. The number of
+elements is indicated in argument nvec. The content of each element
+will be mapped to the following struct defined in /driver/pci/msi.h.
+
+struct msix_entry {
+	u16 	vector; /* kernel uses to write alloc vector */
+	u16	entry; /* driver uses to specify entry */
+};
+
+A device driver is responsible for initializing the field entry of
+each element with unique entry supported by MSI-X table. Otherwise,
+-EINVAL will be returned as a result. A successful return of zero
+indicates the PCI subsystem completes initializing each of requested
+entries of the MSI-X table with message address and message data.
+Last but not least, the PCI subsystem will write the 1:1
+vector-to-entry mapping into the field vector of each element. A
+device driver is responsible of keeping track of allocated MSI-X
+vectors in its internal data structure.
+
 Argument nvec is an integer indicating the number of messages
 requested.
-A return of zero indicates that the number of allocated vector is
-successfully allocated. Otherwise, indicate resources not
-available.
-
-int msi_free_vectors(struct pci_dev* dev, int *vector, int nvec)
-
-This API enables the software driver to inform the PCI subsystem
-that it is willing to release a number of vectors back to the
-MSI resource pool. Once invoked, the PCI subsystem disables each
-MSI-X entry associated with each vector stored in the argument 2.
-These vectors are no longer valid for the hardware device and
-its software driver to use.
 
-Argument dev points to the device (pci_dev) structure.
-Argument vector is a pointer of integer type. The number of
-elements is indicated in argument nvec.
-Argument nvec is an integer indicating the number of messages
-released.
-A return of zero indicates that the number of allocated vectors
-is successfully released. Otherwise, indicates a failure.
+A return of zero indicates that the number of MSI-X vectors is
+successfully allocated. A return of greater than zero indicates
+MSI-X vector shortage. Or a return of less than zero indicates
+a failure. This failure may be a result of duplicate entries
+specified in second argument, or a result of no available vector,
+or a result of failing to initialize MSI-X table entries.
+
+5.3.5 API pci_disable_msix
+
+void pci_disable_msix(struct pci_dev *dev)
+
+This API should always be used to undo the effect of pci_enable_msix()
+when a device driver is unloading. Note that a device driver should
+always call free_irq() on all MSI-X vectors it has done request_irq()
+on before calling this API. Failure to do so results a BUG_ON() and
+a device will be left with MSI-X enabled and leaks its vectors.
+
+5.3.6 MSI-X mode vs. legacy mode diagram
+
+The below diagram shows the events, which switches the interrupt
+mode on the MSI-X capable device function between MSI-X mode and
+PIN-IRQ assertion mode (legacy).
+
+	 ------------   pci_enable_msix(,,n) ------------------------
+	|	     | <===============	    | 			     |
+	| MSI-X MODE |	  	     	    | PIN-IRQ ASSERTION MODE |
+	| 	     | ===============>	    |			     |
+ 	 ------------	pci_disable_msix     ------------------------
+
+Figure 2.0 MSI-X Mode vs. Legacy Mode
+
+In Figure 2.0, a device operates by default in legacy mode. A
+successful MSI-X request (using pci_enable_msix()) switches a
+device's interrupt mode to MSI-X mode. A pre-assigned IOAPIC vector
+stored in dev->irq will be saved by the PCI subsystem; however,
+unlike MSI mode, the PCI subsystem will not replace dev->irq with
+assigned MSI-X vector because the PCI subsystem already writes the 1:1
+vector-to-entry mapping into the field vector of each element
+specified in second argument.
+
+To return back to its default mode, a device driver should always call
+pci_disable_msix() to undo the effect of pci_enable_msix(). Note that
+a device driver should always call free_irq() on all MSI-X vectors it
+has done request_irq() on before calling pci_disable_msix(). Failure
+to do so results a BUG_ON() and a device will be left with MSI-X
+enabled and leaks its vectors. Otherwise, the PCI subsystem switches a
+device function's interrupt mode from MSI-X mode to legacy mode and
+marks all allocated MSI-X vectors as unused.
+
+Once being marked as unused, there is no guarantee that the PCI
+subsystem will reserve these MSI-X vectors for a device. Depending on
+the availability of current PCI vector resources and the number of
+MSI/MSI-X requests from other drivers, these MSI-X vectors may be
+re-assigned.
+
+For the case where the PCI subsystem re-assigned these MSI-X vectors
+to other driver, a request to switching back to MSI-X mode may result
+being assigned with another set of MSI-X vectors or a failure if no
+more vectors are available.
+
+5.4 Handling function implementng both MSI and MSI-X capabilities
+
+For the case where a function implements both MSI and MSI-X
+capabilities, the PCI subsystem enables a device to run either in MSI
+mode or MSI-X mode but not both. A device driver determines whether it
+wants MSI or MSI-X enabled on its hardware device. Once a device
+driver requests for MSI, for example, it is prohibited to request for
+MSI-X; in other words, a device driver is not permitted to ping-pong
+between MSI mod MSI-X mode during a run-time.
 
-5.4 Hardware requirements for MSI support
-MSI support requires support from both system hardware and
+5.5 Hardware requirements for MSI/MSI-X support
+MSI/MSI-X support requires support from both system hardware and
 individual hardware device functions.
 
-5.4.1 System hardware support
+5.5.1 System hardware support
 Since the target of MSI address is the local APIC CPU, enabling
-MSI support in Linux kernel is dependent on whether existing
+MSI/MSI-X support in Linux kernel is dependent on whether existing
 system hardware supports local APIC. Users should verify their
 system whether it runs when CONFIG_X86_LOCAL_APIC=y.
 
 In SMP environment, CONFIG_X86_LOCAL_APIC is automatically set;
 however, in UP environment, users must manually set
 CONFIG_X86_LOCAL_APIC. Once CONFIG_X86_LOCAL_APIC=y, setting
-CONFIG_PCI_USE_VECTOR enables the VECTOR based scheme and
+CONFIG_PCI_MSI enables the VECTOR based scheme and
 the option for MSI-capable device drivers to selectively enable
-MSI (using pci_enable_msi as described below).
+MSI/MSI-X.
 
-Note that CONFIG_X86_IO_APIC setting is irrelevant because MSI
-vector is allocated new during runtime and MSI support does not
-depend on BIOS support. This key independency enables MSI support
-on future IOxAPIC free platform.
+Note that CONFIG_X86_IO_APIC setting is irrelevant because MSI/MSI-X
+vector is allocated new during runtime and MSI/MSI-X support does not
+depend on BIOS support. This key independency enables MSI/MSI-X
+support on future IOxAPIC free platform.
 
-5.4.2 Device hardware support
+5.5.2 Device hardware support
 The hardware device function supports MSI by indicating the
 MSI/MSI-X capability structure on its PCI capability list. By
 default, this capability structure will not be initialized by
@@ -249,17 +430,19 @@
 MSI-capable hardware is responsible for whether calling
 pci_enable_msi or not. A return of zero indicates the kernel
 successfully initializes the MSI/MSI-X capability structure of the
-device funtion. The device function is now running on MSI mode.
+device funtion. The device function is now running on MSI/MSI-X mode.
 
-5.5 How to tell whether MSI is enabled on device function
+5.6 How to tell whether MSI/MSI-X is enabled on device function
 
-At the driver level, a return of zero from pci_enable_msi(...)
-indicates to the device driver that its device function is
-initialized successfully and ready to run in MSI mode.
+At the driver level, a return of zero from the function call of
+pci_enable_msi()/pci_enable_msix() indicates to a device driver that
+its device function is initialized successfully and ready to run in
+MSI/MSI-X mode.
 
 At the user level, users can use command 'cat /proc/interrupts'
-to display the vector allocated for the device and its interrupt
-mode, as shown below.
+to display the vector allocated for a device and its interrupt
+MSI/MSI-X mode ("PCI MSI"/"PCI MSIX"). Below shows below MSI mode is
+enabled on a SCSI Adaptec 39320D Ultra320.
 
            CPU0       CPU1
   0:     324639          0    IO-APIC-edge  timer
diff -urN linux-2.6.8-rc2/Documentation/arm/Booting linux-2.6.8-rc3/Documentation/arm/Booting
--- linux-2.6.8-rc2/Documentation/arm/Booting	2004-06-15 22:19:43.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/arm/Booting	2004-08-03 15:21:29.277420990 -0700
@@ -50,7 +50,7 @@
 option to the kernel via the tagged lists specifying the port, and
 serial format options as described in
 
-       linux/Documentation/kernel-parameters.txt.
+       Documentation/kernel-parameters.txt.
 
 
 3. Detect the machine type
diff -urN linux-2.6.8-rc2/Documentation/cdrom/aztcd linux-2.6.8-rc3/Documentation/cdrom/aztcd
--- linux-2.6.8-rc2/Documentation/cdrom/aztcd	2004-06-15 22:19:10.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/cdrom/aztcd	2004-08-03 15:21:29.734439738 -0700
@@ -1,5 +1,5 @@
 $Id: README.aztcd,v 2.60 1997/11/29 09:51:25 root Exp root $
-          Readme-File /usr/src/Documentation/cdrom/aztcd
+          Readme-File Documentation/cdrom/aztcd
            			for 
 	     AZTECH CD-ROM CDA268-01A, ORCHID CD-3110,
       OKANO/WEARNES CDD110, CONRAD TXC, CyCDROM CR520, CR540
@@ -524,7 +524,7 @@
 
 A reworked and improved version called 'cdtester.c', which has yet more
 features for testing CDROM-drives can be found in
-/usr/src/linux/Documentation/cdrom/sbpcd, written by E.Moenkeberg.
+Documentation/cdrom/sbpcd, written by E.Moenkeberg.
 
 Werner Zimmermann
 Fachhochschule fuer Technik Esslingen
diff -urN linux-2.6.8-rc2/Documentation/computone.txt linux-2.6.8-rc3/Documentation/computone.txt
--- linux-2.6.8-rc2/Documentation/computone.txt	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/computone.txt	2004-08-03 15:21:29.958448927 -0700
@@ -302,7 +302,7 @@
 To create the ip2mkdev shell script change to a convenient directory (/tmp
 works just fine) and run the following command:
 
-	unshar /usr/src/linux/Documentation/computone.txt
+	unshar Documentation/computone.txt
 		(This file)
 
 You should now have a file ip2mkdev in your current working directory with
diff -urN linux-2.6.8-rc2/Documentation/crypto/api-intro.txt linux-2.6.8-rc3/Documentation/crypto/api-intro.txt
--- linux-2.6.8-rc2/Documentation/crypto/api-intro.txt	2004-06-15 22:19:42.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/crypto/api-intro.txt	2004-08-03 15:21:30.085454137 -0700
@@ -215,6 +215,7 @@
   Herbert Valerio Riedel
   Kyle McMartin
   Adam J. Richter
+  Fruhwirth Clemens (i586)
 
 CAST5 algorithm contributors:
   Kartikey Mahendra Bhatt (original developers unknown, FSF copyright).
diff -urN linux-2.6.8-rc2/Documentation/digiepca.txt linux-2.6.8-rc3/Documentation/digiepca.txt
--- linux-2.6.8-rc2/Documentation/digiepca.txt	2004-06-15 22:18:52.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/digiepca.txt	2004-08-03 15:21:30.141456435 -0700
@@ -60,7 +60,7 @@
 Supporting Tools:
 -----------------
 Supporting tools include digiDload, digiConfig, buildPCI, and ditty.  See
-/usr/src/linux/Documentation/README.epca.dir/user.doc for more details.  Note,
+drivers/char/README.epca for more details.  Note,
 this driver REQUIRES that digiDload be executed prior to it being used. 
 Failure to do this will result in an ENODEV error.
 
diff -urN linux-2.6.8-rc2/Documentation/dvb/firmware.txt linux-2.6.8-rc3/Documentation/dvb/firmware.txt
--- linux-2.6.8-rc2/Documentation/dvb/firmware.txt	2004-06-15 22:19:44.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/dvb/firmware.txt	2004-08-03 15:21:30.194458609 -0700
@@ -2,7 +2,7 @@
 binary-only firmware.
 
 The DVB drivers will be converted to use the request_firmware()
-hotplug interface (see linux/Documentation/firmware_class/).
+hotplug interface (see Documentation/firmware_class/).
 (CONFIG_FW_LOADER)
 
 The firmware can be loaded automatically via the hotplug manager
diff -urN linux-2.6.8-rc2/Documentation/dvb/ttusb-dec.txt linux-2.6.8-rc3/Documentation/dvb/ttusb-dec.txt
--- linux-2.6.8-rc2/Documentation/dvb/ttusb-dec.txt	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/dvb/ttusb-dec.txt	2004-08-03 15:21:30.194458609 -0700
@@ -57,7 +57,7 @@
 Hotplug Firmware Loading for 2.6 kernels
 ----------------------------------------
 For 2.6 kernels the firmware is loaded at the point that the driver module is
-loaded.  See linux/Documentation/dvb/firmware.txt for more information.
+loaded.  See Documentation/dvb/firmware.txt for more information.
 
 mv STB_PC_T.bin /usr/lib/hotplug/firmware/dvb-ttusb-dec-2000t.fw
 mv STB_PC_X.bin /usr/lib/hotplug/firmware/dvb-ttusb-dec-2540t.fw
diff -urN linux-2.6.8-rc2/Documentation/filesystems/proc.txt linux-2.6.8-rc3/Documentation/filesystems/proc.txt
--- linux-2.6.8-rc2/Documentation/filesystems/proc.txt	2004-08-03 15:21:04.081387697 -0700
+++ linux-2.6.8-rc3/Documentation/filesystems/proc.txt	2004-08-03 15:21:30.525472188 -0700
@@ -1232,6 +1232,18 @@
 hugetlb_shm_group contains group id that is allowed to create SysV shared
 memory segment using hugetlb page.
 
+laptop_mode
+-----------
+
+laptop_mode is a knob that controls "laptop mode". All the things that are
+controlled by this knob are discussed in Documentation/laptop-mode.txt.
+
+block_dump
+----------
+
+block_dump enables block I/O debugging when set to a nonzero value. More
+information on block I/O debugging is in Documentation/laptop-mode.txt.
+
 2.5 /proc/sys/dev - Device specific parameters
 ----------------------------------------------
 
diff -urN linux-2.6.8-rc2/Documentation/filesystems/udf.txt linux-2.6.8-rc3/Documentation/filesystems/udf.txt
--- linux-2.6.8-rc2/Documentation/filesystems/udf.txt	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/filesystems/udf.txt	2004-08-03 15:21:30.548473132 -0700
@@ -1,5 +1,5 @@
 *
-* ./Documentation/filesystems/udf.txt
+* Documentation/filesystems/udf.txt
 *
 UDF Filesystem version 0.9.8.1
 
diff -urN linux-2.6.8-rc2/Documentation/filesystems/vfat.txt linux-2.6.8-rc3/Documentation/filesystems/vfat.txt
--- linux-2.6.8-rc2/Documentation/filesystems/vfat.txt	2004-08-03 15:21:04.082387738 -0700
+++ linux-2.6.8-rc3/Documentation/filesystems/vfat.txt	2004-08-03 15:21:30.569473993 -0700
@@ -19,18 +19,23 @@
 
 codepage=###  -- Sets the codepage number for converting to shortname
 		 characters on FAT filesystem.
-		 By default, FAT_DEFAULT_CODEPAGE setting is used.
+
+		 NOTE: If this option was not specified, the file name
+		 may not be read/written rightly, also filesystem is
+		 mounted as read-only.
 
 iocharset=name -- Character set to use for converting between the
 		 encoding is used for user visible filename and 16 bit
 		 Unicode characters. Long filenames are stored on disk
 		 in Unicode format, but Unix for the most part doesn't
 		 know how to deal with Unicode.
-		 By default, FAT_DEFAULT_IOCHARSET setting is used.
-
 		 There is also an option of doing UTF8 translations
 		 with the utf8 option.
 
+		 NOTE: If this option was not specified, the file name
+		 may not be read/written rightly, also filesystem is
+		 mounted as read-only.
+
 		 NOTE: "iocharset=utf8" is not recommended. If unsure,
 		 you should consider the following option instead.
 
diff -urN linux-2.6.8-rc2/Documentation/i386/boot.txt linux-2.6.8-rc3/Documentation/i386/boot.txt
--- linux-2.6.8-rc2/Documentation/i386/boot.txt	2004-06-15 22:19:42.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/i386/boot.txt	2004-08-03 15:21:30.665477932 -0700
@@ -334,7 +334,7 @@
 though not all of them are actually meaningful to the kernel.  Boot
 loader authors who need additional command line options for the boot
 loader itself should get them registered in
-linux/Documentation/kernel-parameters.txt to make sure they will not
+Documentation/kernel-parameters.txt to make sure they will not
 conflict with actual kernel options now or in the future.
 
   vga=<mode>
diff -urN linux-2.6.8-rc2/Documentation/kbuild/modules.txt linux-2.6.8-rc3/Documentation/kbuild/modules.txt
--- linux-2.6.8-rc2/Documentation/kbuild/modules.txt	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/kbuild/modules.txt	2004-08-03 15:21:30.696479204 -0700
@@ -23,7 +23,7 @@
 module outside the kernel is to use the kernel build system,
 kbuild. Use the following command-line:
 
-make -C path/to/kernel/src SUBDIRS=$PWD modules
+make -C path/to/kernel/src M=$PWD modules
 
 This requires that a makefile exits made in accordance to
 Documentation/kbuild/makefiles.txt. Read that file for more details on
@@ -65,4 +65,4 @@
 # Invokes the kernel build system to come back to the current
 # directory and build yourmodule.ko.
 default:
-	make -C ${KERNEL_SOURCE} SUBDIRS=`pwd` modules
+	make -C ${KERNEL_SOURCE} M=`pwd` modules
diff -urN linux-2.6.8-rc2/Documentation/laptop-mode.txt linux-2.6.8-rc3/Documentation/laptop-mode.txt
--- linux-2.6.8-rc2/Documentation/laptop-mode.txt	2004-08-03 15:21:04.126389540 -0700
+++ linux-2.6.8-rc3/Documentation/laptop-mode.txt	2004-08-03 15:21:30.818484209 -0700
@@ -3,12 +3,12 @@
 
 Document Author: Bart Samwel (bart@samwel.tk)
 Date created: January 2, 2004
-Last modified: April 3, 2004
+Last modified: July 10, 2004
 
 Introduction
 ------------
 
-Laptopmode is used to minimize the time that the hard disk needs to be spun up,
+Laptop mode is used to minimize the time that the hard disk needs to be spun up,
 to conserve battery power on laptops. It has been reported to cause significant
 power savings.
 
@@ -16,46 +16,43 @@
 --------
 
 * Introduction
-* The short story
+* Installation
 * Caveats
-* The details
+* The Details
 * Tips & Tricks
 * Control script
 * ACPI integration
 * Monitoring tool
 
 
-The short story
----------------
+Installation
+------------
 
 To use laptop mode, you don't need to set any kernel configuration options
-or anything. You simply need to run the laptop_mode control script (which
-is included in this document) as follows:
-
-# laptop_mode start
-
-Then set your harddisk spindown time to a relatively low value with hdparm:
-
-hdparm -S 4 /dev/hda
-
-The value -S 4 means 20 seconds idle time before spindown. Your harddisk will
-now only spin up when a disk cache miss occurs, or at least once every 10
-minutes to write back any pending changes.
-
-To stop laptop_mode, run "laptop_mode stop".
+or anything. Simply install all the files included in this document, and
+laptop mode will automatically be started when you're on battery. For
+your convenience, a tarball containing an installer can be downloaded at:
+
+http://www.xs4all.nl/~bsamwel/laptop_mode/tools
+
+To configure laptop mode, you need to edit the configuration file, which is
+located in /etc/default/laptop-mode on Debian-based systems, or in
+/etc/sysconfig/laptop-mode on other systems.
+
+Unfortunately, automatic enabling of laptop mode does not work for
+laptops that don't have ACPI. On those laptops, you need to start laptop
+mode manually. To start laptop mode, run "laptop_mode start", and to
+stop it, run "laptop_mode stop". (Note: The laptop mode tools package now
+has experimental support for APM, you might want to try that first.)
 
 
 Caveats
 -------
 
-* The downside of laptop mode is that you have a chance of losing up
-  to 10 minutes of work. If you cannot afford this, don't use it! It's
-  wise to turn OFF laptop mode when you're almost out of battery --
-  although this will make the battery run out faster, at least you'll
-  lose less work when it actually runs out. I'm still looking for someone
-  to submit instructions on how to turn off laptop mode when battery is low,
-  e.g., using ACPI events. I don't have a laptop myself, so if you do and
-  you care to contribute such instructions, please do.
+* The downside of laptop mode is that you have a chance of losing up to 10
+  minutes of work. If you cannot afford this, don't use it! The supplied ACPI
+  scripts automatically turn off laptop mode when the battery almost runs out,
+  so that you won't lose any data at the end of your battery life.
 
 * Most desktop hard drives have a very limited lifetime measured in spindown
   cycles, typically about 50.000 times (it's usually listed on the spec sheet).
@@ -69,23 +66,27 @@
 
 * If you have your filesystems listed as type "auto" in fstab, like I did, then
   the control script will not recognize them as filesystems that need remounting.
+  You must list the filesystems with their true type instead.
 
 * It has been reported that some versions of the mutt mail client use file access
   times to determine whether a folder contains new mail. If you use mutt and
-  experience this, you must disable the noatime remounting in the control script
-  by setting DO_REMOUNT_NOATIME=0.
+  experience this, you must disable the noatime remounting by setting the option
+  DO_REMOUNT_NOATIME to 0 in the configuration file.
 
 
-The details
+The Details
 -----------
 
-Laptop-mode is controlled by the flag /proc/sys/vm/laptop_mode. This flag is
+Laptop mode is controlled by the knob /proc/sys/vm/laptop_mode. This knob is
 present for all kernels that have the laptop mode patch, regardless of any
-configuration options. When the flag is set, any physical disk read operation
-(that might have caused the hard disk to spin up) causes Linux to flush all dirty
-blocks. The result of this is that after a disk has spun down, it will not be spun
-up anymore to write dirty blocks, because those blocks had already been written
-immediately after the most recent read operation.
+configuration options. When the knob is set, any physical disk I/O (that might
+have caused the hard disk to spin up) causes Linux to flush all dirty blocks. The
+result of this is that after a disk has spun down, it will not be spun up
+anymore to write dirty blocks, because those blocks had already been written
+immediately after the most recent read operation. The value of the laptop_mode
+knob determines the time between the occurrence of disk I/O and when the flush
+is triggered. A sensible value for the knob is 5 seconds. Setting the knob to
+0 disables laptop mode.
 
 To increase the effectiveness of the laptop_mode strategy, the laptop_mode
 control script increases dirty_expire_centisecs and dirty_writeback_centisecs in
@@ -104,32 +105,102 @@
 all block dirtyings done to files. This makes it possible to debug why a disk
 needs to spin up, and to increase battery life even more. The output of
 block_dump is written to the kernel output, and it can be retrieved using
-"dmesg". When you use block_dump, you may want to turn off klogd, otherwise
+"dmesg". When you use block_dump and your kernel logging level also includes
+kernel debugging messages, you probably want to turn off klogd, otherwise
 the output of block_dump will be logged, causing disk activity that is not
 normally there.
 
-If 10 minutes is too much or too little downtime for you, you can configure
-this downtime as follows. In the control script, set the MAX_AGE value to the
-maximum number of seconds of disk downtime that you would like. You should
-then set your filesystem's commit interval to the same value. The dirty ratio
-is also configurable from the control script.
 
-If you don't like the idea of the control script remounting your filesystems
-for you, you can change DO_REMOUNTS to 0 in the script.
+Configuration
+-------------
+
+The laptop mode configuration file is located in /etc/default/laptop-mode on
+Debian-based systems, or in /etc/sysconfig/laptop-mode on other systems. It
+contains the following options:
+
+MAX_AGE:
+
+Maximum time, in seconds, of hard drive spindown time that you are
+confortable with. Worst case, it's possible that you could lose this
+amount of work if your battery fails while you're in laptop mode.
+
+MINIMUM_BATTERY_MINUTES:
+
+Automatically disable laptop mode if the remaining number of minutes of
+battery power is less than this value. Default is 10 minutes.
+
+AC_HD/BATT_HD:
+
+The idle timeout that should be set on your hard drive when laptop mode
+is active (BATT_HD) and when it is not active (AC_HD). The defaults are
+20 seconds (value 4) for BATT_HD  and 2 hours (value 244) for AC_HD. The
+possible values are those listed in the manual page for "hdparm" for the
+"-S" option.
+
+HD:
+
+The devices for which the spindown timeout should be adjusted by laptop mode.
+Default is /dev/hda. If you specify multiple devices, separate them by a space.
+
+READAHEAD:
+
+Disk readahead, in 512-byte sectors, while laptop mode is active. A large
+readahead can prevent disk accesses for things like executable pages (which are
+loaded on demand while the application executes) and sequentially accessed data
+(MP3s).
+
+DO_REMOUNTS:
 
-Thanks to Kiko Piris, the control script can be used to enable laptop mode on
-both the Linux 2.4 and 2.6 series.
+The control script automatically remounts any mounted journaled filesystems
+with approriate commit interval options. When this option is set to 0, this
+feature is disabled.
+
+DO_REMOUNT_NOATIME:
+
+When remounting, should the filesystems be remounted with the noatime option?
+Normally, this is set to "1" (enabled), but there may be programs that require
+access time recording.
+
+DIRTY_RATIO:
+
+The percentage of memory that is allowed to contain "dirty" or unsaved data
+before a writeback is forced, while laptop mode is active. Corresponds to
+the /proc/sys/vm/dirty_ratio sysctl.
+
+DIRTY_BACKGROUND_RATIO:
+
+The percentage of memory that is allowed to contain "dirty" or unsaved data
+after a forced writeback is done due to an exceeding of DIRTY_RATIO. Set
+this nice and low. This corresponds to the /proc/sys/vm/dirty_background_ratio
+sysctl.
+
+Note that the behaviour of dirty_background_ratio is quite different
+when laptop mode is active and when it isn't. When laptop mode is inactive,
+dirty_background_ratio is the threshold percentage at which background writeouts
+start taking place. When laptop mode is active, however, background writeouts
+are disabled, and the dirty_background_ratio only determines how much writeback
+is done when dirty_ratio is reached.
+
+DO_CPU:
+
+Enable CPU frequency scaling when in laptop mode. (Requires CPUFreq to be setup.
+See Documentation/cpu-freq/user-guide.txt for more info. Disabled by default.)
+
+CPU_MAXFREQ:
+
+When on battery, what is the maximum CPU speed that the system should use? Legal
+values are "slowest" for the slowest speed that your CPU is able to operate at,
+or a value listed in /sys/devices/system/cpu/cpu0/cpufreq/scaling_available_frequencies.
 
 
 Tips & Tricks
 -------------
 
 * Bartek Kania reports getting up to 50 minutes of extra battery life (on top
-  of his regular 3 to 3.5 hours) using very aggressive power management (hdparm
-  -B1) and a spindown time of 5 seconds (hdparm -S1).
+  of his regular 3 to 3.5 hours) using a spindown time of 5 seconds (BATT_HD=1).
 
-* You can spin down the disk while playing MP3, by setting the disk readahead
-  to 8MB (hdparm -a 16384). Effectively, the disk will read a complete MP3 at
+* You can spin down the disk while playing MP3, by setting disk readahead
+  to 8MB (READAHEAD=16384). Effectively, the disk will read a complete MP3 at
   once, and will then spin down while the MP3 is playing. (Thanks to Bartek
   Kania.)
 
@@ -138,18 +209,6 @@
   this on powerbooks too. I hope that this is a piece of information that
   might be useful to the Laptop Mode patch or it's users."
 
-* One thing which will cause disks to spin up is not-present application
-  and dynamic library text pages.  The kernel will load program text off disk
-  on-demand, so each time you invoke an application feature for the first
-  time, the kernel needs to spin the disk up to go and fetch that part of the
-  application.
-
-  So it is useful to increase the disk readahead parameter greatly, so that
-  the kernel will pull all of the executable's pages into memory on the first
-  pagefault.
-
-  The supplied script does this.
-
 * In syslog.conf, you can prefix entries with a dash ``-'' to omit syncing the
   file after every logging. When you're using laptop-mode and your disk doesn't
   spin down, this is a likely culprit.
@@ -158,13 +217,108 @@
   (http://noflushd.sourceforge.net/), it seems that noflushd prevents laptop-mode
   from doing its thing.
 
+* If you're worried about your data, you might want to consider using a USB
+  memory stick or something like that as a "working area". (Be aware though
+  that flash memory can only handle a limited number of writes, and overuse
+  may wear out your memory stick pretty quickly. Do _not_ use journalling
+  filesystems on flash memory sticks.)
+
+
+Configuration file for control and ACPI battery scripts
+-------------------------------------------------------
+
+This allows the tunables to be changed for the scripts via an external
+configuration file
+
+It should be installed as /etc/default/laptop-mode on Debian, and as
+/etc/sysconfig/laptop-mode on Red Hat, SUSE, Mandrake, and other work-alikes.
+
+--------------------CONFIG FILE BEGIN-------------------------------------------
+# Maximum time, in seconds, of hard drive spindown time that you are
+# confortable with. Worst case, it's possible that you could lose this
+# amount of work if your battery fails you while in laptop mode.
+#MAX_AGE=600
+
+# Automatically disable laptop mode when the number of minutes of battery
+# that you have left goes below this threshold.
+MINIMUM_BATTERY_MINUTES=10
+
+# Read-ahead, in 512-byte sectors. You can spin down the disk while playing MP3/OGG
+# by setting the disk readahead to 8MB (READAHEAD=16384). Effectively, the disk
+# will read a complete MP3 at once, and will then spin down while the MP3/OGG is
+# playing.
+#READAHEAD=4096
+
+# Shall we remount journaled fs. with appropiate commit interval? (1=yes)
+#DO_REMOUNTS=1
+
+# And shall we add the "noatime" option to that as well? (1=yes)
+#DO_REMOUNT_NOATIME=1
+
+# Dirty synchronous ratio.  At this percentage of dirty pages the process
+# which
+# calls write() does its own writeback
+#DIRTY_RATIO=40
+
+#
+# Allowed dirty background ratio, in percent.  Once DIRTY_RATIO has been
+# exceeded, the kernel will wake pdflush which will then reduce the amount
+# of dirty memory to dirty_background_ratio.  Set this nice and low, so once
+# some writeout has commenced, we do a lot of it.
+#
+#DIRTY_BACKGROUND_RATIO=5
+
+# kernel default dirty buffer age
+#DEF_AGE=30
+#DEF_UPDATE=5
+#DEF_DIRTY_BACKGROUND_RATIO=10
+#DEF_DIRTY_RATIO=40
+#DEF_XFS_AGE_BUFFER=15
+#DEF_XFS_SYNC_INTERVAL=30
+#DEF_XFS_BUFD_INTERVAL=1
+
+# This must be adjusted manually to the value of HZ in the running kernel
+# on 2.4, until the XFS people change their 2.4 external interfaces to work in
+# centisecs. This can be automated, but it's a work in progress that still
+# needs# some fixes. On 2.6 kernels, XFS uses USER_HZ instead of HZ for
+# external interfaces, and that is currently always set to 100. So you don't
+# need to change this on 2.6.
+#XFS_HZ=100
+
+# Should the maximum CPU frequency be adjusted down while on battery?
+# Requires CPUFreq to be setup.
+# See Documentation/cpu-freq/user-guide.txt for more info
+#DO_CPU=0
+
+# When on battery what is the maximum CPU speed that the system should
+# use? Legal values are "slowest" for the slowest speed that your
+# CPU is able to operate at, or a value listed in:
+# /sys/devices/system/cpu/cpu0/cpufreq/scaling_available_frequencies
+# Only applicable if DO_CPU=1.
+#CPU_MAXFREQ=slowest
+
+# Idle timeout for your hard drive (man hdparm for valid values, -S option)
+# Default is 2 hours on AC (AC_HD=244) and 20 seconds for battery (BATT_HD=4).
+#AC_HD=244
+#BATT_HD=4
+
+# The drives for which to adjust the idle timeout. Separate them by a space,
+# e.g. HD="/dev/hda /dev/hdb".
+#HD="/dev/hda"
+
+# Set the spindown timeout on a hard drive?
+#DO_HD=1
+
+--------------------CONFIG FILE END---------------------------------------------
+
 
 Control script
 --------------
 
-Please note that this control script works for the Linux 2.4 and 2.6 series.
+Please note that this control script works for the Linux 2.4 and 2.6 series (thanks
+to Kiko Piris).
 
---------------------CONTROL SCRIPT BEGIN------------------------------------------
+--------------------CONTROL SCRIPT BEGIN----------------------------------------
 #!/bin/bash
 
 # start or stop laptop_mode, best run by a power management daemon when
@@ -183,21 +337,50 @@
 
 #############################################################################
 
-# Age time, in seconds. should be put into a sysconfig file
-MAX_AGE=600
+# Source config
+if [ -f /etc/default/laptop-mode ] ; then
+	# Debian
+	. /etc/default/laptop-mode
+elif [ -f /etc/sysconfig/laptop-mode ] ; then
+	# Others
+        . /etc/sysconfig/laptop-mode
+fi
+
+# Don't raise an error if the config file is incomplete
+# set defaults instead:
+
+# Maximum time, in seconds, of hard drive spindown time that you are
+# confortable with. Worst case, it's possible that you could lose this
+# amount of work if your battery fails you while in laptop mode.
+MAX_AGE=${MAX_AGE:-'600'}
 
 # Read-ahead, in kilobytes
-READAHEAD=4096
+READAHEAD=${READAHEAD:-'4096'}
 
 # Shall we remount journaled fs. with appropiate commit interval? (1=yes)
-DO_REMOUNTS=1
+DO_REMOUNTS=${DO_REMOUNTS:-'1'}
 
 # And shall we add the "noatime" option to that as well? (1=yes)
-DO_REMOUNT_NOATIME=1
+DO_REMOUNT_NOATIME=${DO_REMOUNT_NOATIME:-'1'}
+
+# Shall we adjust the idle timeout on a hard drive?
+DO_HD=${DO_HD:-'1'}
+
+# Adjust idle timeout on which hard drive?
+HD="${HD:-'/dev/hda'}"
+
+# spindown time for HD (hdparm -S values)
+AC_HD=${AC_HD:-'244'}
+BATT_HD=${BATT_HD:-'4'}
 
 # Dirty synchronous ratio.  At this percentage of dirty pages the process which
 # calls write() does its own writeback
-DIRTY_RATIO=40
+DIRTY_RATIO=${DIRTY_RATIO:-'40'}
+
+# cpu frequency scaling
+# See Documentation/cpu-freq/user-guide.txt for more info
+DO_CPU=${CPU_MANAGE:-'0'}
+CPU_MAXFREQ=${CPU_MAXFREQ:-'slowest'}
 
 #
 # Allowed dirty background ratio, in percent.  Once DIRTY_RATIO has been
@@ -205,16 +388,16 @@
 # of dirty memory to dirty_background_ratio.  Set this nice and low, so once
 # some writeout has commenced, we do a lot of it.
 #
-DIRTY_BACKGROUND_RATIO=5
+DIRTY_BACKGROUND_RATIO=${DIRTY_BACKGROUND_RATIO:-'5'}
 
 # kernel default dirty buffer age
-DEF_AGE=30
-DEF_UPDATE=5
-DEF_DIRTY_BACKGROUND_RATIO=10
-DEF_DIRTY_RATIO=40
-DEF_XFS_AGE_BUFFER=15
-DEF_XFS_SYNC_INTERVAL=30
-DEF_XFS_BUFD_INTERVAL=1
+DEF_AGE=${DEF_AGE:-'30'}
+DEF_UPDATE=${DEF_UPDATE:-'5'}
+DEF_DIRTY_BACKGROUND_RATIO=${DEF_DIRTY_BACKGROUND_RATIO:-'10'}
+DEF_DIRTY_RATIO=${DEF_DIRTY_RATIO:-'40'}
+DEF_XFS_AGE_BUFFER=${DEF_XFS_AGE_BUFFER:-'15'}
+DEF_XFS_SYNC_INTERVAL=${DEF_XFS_SYNC_INTERVAL:-'30'}
+DEF_XFS_BUFD_INTERVAL=${DEF_XFS_BUFD_INTERVAL:-'1'}
 
 # This must be adjusted manually to the value of HZ in the running kernel
 # on 2.4, until the XFS people change their 2.4 external interfaces to work in
@@ -222,7 +405,7 @@
 # some fixes. On 2.6 kernels, XFS uses USER_HZ instead of HZ for external
 # interfaces, and that is currently always set to 100. So you don't need to
 # change this on 2.6.
-XFS_HZ=100
+XFS_HZ=${XFS_HZ:-'100'}
 
 #############################################################################
 
@@ -342,6 +525,20 @@
 	fi
 }
 
+deduce_fstype () {
+	MP="$1"
+	# My root filesystem unfortunately has
+	# type "unknown" in /etc/mtab. If we encounter
+	# "unknown", we try to get the type from fstab.
+	cat /etc/fstab |
+	grep -v '^#' |
+	while read FSTAB_DEV FSTAB_MP FSTAB_FST FSTAB_OPTS FSTAB_DUMP FSTAB_DUMP ; do
+		if [ "$FSTAB_MP" = "$MP" ]; then
+			echo $FSTAB_FST
+			exit 0
+		fi
+	done
+}
 
 if [ $DO_REMOUNT_NOATIME -eq 1 ] ; then
 	NOATIME_OPT=",noatime"
@@ -395,6 +592,9 @@
 		if [ $DO_REMOUNTS -eq 1 ]; then
 			cat /etc/mtab | while read DEV MP FST OPTS DUMP PASS ; do
 				PARSEDOPTS="$(parse_mount_opts "$OPTS")"
+				if [ "$FST" = 'unknown' ]; then
+					FST=$(deduce_fstype $MP)
+				fi
 				case "$FST" in
 					"ext3"|"reiserfs")
 						PARSEDOPTS="$(parse_mount_opts commit "$OPTS")"
@@ -409,6 +609,18 @@
 				fi
 			done
 		fi
+		if [ $DO_HD -eq 1 ] ; then
+			for THISHD in $HD ; do
+				/sbin/hdparm -S $BATT_HD $THISHD > /dev/null 2>&1
+				/sbin/hdparm -B 1 $THISHD > /dev/null 2>&1
+			done
+		fi
+		if [ $DO_CPU -eq 1 -a -e /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq ]; then
+			if [ $CPU_MAXFREQ = 'slowest' ]; then
+				CPU_MAXFREQ=`cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq`
+			fi
+			echo $CPU_MAXFREQ > /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
+		fi
 		echo "."
 		;;
 	stop)
@@ -440,6 +652,9 @@
 		if [ $DO_REMOUNTS -eq 1 ] ; then
 			cat /etc/mtab | while read DEV MP FST OPTS DUMP PASS ; do
 				# Reset commit and atime options to defaults.
+				if [ "$FST" = 'unknown' ]; then
+					FST=$(deduce_fstype $MP)
+				fi
 				case "$FST" in
 					"ext3"|"reiserfs")
 						PARSEDOPTS="$(parse_mount_opts_wfstab $DEV commit $OPTS)"
@@ -456,6 +671,15 @@
 				fi
 			done
 		fi
+		if [ $DO_HD -eq 1 ] ; then
+			for THISHD in $HD ; do
+				/sbin/hdparm -S $AC_HD $THISHD > /dev/null 2>&1
+				/sbin/hdparm -B 255 $THISHD > /dev/null 2>&1
+			done
+		fi
+		if [ $DO_CPU -eq 1 -a -e /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq ]; then
+			echo `cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq` > /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq
+		fi
 		echo "."
 		;;
 	*)
@@ -466,56 +690,90 @@
 esac
 
 exit 0
---------------------CONTROL SCRIPT END--------------------------------------------
+--------------------CONTROL SCRIPT END------------------------------------------
 
 
 ACPI integration
 ----------------
 
 Dax Kelson submitted this so that the ACPI acpid daemon will
-kick off the laptop_mode script and run hdparm.
+kick off the laptop_mode script and run hdparm. The part that
+automatically disables laptop mode when the battery is low was
+writen by Jan Topinski.
 
----------------------------/etc/acpi/events/ac_adapter BEGIN-------------------------------------------
+-----------------/etc/acpi/events/ac_adapter BEGIN------------------------------
 event=ac_adapter
-action=/etc/acpi/actions/battery.sh
----------------------------/etc/acpi/events/ac_adapter END-------------------------------------------
+action=/etc/acpi/actions/ac.sh %e
+----------------/etc/acpi/events/ac_adapter END---------------------------------
+
 
----------------------------/etc/acpi/actions/battery.sh BEGIN-------------------------------------------
-#!/bin/sh
+-----------------/etc/acpi/events/battery BEGIN---------------------------------
+event=battery.*
+action=/etc/acpi/actions/battery.sh %e
+----------------/etc/acpi/events/battery END------------------------------------
 
-# cpu throttling
-# cat /proc/acpi/processor/CPU0/throttling for more info
-ACAD_THR=0
-BATT_THR=2
 
-# spindown time for HD (man hdparm for valid values)
-# I prefer 2 hours for acad and 20 seconds for batt
-ACAD_HD=244
-BATT_HD=4
+----------------/etc/acpi/actions/ac.sh BEGIN-----------------------------------
+#!/bin/bash
 
-# ac/battery event handler
+# ac on/offline event handler
 
-status=`awk '/^state: / { print $2 }' /proc/acpi/ac_adapter/AC/state`
+status=`awk '/^state: / { print $2 }' /proc/acpi/ac_adapter/$2/state`
 
 case $status in
         "on-line")
-                echo "Setting HD spindown for AC mode."
                 /sbin/laptop_mode stop
-                /sbin/hdparm -S $ACAD_HD /dev/hda > /dev/null 2>&1
-                /sbin/hdparm -B 255 /dev/hda > /dev/null 2>&1
-                #echo -n $ACAD_CPU:$ACAD_THR > /proc/acpi/processor/CPU0/limit
                 exit 0
         ;;
         "off-line")
-                echo "Setting HD spindown for battery mode."
                 /sbin/laptop_mode start
-                /sbin/hdparm -S $BATT_HD /dev/hda > /dev/null 2>&1
-                /sbin/hdparm -B 1 /dev/hda > /dev/null 2>&1
-                #echo -n $BATT_CPU:$BATT_THR > /proc/acpi/processor/CPU0/limit
                 exit 0
         ;;
 esac
----------------------------/etc/acpi/actions/battery.sh END-------------------------------------------
+---------------------------/etc/acpi/actions/ac.sh END--------------------------
+
+
+---------------------------/etc/acpi/actions/battery.sh BEGIN-------------------
+#! /bin/bash
+
+# Automatically disable laptop mode when the battery almost runs out.
+
+BATT_INFO=/proc/acpi/battery/$2/state
+
+if [[ -f /proc/sys/vm/laptop_mode ]]
+then
+   LM=`cat /proc/sys/vm/laptop_mode`
+   if [[ $LM -gt 0 ]]
+   then
+     if [[ -f $BATT_INFO ]]
+     then
+        # Source the config file only now that we know we need
+        if [ -f /etc/default/laptop-mode ] ; then
+                # Debian
+                . /etc/default/laptop-mode
+        elif [ -f /etc/sysconfig/laptop-mode ] ; then
+                # Others
+                . /etc/sysconfig/laptop-mode
+        fi
+        MINIMUM_BATTERY_MINUTES=${MINIMUM_BATTERY_MINUTES:-'10'}
+
+        ACTION="`cat $BATT_INFO | grep charging | cut -c 26-`"
+        if [[ ACTION -eq "discharging" ]]
+        then
+           PRESENT_RATE=`cat $BATT_INFO | grep "present rate:" | sed  "s/.* \([0-9][0-9]* \).*/\1/" `
+           REMAINING=`cat $BATT_INFO | grep "remaining capacity:" | sed  "s/.* \([0-9][0-9]* \).*/\1/" `
+        fi
+        if (($REMAINING * 60 / $PRESENT_RATE < $MINIMUM_BATTERY_MINUTES))
+        then
+           /sbin/laptop_mode stop
+        fi
+     else
+       logger -p daemon.warning "You are using laptop mode and your battery interface $BATT_INFO is missing. This may lead to loss of data when the battery runs out. Check kernel ACPI support and /proc/acpi/battery folder, and edit /etc/acpi/battery.sh to set BATT_INFO to the correct path."
+     fi
+   fi
+fi
+---------------------------/etc/acpi/actions/battery.sh END--------------------
+
 
 Monitoring tool
 ---------------
@@ -523,7 +781,7 @@
 Bartek Kania submitted this, it can be used to measure how much time your disk
 spends spun up/down.
 
----------------------------dslm.c BEGIN-------------------------------------------
+---------------------------dslm.c BEGIN-----------------------------------------
 /*
  * Simple Disk Sleep Monitor
  *  by Bartek Kania
@@ -689,4 +947,4 @@
 
     return 0;
 }
----------------------------dslm.c END---------------------------------------------
+---------------------------dslm.c END-------------------------------------------
diff -urN linux-2.6.8-rc2/Documentation/locks.txt linux-2.6.8-rc3/Documentation/locks.txt
--- linux-2.6.8-rc2/Documentation/locks.txt	2004-06-15 22:19:43.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/locks.txt	2004-08-03 15:21:30.846485357 -0700
@@ -19,7 +19,7 @@
 
 This should not cause problems for anybody, since everybody using a
 2.1.x kernel should have updated their C library to a suitable version
-anyway (see the file "linux/Documentation/Changes".)
+anyway (see the file "Documentation/Changes".)
 
 1.2 Allow Mixed Locks Again
 ---------------------------
diff -urN linux-2.6.8-rc2/Documentation/networking/Configurable linux-2.6.8-rc3/Documentation/networking/Configurable
--- linux-2.6.8-rc2/Documentation/networking/Configurable	2004-06-15 22:19:44.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/networking/Configurable	2004-08-03 15:21:30.883486875 -0700
@@ -7,7 +7,7 @@
 The current list of parameters can be found in the files:
 
 	linux/net/TUNABLE
-	linux/Documentation/networking/ip-sysctl.txt
+	Documentation/networking/ip-sysctl.txt
 
 Some of these are accessible via the sysctl interface, and many more are
 scheduled to be added in this way. For example, some parameters related 
diff -urN linux-2.6.8-rc2/Documentation/networking/comx.txt linux-2.6.8-rc3/Documentation/networking/comx.txt
--- linux-2.6.8-rc2/Documentation/networking/comx.txt	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/networking/comx.txt	2004-08-03 15:21:30.968490362 -0700
@@ -148,7 +148,7 @@
 The SliceCOM board doesn't require firmware. You can have 4 of these cards
 in one machine. The driver doesn't (yet) support shared interrupts, so
 you will need a separate IRQ line for every board.
-Read linux/Documentation/networking/slicecom.txt for help on configuring
+Read Documentation/networking/slicecom.txt for help on configuring
 this adapter.
 
 THE HDLC/PPP LINE PROTOCOL DRIVER
diff -urN linux-2.6.8-rc2/Documentation/nmi_watchdog.txt linux-2.6.8-rc3/Documentation/nmi_watchdog.txt
--- linux-2.6.8-rc2/Documentation/nmi_watchdog.txt	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/nmi_watchdog.txt	2004-08-03 15:21:31.035493111 -0700
@@ -58,6 +58,9 @@
 you have to enable it with a boot time parameter.  Prior to 2.4.2-ac18
 the NMI-oopser is enabled unconditionally on x86 SMP boxes.
 
+On x86-64 the NMI oopser is on by default. On 64bit Intel CPUs
+it uses IO-APIC by default and on AMD it uses local APIC.
+
 [ feel free to send bug reports, suggestions and patches to
   Ingo Molnar <mingo@redhat.com> or the Linux SMP mailing
   list at <linux-smp@vger.kernel.org> ]
diff -urN linux-2.6.8-rc2/Documentation/power/swsusp.txt linux-2.6.8-rc3/Documentation/power/swsusp.txt
--- linux-2.6.8-rc2/Documentation/power/swsusp.txt	2004-08-03 15:21:04.422401667 -0700
+++ linux-2.6.8-rc3/Documentation/power/swsusp.txt	2004-08-03 15:21:31.141497460 -0700
@@ -202,3 +202,30 @@
 should be sent to the mailing list available through the suspend2
 website, and not to the Linux Kernel Mailing List. We are working
 toward merging suspend2 into the mainline kernel.
+
+Q: Kernel thread must voluntarily freeze itself (call 'refrigerator'). But
+I found some kernel threads don't do it, and they don't freeze, and
+so the system can't sleep. Is this a known behavior?
+
+A: All such kernel threads need to be fixed, one by one. Select place
+where it is safe to be frozen (no kernel semaphores should be held at
+that point and it must be safe to sleep there), and add:
+
+            if (current->flags & PF_FREEZE)
+                    refrigerator(PF_FREEZE);
+
+Q: What is the difference between between "platform", "shutdown" and
+"firmware" in /sys/power/disk?
+
+A:
+
+shutdown: save state in linux, then tell bios to powerdown
+
+platform: save state in linux, then tell bios to powerdown and blink
+          "suspended led"
+
+firmware: tell bios to save state itself [needs BIOS-specific suspend
+	  partition, and has very little to do with swsusp]
+
+"platform" is actually right thing to do, but "shutdown" is most
+reliable.
diff -urN linux-2.6.8-rc2/Documentation/powerpc/hvcs.txt linux-2.6.8-rc3/Documentation/powerpc/hvcs.txt
--- linux-2.6.8-rc2/Documentation/powerpc/hvcs.txt	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/Documentation/powerpc/hvcs.txt	2004-08-03 15:21:31.143497542 -0700
@@ -0,0 +1,534 @@
+===========================================================================
+				   HVCS
+	IBM "Hypervisor Virtual Console Server" Installation Guide
+			  for Linux Kernel 2.6.4+
+		    Copyright (C) 2004 IBM Corporation
+
+===========================================================================
+NOTE:Eight space tabs are the optimum editor setting for reading this file.
+===========================================================================
+
+	       Author(s) :  Ryan S. Arnold <rsa@us.ibm.com>
+		       Date Created: March, 02, 2004
+		       Last Changed: July, 07, 2004
+
+---------------------------------------------------------------------------
+Table of contents:
+
+	1.  Driver Introduction:
+	2.  System Requirements
+	3.  Build Options:
+		3.1  Built-in:
+		3.2  Module:
+	4.  Installation:
+	5.  Connection:
+	6.  Disconnection:
+	7.  Configuration:
+	8.  Questions & Answers:
+	9.  Reporting Bugs:
+
+---------------------------------------------------------------------------
+1. Driver Introduction:
+
+This is the device driver for the IBM Hypervisor Virtual Console Server,
+"hvcs".  The IBM hvcs provides a tty driver interface to allow Linux user
+space applications access to the system consoles of logically partitioned
+operating systems (Linux and AIX) running on the same partitioned Power5
+ppc64 system.  Physical hardware consoles per partition are not practical
+on this hardware so system consoles are accessed by this driver using
+firmware interfaces to virtual terminal devices.
+
+---------------------------------------------------------------------------
+2. System Requirements:
+
+This device driver was written using 2.6.4 Linux kernel APIs and will only
+build and run on kernels of this version or later.
+
+This driver was written to operate solely on IBM Power5 ppc64 hardware
+though some care was taken to abstract the architecture dependent firmware
+calls from the driver code.
+
+Sysfs must be mounted on the system so that the user can determine which
+major and minor numbers are associated with each vty-server.  Directions
+for sysfs mounting are outside the scope of this document.
+
+---------------------------------------------------------------------------
+3. Build Options:
+
+The hvcs driver registers itself as a tty driver.  The tty layer
+dynamically allocates a block of major and minor numbers in a quantity
+requested by the registering driver.  The hvcs driver asks the tty layer
+for 64 of these major/minor numbers by default to use for hvcs device node
+entries.
+
+If the default number of device entries is adequate then this driver can be
+built into the kernel.  If not, the default can be over-ridden by inserting
+the driver as a module with insmod parameters.
+
+---------------------------------------------------------------------------
+3.1 Built-in:
+
+The following menuconfig example demonstrates selecting to build this
+driver into the kernel.
+
+	Device Drivers  --->
+		Character devices  --->
+			<*> IBM Hypervisor Virtual Console Server Support
+
+Begin the kernel make process.
+
+---------------------------------------------------------------------------
+3.2 Module:
+
+The following menuconfig example demonstrates selecting to build this
+driver as a kernel module.
+
+	Device Drivers  --->
+		Character devices  --->
+			<M> IBM Hypervisor Virtual Console Server Support
+
+The make process will build the following kernel modules:
+
+	hvcs.ko
+	hvcserver.ko
+
+To insert the module with the default allocation execute the following
+commands in the order they appear:
+
+	insmod hvcserver.ko
+	insmod hvcs.ko
+
+The hvcserver module contains architecture specific firmware calls and must
+be inserted first, otherwise the hvcs module will not find some of the
+symbols it expects.
+
+To override the default use an insmod parameter as follows (requesting 4
+tty devices as an example):
+
+	insmod hvcs.ko hvcs_parm_num_devs=4
+
+There is a maximum number of dev entries that can be specified on insmod.
+We think that 1024 is currently a decent maximum number of server adapters
+to allow.  This can always be changed by modifying the constant in the
+source file before building.
+
+NOTE: The length of time it takes to insmod the driver seems to be related
+to the number of tty interfaces the registering driver requests.
+
+In order to remove the driver module execute the following command:
+
+	rmmod hvcs.ko
+
+The recommended method for installing hvcs as a module is to use depmod to
+build a current modules.dep file in /lib/modules/`uname -r` and then
+execute:
+
+modprobe hvcs hvcs_parm_num_devs=4
+
+The modules.dep file indicates that hvcserver.ko needs to be inserted
+before hvcs.ko and modprobe uses this file to smartly insert the modules in
+the proper order.
+
+The following modprobe command is used to remove hvcs and hvcserver in the
+proper order:
+
+modprobe -r hvcs
+
+---------------------------------------------------------------------------
+4. Installation:
+
+The tty layer creates sysfs entries which contain the major and minor
+numbers allocated for the hvcs driver.  The following snippet of "tree"
+output of the sysfs directory shows where these numbers are presented:
+
+	sys/
+	|-- *other sysfs base dirs*
+	|
+	|-- class
+	|   |-- *other classes of devices*
+	|   |
+	|   `-- tty
+	|       |-- *other tty devices*
+	|       |
+	|       |-- hvcs0
+	|       |   `-- dev
+	|       |-- hvcs1
+	|       |   `-- dev
+	|       |-- hvcs2
+	|       |   `-- dev
+	|       |-- hvcs3
+	|       |   `-- dev
+	|       |
+	|       |-- *other tty devices*
+	|
+	|-- *other sysfs base dirs*
+
+For the above examples the following output is a result of cat'ing the
+"dev" entry in the hvcs directory:
+
+	Pow5:/sys/class/tty/hvcs0/ # cat dev
+	254:0
+
+	Pow5:/sys/class/tty/hvcs1/ # cat dev
+	254:1
+
+	Pow5:/sys/class/tty/hvcs2/ # cat dev
+	254:2
+
+	Pow5:/sys/class/tty/hvcs3/ # cat dev
+	254:3
+
+The output from reading the "dev" attribute is the char device major and
+minor numbers that the tty layer has allocated for this driver's use.  Most
+systems running hvcs will already have the device entries created or udev
+will do it automatically.
+
+Given the example output above, to manually create a /dev/hvcs* node entry
+mknod can be used as follows:
+
+	mknod /dev/hvcs0 c 254 0
+	mknod /dev/hvcs1 c 254 1
+	mknod /dev/hvcs2 c 254 2
+	mknod /dev/hvcs3 c 254 3
+
+Using mknod to manually create the device entries makes these device nodes
+persistent.  Once created they will exist prior to the driver insmod.
+
+Attempting to connect an application to /dev/hvcs* prior to insertion of
+the hvcs module will result in an error message similar to the following:
+
+	"/dev/hvcs*: No such device".
+
+NOTE: Just because there is a device node present doesn't mean that there
+is a vty-server device configured for that node.
+
+---------------------------------------------------------------------------
+5. Connection
+
+Since this driver controls devices that provide a tty interface a user can
+interact with the device node entries using any standard tty-interactive
+method (e.g. "cat", "dd", "echo").  The intent of this driver however, is
+to provide real time console interaction with a Linux partition's console,
+which requires the use of applications that provide bi-directional,
+interactive I/O with a tty device.
+
+Applications (e.g. "minicom" and "screen") that act as terminal emulators
+or perform terminal type control sequence conversion on the data being
+passed through them are NOT acceptable for providing interactive console
+I/O.  These programs often emulate antiquated terminal types (vt100 and
+ANSI) and expect inbound data to take the form of one of these supported
+terminal types but they either do not convert, or do not _adequately_
+convert, outbound data into the terminal type of the terminal which invoked
+them (though screen makes an attempt and can apparently be configured with
+much termcap wrestling.)
+
+For this reason kermit and cu are two of the recommended applications for
+interacting with a Linux console via an hvcs device.  These programs simply
+act as a conduit for data transfer to and from the tty device.  They do not
+require inbound data to take the form of a particular terminal type, nor do
+they cook outbound data to a particular terminal type.
+
+In order to ensure proper functioning of console applications one must make
+sure that once connected to a /dev/hvcs console that the console's $TERM
+env variable is set to the exact terminal type of the terminal emulator
+used to launch the interactive I/O application.  If one is using xterm and
+kermit to connect to /dev/hvcs0 when the console prompt becomes available
+one should "export TERM=xterm" on the console.  This tells ncurses
+applications that are invoked from the console that they should output
+control sequences that xterm can understand.
+
+As a precautionary measure an hvcs user should always "exit" from their
+session before disconnecting an application such as kermit from the device
+node.  If this is not done, the next user to connect to the console will
+continue using the previous user's logged in session which includes
+using the $TERM variable that the previous user supplied.
+
+---------------------------------------------------------------------------
+6. Disconnection
+
+As a security feature to prevent the delivery of stale data to an
+unintended target the Power5 system firmware disables the fetching of data
+and discards that data when a connection between a vty-server and a vty has
+been severed.  As an example, when a vty-server is immediately disconnected
+from a vty following output of data to the vty the vty adapter may not have
+enough time between when it received the data interrupt and when the
+connection was severed to fetch the data from firmware before the fetch is
+disabled by firmware.
+
+When hvcs is being used to serve consoles this behavior is not a huge issue
+because the adapter stays connected for large amounts of time following
+almost all data writes.  When hvcs is being used as a tty conduit to tunnel
+data between two partitions [see Q & A below] this is a huge problem
+because the standard Linux behavior when cat'ing or dd'ing data to a device
+is to open the tty, send the data, and then close the tty.  If this driver
+manually terminated vty-server connections on tty close this would close
+the vty-server and vty connection before the target vty has had a chance to
+fetch the data.
+
+Additionally, disconnecting a vty-server and vty only on module removal or
+adapter removal is impractical because other vty-servers in other
+partitions may require the usage of the target vty at any time.
+
+Due to this behavioral restriction disconnection of vty-servers from the
+connected vty is a manual procedure using a write to a sysfs attribute
+outlined below, on the other hand the initial vty-server connection to a
+vty is established automatically by this driver.  Manual vty-server
+connection is never required.
+
+In order to terminate the connection between a vty-server and vty the
+"vterm_state" sysfs attribute within each vty-server's sysfs entry is used.
+Reading this attribute reveals the current connection state of the
+vty-server adapter.  A zero means that the vty-server is not connected to a
+vty.  A one indicates that a connection is active.
+
+Writing a '0' (zero) to the vterm_state attribute will disconnect the VTERM
+connection between the vty-server and target vty ONLY if the vterm_state
+previously read '1'.  The write directive is ignored if the vterm_state
+read '0' or if any value other than '0' was written to the vterm_state
+attribute.  The following example will show the method used for verifying
+the vty-server connection status and disconnecting a vty-server connection.
+
+	Pow5:/sys/bus/vio/drivers/hvcs/30000004 # cat vterm_state
+	1
+
+	Pow5:/sys/bus/vio/drivers/hvcs/30000004 # echo 0 > vterm_state
+
+	Pow5:/sys/bus/vio/drivers/hvcs/30000004 # cat vterm_state
+	0
+
+All vty-server connections are automatically terminated when the device is
+hotplug removed and when the module is removed.
+
+---------------------------------------------------------------------------
+7. Configuration
+
+Each vty-server has a sysfs entry in the /sys/devices/vio directory, which
+is symlinked in several other sysfs tree directories, notably under the
+hvcs driver entry, which looks like the following example:
+
+	Pow5:/sys/bus/vio/drivers/hvcs # ls
+	.  ..  30000003  30000004  rescan
+
+By design, firmware notifies the hvcs driver of vty-server lifetimes and
+partner vty removals but not the addition of partner vtys.  Since an HMC
+Super Admin can add partner info dynamically we have provided the hvcs
+driver sysfs directory with the "rescan" update attribute which will query
+firmware and update the partner info for all the vty-servers that this
+driver manages.  Writing a '1' to the attribute triggers the update.  An
+explicit example follows:
+
+	Pow5:/sys/bus/vio/drivers/hvcs # echo 1 > rescan
+
+Reading the attribute will indicate a state of '1' or '0'.  A one indicates
+that an update is in process.  A zero indicates that an update has
+completed or was never executed.
+
+Vty-server entries in this directory are a 32 bit partition unique unit
+address that is created by firmware.  An example vty-server sysfs entry
+looks like the following:
+
+	Pow5:/sys/bus/vio/drivers/hvcs/30000004 # ls
+	.   current_vty   devspec  partner_clcs  vterm_state
+	..  detach_state  name     partner_vtys
+
+Each entry is provided, by default with a "name" attribute.  Reading the
+"name" attribute will reveal the device type as shown in the following
+example:
+
+	Pow5:/sys/bus/vio/drivers/hvcs/30000003 # cat name
+	vty-server
+
+Each entry is also provided, by default, with a "devspec" attribute which
+reveals the full device specification when read, as shown in the following
+example:
+
+	Pow5:/sys/bus/vio/drivers/hvcs/30000004 # cat devspec
+	/vdevice/vty-server@30000004
+
+Each vty-server sysfs dir is provided with two read-only attributes that
+provide lists of easily parsed partner vty data: "partner_vtys" and
+"partner_clcs".
+
+	Pow5:/sys/bus/vio/drivers/hvcs/30000004 # cat partner_vtys
+	30000000
+	30000001
+	30000002
+	30000000
+	30000000
+
+	Pow5:/sys/bus/vio/drivers/hvcs/30000004 # cat partner_clcs
+	U5112.428.103048A-V3-C0
+	U5112.428.103048A-V3-C2
+	U5112.428.103048A-V3-C3
+	U5112.428.103048A-V4-C0
+	U5112.428.103048A-V5-C0
+
+Reading partner_vtys returns a list of partner vtys.  Vty unit address
+numbering is only per-partition-unique so entries will frequently repeat.
+
+Reading partner_clcs returns a list of "converged location codes" which are
+composed of a system serial number followed by "-V*", where the '*' is the
+target partition number, and "-C*", where the '*' is the slot of the
+adapter.  The first vty partner corresponds to the first clc item, the
+second vty partner to the second clc item, etc.
+
+A vty-server can only be connected to a single vty at a time.  The entry,
+"current_vty" prints the clc of the currently selected partner vty when
+read.
+
+The current_vty can be changed by writing a valid partner clc to the entry
+as in the following example:
+
+	Pow5:/sys/bus/vio/drivers/hvcs/30000004 # echo U5112.428.10304
+	8A-V4-C0 > current_vty
+
+Changing the current_vty when a vty-server is already connected to a vty
+does not affect the current connection.  The change takes effect when the
+currently open connection is freed.
+
+Information on the "vterm_state" attribute was covered earlier on the
+chapter entitled "disconnection".
+
+---------------------------------------------------------------------------
+8. Questions & Answers:
+===========================================================================
+Q: What are the security concerns involving hvcs?
+
+A: There are three main security concerns:
+
+	1. The creator of the /dev/hvcs* nodes has the ability to restrict
+	the access of the device entries to certain users or groups.  It
+	may be best to create a special hvcs group privilege for providing
+	access to system consoles.
+
+	2. To provide network security when grabbing the console it is
+	suggested that the user connect to the console hosting partition
+	using a secure method, such as SSH or sit at a hardware console.
+
+	3. Make sure to exit the user session when done with a console or
+	the next vty-server connection (which may be from another
+	partition) will experience the previously logged in session.
+
+---------------------------------------------------------------------------
+Q: How do I multiplex a console that I grab through hvcs so that other
+people can see it:
+
+A: You can use "screen" to directly connect to the /dev/hvcs* device and
+setup a session on your machine with the console group privileges.  As
+pointed out earlier by default screen doesn't provide the termcap settings
+for most terminal emulators to provide adequate character conversion from
+term type "screen" to others.  This means that curses based programs may
+not display properly in screen sessions.
+
+---------------------------------------------------------------------------
+Q: Why are the colors all messed up?
+Q: Why are the control characters acting strange or not working?
+Q: Why is the console output all strange and unintelligible?
+
+A: Please see the preceding section on "Connection" for a discussion of how
+applications can affect the display of character control sequences.
+Additionally, just because you logged into the console using and xterm
+doesn't mean someone else didn't log into the console with the HMC console
+(vt320) before you and leave the session logged in.  The best thing to do
+is to export TERM to the terminal type of your terminal emulator when you
+get the console.  Additionally make sure to "exit" the console before you
+disconnect from the console.  This will ensure that the next user gets
+their own TERM type set when they login.
+
+---------------------------------------------------------------------------
+Q: When I try to CONNECT kermit to an hvcs device I get:
+"Sorry, can't open connection: /dev/hvcs*"What is happening?
+
+A: Some other Power5 console mechanism has a connection to the vty and
+isn't giving it up.  You can try to force disconnect the consoles from the
+HMC by right clicking on the partition and then selecting "close terminal".
+Otherwise you have to hunt down the people who have console authority.  It
+is possible that you already have the console open using another kermit
+session and just forgot about it.  Please review the console options for
+Power5 systems to determine the many ways a system console can be held.
+
+OR
+
+A: Another user may not have a connectivity method currently attached to a
+/dev/hvcs device but the vterm_state may reveal that they still have the
+vty-server connection established.  They need to free this using the method
+outlined in the section on "Disconnection" in order for others to connect
+to the target vty.
+
+OR
+
+A: The user profile you are using to execute kermit probably doesn't have
+permissions to use the /dev/hvcs* device.
+
+OR
+
+A: You probably haven't inserted the hvcs.ko module yet but the /dev/hvcs*
+entry still exists (on systems without udev).
+
+OR
+
+A: There is not a corresponding vty-server device that maps to an existing
+/dev/hvcs* entry.
+
+---------------------------------------------------------------------------
+Q: When I try to CONNECT kermit to an hvcs device I get:
+"Sorry, write access to UUCP lockfile directory denied."
+
+A: The /dev/hvcs* entry you have specified doesn't exist where you said it
+does?  Maybe you haven't inserted the module (on systems with udev).
+
+---------------------------------------------------------------------------
+Q: If I already have one Linux partition installed can I use hvcs on said
+partition to provide the console for the install of a second Linux
+partition?
+
+A: Yes granted that your are connected to the /dev/hvcs* device using
+kermit or cu or some other program that doesn't provide terminal emulation.
+
+---------------------------------------------------------------------------
+Q: Can I connect to more than one partition's console at a time using this
+driver?
+
+A: Yes.  Of course this means that there must be more than one vty-server
+configured for this partition and each must point to a disconnected vty.
+
+---------------------------------------------------------------------------
+Q: Does the hvcs driver support dynamic (hotplug) addition of devices?
+
+A: Yes, if you have dlpar and hotplug enabled for your system and it has
+been built into the kernel the hvcs drivers is configured to dynamically
+handle additions of new devices and removals of unused devices.
+
+---------------------------------------------------------------------------
+Q: Can I use /dev/hvcs* as a conduit to another partition and use a tty
+device on that partition as the other end of the pipe?
+
+A: Yes, on Power5 platforms the hvc_console driver provides a tty interface
+for extra /dev/hvc* devices (where /dev/hvc0 is most likely the console).
+In order to get a tty conduit working between the two partitions the HMC
+Super Admin must create an additional "serial server" for the target
+partition with the HMC gui which will show up as /dev/hvc* when the target
+partition is rebooted.
+
+The HMC Super Admin then creates an additional "serial client" for the
+current partition and points this at the target partition's newly created
+"serial server" adapter (remember the slot).  This shows up as an
+additional /dev/hvcs* device.
+
+Now a program on the target system can be configured to read or write to
+/dev/hvc* and another program on the current partition can be configured to
+read or write to /dev/hvcs*.  Now you have a tty conduit between two
+partitions.
+
+---------------------------------------------------------------------------
+9. Reporting Bugs:
+
+The proper channel for reporting bugs is either through the Linux OS
+distribution company that provided your OS or by posting issues to the
+ppc64 development mailing list at:
+
+linuxppc64-dev@lists.linuxppc.org
+
+This request is to provide a documented and searchable public exchange
+of the problems and solutions surrounding this driver for the benefit of
+all users.
diff -urN linux-2.6.8-rc2/Documentation/powerpc/mpc52xx.txt linux-2.6.8-rc3/Documentation/powerpc/mpc52xx.txt
--- linux-2.6.8-rc2/Documentation/powerpc/mpc52xx.txt	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/Documentation/powerpc/mpc52xx.txt	2004-08-03 15:21:31.144497583 -0700
@@ -0,0 +1,48 @@
+Linux 2.6.x on MPC52xx family
+-----------------------------
+
+For the latest info, go to http://www.246tNt.com/mpc52xx/state.txt
+ 
+To compile/use :
+
+  - U-Boot:
+     # <edit Makefile to set ARCH=ppc & CROSS_COMPILE=... ( also EXTRAVERSION
+        if you wish to ).
+     # make lite5200_defconfig
+     # make uImage
+    
+     then, on U-boot:
+     => tftpboot 200000 uImage
+     => tftpboot 400000 pRamdisk
+     => bootm 200000 400000
+    
+  - DBug:
+     # <edit Makefile to set ARCH=ppc & CROSS_COMPILE=... ( also EXTRAVERSION
+        if you wish to ).
+     # make lite5200_defconfig
+     # cp your_initrd.gz arch/ppc/boot/images/ramdisk.image.gz
+     # make zImage.initrd 
+     # make 
+
+     then in DBug:
+     DBug> dn -i zImage.initrd.lite5200
+     
+
+Some remarks :
+ - The port is named mpc52xxx, and config options are PPC_MPC52xx. The MGT5100
+   is not supported, and I'm not sure anyone is interesting in working on it
+   so. I didn't took 5xxx because there's apparently a lot of 5xxx that have
+   nothing to do with the MPC5200. I also included the 'MPC' for the same
+   reason.
+ - Of course, I inspired myself from the 2.4 port. If you think I forgot to
+   mention you/your company in the copyright of some code, I'll correct it
+   ASAP.
+ - The codes wants the MBAR to be set at 0xf0000000 by the bootloader. It's
+   mapped 1:1 with the MMU. If for whatever reason, you want to change this,
+   beware that some code depends on the 0xf0000000 address and other depends
+   on the 1:1 mapping.
+ - Most of the code assumes that port multiplexing, frequency selection, ...
+   has already been done. IMHO this should be done as early as possible, in
+   the bootloader. If for whatever reason you can't do it there, do it in the
+   platform setup code (if U-Boot) or in the arch/ppc/boot/simple/... (if
+   DBug)
diff -urN linux-2.6.8-rc2/Documentation/s390/3270.txt linux-2.6.8-rc3/Documentation/s390/3270.txt
--- linux-2.6.8-rc2/Documentation/s390/3270.txt	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/s390/3270.txt	2004-08-03 15:21:31.241501562 -0700
@@ -117,7 +117,7 @@
 
 	Then notify /sbin/init that /etc/inittab has changed, by issuing
 	the telinit command with the q operand:
-		cd /usr/src/linux/Documentation/s390
+		cd Documentation/s390
 		sh config3270.sh
 		sh /tmp/mkdev3270
 		telinit q
diff -urN linux-2.6.8-rc2/Documentation/scsi/scsi_mid_low_api.txt linux-2.6.8-rc3/Documentation/scsi/scsi_mid_low_api.txt
--- linux-2.6.8-rc2/Documentation/scsi/scsi_mid_low_api.txt	2004-08-03 15:21:04.549406870 -0700
+++ linux-2.6.8-rc3/Documentation/scsi/scsi_mid_low_api.txt	2004-08-03 15:21:31.244501685 -0700
@@ -40,7 +40,7 @@
 Documentation
 =============
 There is a SCSI documentation directory within the kernel source tree, 
-typically /usr/src/linux/Documentation/scsi . Most documents are in plain
+typically Documentation/scsi . Most documents are in plain
 (i.e. ASCII) text. This file is named scsi_mid_low_api.txt and can be 
 found in that directory. A more recent copy of this document may be found
 at http://www.torque.net/scsi/scsi_mid_low_api.txt.gz . 
diff -urN linux-2.6.8-rc2/Documentation/sound/alsa/DocBook/writing-an-alsa-driver.tmpl linux-2.6.8-rc3/Documentation/sound/alsa/DocBook/writing-an-alsa-driver.tmpl
--- linux-2.6.8-rc2/Documentation/sound/alsa/DocBook/writing-an-alsa-driver.tmpl	2004-06-15 22:19:09.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/sound/alsa/DocBook/writing-an-alsa-driver.tmpl	2004-08-03 15:21:31.392507757 -0700
@@ -3641,7 +3641,7 @@
 
         <para>
           More precise information can be found in
-        <filename>alsa-kernel/Documentation/sound/alsa/ControlNames.txt</filename>.
+        <filename>Documentation/sound/alsa/ControlNames.txt</filename>.
         </para>
       </section>
     </section>
diff -urN linux-2.6.8-rc2/Documentation/sound/oss/INSTALL.awe linux-2.6.8-rc3/Documentation/sound/oss/INSTALL.awe
--- linux-2.6.8-rc2/Documentation/sound/oss/INSTALL.awe	2004-06-15 22:19:43.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/sound/oss/INSTALL.awe	2004-08-03 15:21:31.423509028 -0700
@@ -114,7 +114,7 @@
 		# insmod awe_wave
 		(Be sure to load awe_wave after sb!)
 
-		See /usr/src/linux/Documentation/sound/oss/AWE32 for
+		See Documentation/sound/oss/AWE32 for
 		more details.
 
   9. (only for obsolete systems) If you don't have /dev/sequencer
diff -urN linux-2.6.8-rc2/Documentation/sound/oss/Introduction linux-2.6.8-rc3/Documentation/sound/oss/Introduction
--- linux-2.6.8-rc2/Documentation/sound/oss/Introduction	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/sound/oss/Introduction	2004-08-03 15:21:31.425509111 -0700
@@ -24,7 +24,7 @@
 ========
 0.1.0  11/20/1998  First version, draft
 1.0.0  11/1998     Alan Cox changes, incorporation in 2.2.0
-                   as /usr/src/linux/Documentation/sound/oss/Introduction
+                   as Documentation/sound/oss/Introduction
 1.1.0  6/30/1999   Second version, added notes on making the drivers,
                    added info on multiple sound cards of similar types,]
                    added more diagnostics info, added info about esd.
@@ -439,7 +439,7 @@
 
 4)  OSS's WWW site at http://www.opensound.com.
 
-5)  All the files in linux/Documentation/sound.
+5)  All the files in Documentation/sound.
 
 6)  The comments and code in linux/drivers/sound.
 
diff -urN linux-2.6.8-rc2/Documentation/sound/oss/PAS16 linux-2.6.8-rc3/Documentation/sound/oss/PAS16
--- linux-2.6.8-rc2/Documentation/sound/oss/PAS16	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/sound/oss/PAS16	2004-08-03 15:21:31.427509193 -0700
@@ -9,7 +9,7 @@
 This documentation is relevant for the PAS16 driver (pas2_card.c and
 friends) under kernel version 2.3.99 and later.  If you are
 unfamiliar with configuring sound under Linux, please read the
-Sound-HOWTO, linux/Documentation/sound/oss/Introduction and other
+Sound-HOWTO, Documentation/sound/oss/Introduction and other
 relevant docs first.
 
 The following information is relevant information from README.OSS
@@ -60,7 +60,7 @@
 
 The new stuff for 2.3.99 and later
 ============================================================================
-The following configuration options from linux/Documentation/Configure.help
+The following configuration options from Documentation/Configure.help
 are relevant to configuring the PAS16:
 
 Sound card support
diff -urN linux-2.6.8-rc2/Documentation/sysctl/README linux-2.6.8-rc3/Documentation/sysctl/README
--- linux-2.6.8-rc2/Documentation/sysctl/README	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/sysctl/README	2004-08-03 15:21:31.433509439 -0700
@@ -60,11 +60,11 @@
 dev/		device specific information (eg dev/cdrom/info)
 fs/		specific filesystems
 		filehandle, inode, dentry and quota tuning
-		binfmt_misc <linux/Documentation/binfmt_misc.txt>
+		binfmt_misc <Documentation/binfmt_misc.txt>
 kernel/		global kernel info / tuning
 		miscellaneous stuff
 net/		networking stuff, for documentation look in:
-		<linux/Documentation/networking/>
+		<Documentation/networking/>
 proc/		<empty>
 sunrpc/		SUN Remote Procedure Call (NFS)
 vm/		memory management tuning
diff -urN linux-2.6.8-rc2/Documentation/sysctl/vm.txt linux-2.6.8-rc3/Documentation/sysctl/vm.txt
--- linux-2.6.8-rc2/Documentation/sysctl/vm.txt	2004-08-03 15:21:04.632410271 -0700
+++ linux-2.6.8-rc3/Documentation/sysctl/vm.txt	2004-08-03 15:21:31.463510669 -0700
@@ -24,11 +24,14 @@
 - dirty_writeback_centisecs
 - max_map_count
 - min_free_kbytes
+- laptop_mode
+- block_dump
 
 ==============================================================
 
 dirty_ratio, dirty_background_ratio, dirty_expire_centisecs,
-dirty_writeback_centisecs, vfs_cache_pressure:
+dirty_writeback_centisecs, vfs_cache_pressure, laptop_mode,
+block_dump:
 
 See Documentation/filesystems/proc.txt
 
diff -urN linux-2.6.8-rc2/Documentation/usb/URB.txt linux-2.6.8-rc3/Documentation/usb/URB.txt
--- linux-2.6.8-rc2/Documentation/usb/URB.txt	2004-06-15 22:19:09.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/usb/URB.txt	2004-08-03 15:21:31.532513500 -0700
@@ -4,7 +4,7 @@
     NOTE:
 
     The USB subsystem now has a substantial section in "The Linux Kernel API"
-    guide (in linux/Documentation/DocBook), generated from the current source
+    guide (in Documentation/DocBook), generated from the current source
     code.  This particular documentation file isn't particularly current or
     complete; don't rely on it except for a quick overview.
 
diff -urN linux-2.6.8-rc2/Documentation/usb/usb-help.txt linux-2.6.8-rc3/Documentation/usb/usb-help.txt
--- linux-2.6.8-rc2/Documentation/usb/usb-help.txt	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/usb/usb-help.txt	2004-08-03 15:21:31.536513664 -0700
@@ -2,7 +2,7 @@
 2000-July-12
 
 For USB help other than the readme files that are located in
-linux/Documentation/usb/*, see the following:
+Documentation/usb/*, see the following:
 
 Linux-USB project:  http://www.linux-usb.org
   mirrors at        http://www.suse.cz/development/linux-usb/
diff -urN linux-2.6.8-rc2/Documentation/video4linux/Zoran linux-2.6.8-rc3/Documentation/video4linux/Zoran
--- linux-2.6.8-rc2/Documentation/video4linux/Zoran	2004-06-15 22:19:42.000000000 -0700
+++ linux-2.6.8-rc3/Documentation/video4linux/Zoran	2004-08-03 15:21:31.625517315 -0700
@@ -308,7 +308,7 @@
 
 Information - video4linux:
 http://roadrunner.swansea.linux.org.uk/v4lapi.shtml
-/usr/src/linux/Documentation/video4linux/API.html
+Documentation/video4linux/API.html
 /usr/include/linux/videodev.h
 
 Information - video4linux/mjpeg extensions:
diff -urN linux-2.6.8-rc2/MAINTAINERS linux-2.6.8-rc3/MAINTAINERS
--- linux-2.6.8-rc2/MAINTAINERS	2004-08-03 15:21:04.797417031 -0700
+++ linux-2.6.8-rc3/MAINTAINERS	2004-08-03 15:21:31.702520474 -0700
@@ -632,7 +632,7 @@
 
 DEFXX FDDI NETWORK DRIVER
 P:	Maciej W. Rozycki
-M:	macro@ds2.pg.gda.pl
+M:	macro@linux-mips.org
 S:	Maintained
 
 DELL LAPTOP SMM DRIVER
@@ -1283,6 +1283,13 @@
 L:	linuxppc-embedded@lists.linuxppc.org
 S:	Maintained
 
+LINUX FOR POWERPC EMBEDDED PPC8XX AND BOOT CODE
+P:	Tom Rini
+M:	trini@kernel.crashing.org
+W:	http://www.penguinppc.org/
+L:	linuxppc-embedded@lists.linuxppc.org
+S:	Maintained
+
 LINUX FOR POWERPC EMBEDDED PPC85XX
 P:     Kumar Gala
 M:     kumar.gala@freescale.com
@@ -1324,11 +1331,14 @@
 L:	linux-scsi@vger.kernel.org
 S:	Maintained
 
-M68K
-P:	Jes Sorensen
-M:	jes@trained-monkey.org
-W:	http://www.clark.net/pub/lawrencc/linux/index.html
+M68K ARCHITECTURE
+P:	Geert Uytterhoeven
+M:	geert@linux-m68k.org
+P:	Roman Zippel
+M:	zippel@linux-m68k.org
 L:	linux-m68k@lists.linux-m68k.org
+W:	http://www.linux-m68k.org/
+W:	http://linux-m68k-cvs.ubb.ca/
 S:	Maintained
 
 M68K ON APPLE MACINTOSH
@@ -1494,6 +1504,8 @@
 M:	jmorris@redhat.com
 P:	Hideaki YOSHIFUJI
 M:	yoshfuji@linux-ipv6.org
+P:	Patrick McHardy
+M:	kaber@coreworks.de
 L:	netdev@oss.sgi.com
 S:	Maintained
 
@@ -1557,7 +1569,7 @@
 ONSTREAM SCSI TAPE DRIVER
 P:	Willem Riede
 M:	osst@riede.org
-L:	osst@linux1.onstream.nl
+L:	osst-users@lists.sourceforge.net
 L:	linux-scsi@vger.kernel.org
 S:	Maintained
 
@@ -1945,8 +1957,8 @@
 S:	Maintained
 
 SPARC (sparc32):
-P:	Keith M. Wesolowski
-M:	wesolows@foobazco.org
+P:	William L. Irwin
+M:	wli@holomorphy.com
 L:	sparclinux@vger.kernel.org
 S:	Maintained
 
diff -urN linux-2.6.8-rc2/Makefile linux-2.6.8-rc3/Makefile
--- linux-2.6.8-rc2/Makefile	2004-08-03 15:21:04.799417113 -0700
+++ linux-2.6.8-rc3/Makefile	2004-08-03 15:21:31.704520556 -0700
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 8
-EXTRAVERSION =-rc2
+EXTRAVERSION =-rc3
 NAME=Zonked Quokka
 
 # *DOCUMENTATION*
@@ -53,7 +53,7 @@
   KBUILD_CHECKSRC = 0
 endif
 
-# Use make M=dir to specify direcotry of external module to build
+# Use make M=dir to specify directory of external module to build
 # Old syntax make ... SUBDIRS=$PWD is still supported
 # Setting the environment variable KBUILD_EXTMOD take precedence
 ifdef SUBDIRS
@@ -130,16 +130,6 @@
 _all: modules
 endif
 
-# Make sure we're not wasting cpu-cycles doing locale handling, yet do make
-# sure error messages appear in the user-desired language
-ifdef LC_ALL
-LANG := $(LC_ALL)
-LC_ALL :=
-endif
-LC_COLLATE := C
-LC_CTYPE := C
-export LANG LC_ALL LC_COLLATE LC_CTYPE
-
 srctree		:= $(if $(KBUILD_SRC),$(KBUILD_SRC),$(CURDIR))
 TOPDIR		:= $(srctree)
 # FIXME - TOPDIR is obsolete, use srctree/objtree
@@ -621,25 +611,44 @@
 
 $(sort $(vmlinux-objs)) arch/$(ARCH)/kernel/vmlinux.lds.s: $(vmlinux-dirs) ;
 
-# 	Handle descending into subdirectories listed in $(vmlinux-dirs)
+# Handle descending into subdirectories listed in $(vmlinux-dirs)
+# Preset locale variables to speed up the build process. Limit locale
+# tweaks to this spot to avoid wrong language settings when running
+# make menuconfig etc.
+# Error messages still appears in the original language
 
 .PHONY: $(vmlinux-dirs)
 $(vmlinux-dirs): prepare-all scripts
-	$(Q)$(MAKE) $(build)=$@
+	$(Q)if [ ! -z $$LC_ALL ]; then          \
+		export LANG=$$LC_ALL;           \
+		export LC_ALL= ;                \
+	fi;                                     \
+	export LC_COLLATE=C; export LC_CTYPE=C; \
+	$(MAKE) $(build)=$@
 
 # Things we need to do before we recursively start building the kernel
 # or the modules are listed in "prepare-all".
 # A multi level approach is used. prepare1 is updated first, then prepare0.
 # prepare-all is the collection point for the prepare targets.
 
-.PHONY: prepare-all prepare prepare0 prepare1
+.PHONY: prepare-all prepare prepare0 prepare1 prepare2
+
+# prepare 2 generate Makefile to be placed in output directory, if
+# using a seperate output directory. This allows convinient use
+# of make in output directory
+prepare2:
+	$(Q)if [ ! $(srctree) -ef $(objtree) ]; then       \
+	$(CONFIG_SHELL) $(srctree)/scripts/mkmakefile      \
+	    $(srctree) $(objtree) $(VERSION) $(PATCHLEVEL) \
+	    > $(objtree)/Makefile;                         \
+	fi
 
 # prepare1 is used to check if we are building in a separate output directory,
 # and if so do:
 # 1) Check that make has not been executed in the kernel src $(srctree)
 # 2) Create the include2 directory, used for the second asm symlink
 
-prepare1:
+prepare1: prepare2
 ifneq ($(KBUILD_SRC),)
 	@echo '  Using $(srctree) as source for kernel'
 	$(Q)if [ -h $(srctree)/include/asm -o -f $(srctree)/.config ]; then \
@@ -760,9 +769,13 @@
 		sleep 1; \
 	fi
 	@rm -rf $(MODLIB)/kernel
-	@rm -f $(MODLIB)/build
+	@rm -f $(MODLIB)/source
 	@mkdir -p $(MODLIB)/kernel
-	@ln -s $(TOPDIR) $(MODLIB)/build
+	@ln -s $(srctree) $(MODLIB)/source
+	@if [ ! $(objtree) -ef  $(MODLIB)/build ]; then \
+		rm -f $(MODLIB)/build ; \
+		ln -s $(objtree) $(MODLIB)/build ; \
+	fi
 	$(Q)$(MAKE) -rR -f $(srctree)/scripts/Makefile.modinst
 
 # If System.map exists, run depmod.  This deliberately does not have a
@@ -1009,19 +1022,19 @@
 # ---------------------------------------------------------------------------
 
 define all-sources
-	( find . $(RCS_FIND_IGNORE) \
+	( find $(srctree) $(RCS_FIND_IGNORE) \
 	       \( -name include -o -name arch \) -prune -o \
 	       -name '*.[chS]' -print; \
-	  find arch/$(ARCH) $(RCS_FIND_IGNORE) \
+	  find $(srctree)/arch/$(ARCH) $(RCS_FIND_IGNORE) \
 	       -name '*.[chS]' -print; \
-	  find security/selinux/include $(RCS_FIND_IGNORE) \
+	  find $(srctree)/security/selinux/include $(RCS_FIND_IGNORE) \
 	       -name '*.[chS]' -print; \
-	  find include $(RCS_FIND_IGNORE) \
+	  find $(srctree)/include $(RCS_FIND_IGNORE) \
 	       \( -name config -o -name 'asm-*' \) -prune \
 	       -o -name '*.[chS]' -print; \
-	  find include/asm-$(ARCH) $(RCS_FIND_IGNORE) \
+	  find $(srctree)/include/asm-$(ARCH) $(RCS_FIND_IGNORE) \
 	       -name '*.[chS]' -print; \
-	  find include/asm-generic $(RCS_FIND_IGNORE) \
+	  find $(srctree)/include/asm-generic $(RCS_FIND_IGNORE) \
 	       -name '*.[chS]' -print )
 endef
 
diff -urN linux-2.6.8-rc2/README linux-2.6.8-rc3/README
--- linux-2.6.8-rc2/README	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/README	2004-08-03 15:21:31.759522813 -0700
@@ -35,7 +35,7 @@
 
  - There are various README files in the Documentation/ subdirectory:
    these typically contain kernel-specific installation notes for some 
-   drivers for example. See ./Documentation/00-INDEX for a list of what
+   drivers for example. See Documentation/00-INDEX for a list of what
    is contained in each file.  Please read the Changes file, as it
    contains information about the problems, which may result by upgrading
    your kernel.
@@ -98,7 +98,7 @@
 
    Compiling and running the 2.6.xx kernels requires up-to-date
    versions of various software packages.  Consult
-   ./Documentation/Changes for the minimum version numbers required
+   Documentation/Changes for the minimum version numbers required
    and how to get updates for these packages.  Beware that using
    excessively old versions of these packages can cause indirect
    errors that are very difficult to track down, so don't assume that
@@ -168,7 +168,7 @@
    gcc 2.91.66 (egcs-1.1.2), and gcc 2.7.2.3 are known to miscompile
    some parts of the kernel, and are *no longer supported*.
    Also remember to upgrade your binutils package (for as/ld/nm and company)
-   if necessary. For more information, refer to ./Documentation/Changes.
+   if necessary. For more information, refer to Documentation/Changes.
 
    Please note that you can still run a.out user programs with this kernel.
 
diff -urN linux-2.6.8-rc2/arch/alpha/kernel/srm_env.c linux-2.6.8-rc3/arch/alpha/kernel/srm_env.c
--- linux-2.6.8-rc2/arch/alpha/kernel/srm_env.c	2004-06-15 22:18:59.000000000 -0700
+++ linux-2.6.8-rc3/arch/alpha/kernel/srm_env.c	2004-08-03 15:21:31.798524413 -0700
@@ -5,7 +5,7 @@
  * Copyright (C) 2001-2002 Jan-Benedict Glaw <jbglaw@lug-owl.de>
  *
  * This driver is at all a modified version of Erik Mouw's
- * ./linux/Documentation/DocBook/procfs_example.c, so: thank
+ * Documentation/DocBook/procfs_example.c, so: thank
  * you, Erik! He can be reached via email at
  * <J.A.K.Mouw@its.tudelft.nl>. It is based on an idea
  * provided by DEC^WCompaq^WIntel's "Jumpstart" CD. They
diff -urN linux-2.6.8-rc2/arch/arm/Kconfig linux-2.6.8-rc3/arch/arm/Kconfig
--- linux-2.6.8-rc2/arch/arm/Kconfig	2004-08-03 15:21:04.815417768 -0700
+++ linux-2.6.8-rc3/arch/arm/Kconfig	2004-08-03 15:21:31.803524618 -0700
@@ -370,7 +370,7 @@
 	help
 	  This enables the CPUfreq driver for ARM Integrator CPUs.
 
-	  For details, take a look at linux/Documentation/cpu-freq.
+	  For details, take a look at <file:Documentation/cpu-freq>.
 
 	  If in doubt, say Y.
 
diff -urN linux-2.6.8-rc2/arch/arm/Makefile linux-2.6.8-rc3/arch/arm/Makefile
--- linux-2.6.8-rc2/arch/arm/Makefile	2004-08-03 15:21:04.815417768 -0700
+++ linux-2.6.8-rc3/arch/arm/Makefile	2004-08-03 15:21:31.804524659 -0700
@@ -58,6 +58,8 @@
 CFLAGS		+=-mapcs-32 $(arch-y) $(tune-y) -mshort-load-bytes -msoft-float -Wa,-mno-fpu -Uarm
 AFLAGS		+=-mapcs-32 $(arch-y) $(tune-y) -msoft-float -Wa,-mno-fpu
 
+CHECK		:= $(CHECK) -D__arm__=1
+
 #Default value
 DATAADDR	:= .
 
diff -urN linux-2.6.8-rc2/arch/arm/kernel/apm.c linux-2.6.8-rc3/arch/arm/kernel/apm.c
--- linux-2.6.8-rc2/arch/arm/kernel/apm.c	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/arch/arm/kernel/apm.c	2004-08-03 15:21:31.837526013 -0700
@@ -206,7 +206,7 @@
 	return err;
 }
 
-static ssize_t apm_read(struct file *fp, char *buf, size_t count, loff_t *ppos)
+static ssize_t apm_read(struct file *fp, char __user *buf, size_t count, loff_t *ppos)
 {
 	struct apm_user *as = fp->private_data;
 	apm_event_t event;
diff -urN linux-2.6.8-rc2/arch/arm/kernel/ptrace.c linux-2.6.8-rc3/arch/arm/kernel/ptrace.c
--- linux-2.6.8-rc2/arch/arm/kernel/ptrace.c	2004-06-15 22:18:58.000000000 -0700
+++ linux-2.6.8-rc3/arch/arm/kernel/ptrace.c	2004-08-03 15:21:31.843526259 -0700
@@ -485,7 +485,7 @@
 	info.si_signo = SIGTRAP;
 	info.si_errno = 0;
 	info.si_code  = TRAP_BRKPT;
-	info.si_addr  = (void *)instruction_pointer(regs);
+	info.si_addr  = (void __user *)instruction_pointer(regs);
 
 	force_sig_info(SIGTRAP, &info, tsk);
 }
diff -urN linux-2.6.8-rc2/arch/arm/kernel/signal.c linux-2.6.8-rc3/arch/arm/kernel/signal.c
--- linux-2.6.8-rc2/arch/arm/kernel/signal.c	2004-06-15 22:18:52.000000000 -0700
+++ linux-2.6.8-rc3/arch/arm/kernel/signal.c	2004-08-03 15:21:31.844526300 -0700
@@ -419,7 +419,7 @@
 	__put_user_error(NULL, &frame->uc.uc_link, err);
 
 	memset(&stack, 0, sizeof(stack));
-	stack.ss_sp = (void *)current->sas_ss_sp;
+	stack.ss_sp = (void __user *)current->sas_ss_sp;
 	stack.ss_flags = sas_ss_flags(regs->ARM_sp);
 	stack.ss_size = current->sas_ss_size;
 	err |= __copy_to_user(&frame->uc.uc_stack, &stack, sizeof(stack));
diff -urN linux-2.6.8-rc2/arch/arm/kernel/sys_arm.c linux-2.6.8-rc3/arch/arm/kernel/sys_arm.c
--- linux-2.6.8-rc2/arch/arm/kernel/sys_arm.c	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/arch/arm/kernel/sys_arm.c	2004-08-03 15:21:31.845526341 -0700
@@ -178,7 +178,7 @@
 		union semun fourth;
 		if (!ptr)
 			return -EINVAL;
-		if (get_user(fourth.__pad, (void __user **) ptr))
+		if (get_user(fourth.__pad, (void __user * __user *) ptr))
 			return -EFAULT;
 		return sys_semctl (first, second, third, fourth);
 	}
diff -urN linux-2.6.8-rc2/arch/arm/kernel/traps.c linux-2.6.8-rc3/arch/arm/kernel/traps.c
--- linux-2.6.8-rc2/arch/arm/kernel/traps.c	2004-08-03 15:21:04.846419038 -0700
+++ linux-2.6.8-rc3/arch/arm/kernel/traps.c	2004-08-03 15:21:31.848526464 -0700
@@ -263,7 +263,7 @@
 	unsigned int instr;
 	struct undef_hook *hook;
 	siginfo_t info;
-	void *pc;
+	void __user *pc;
 
 	/*
 	 * According to the ARM ARM, PC is 2 or 4 bytes ahead,
@@ -272,11 +272,11 @@
 	 */
 	regs->ARM_pc -= correction;
 
-	pc = (void *)instruction_pointer(regs);
+	pc = (void __user *)instruction_pointer(regs);
 	if (thumb_mode(regs)) {
-		get_user(instr, (u16 *)pc);
+		get_user(instr, (u16 __user *)pc);
 	} else {
-		get_user(instr, (u32 *)pc);
+		get_user(instr, (u32 __user *)pc);
 	}
 
 	spin_lock_irq(&undef_lock);
@@ -368,7 +368,7 @@
 	info.si_signo = SIGILL;
 	info.si_errno = 0;
 	info.si_code  = ILL_ILLTRP;
-	info.si_addr  = (void *)instruction_pointer(regs) -
+	info.si_addr  = (void __user *)instruction_pointer(regs) -
 			 (thumb_mode(regs) ? 2 : 4);
 
 	force_sig_info(SIGILL, &info, current);
@@ -481,7 +481,7 @@
 	info.si_signo = SIGILL;
 	info.si_errno = 0;
 	info.si_code  = ILL_ILLTRP;
-	info.si_addr  = (void *)instruction_pointer(regs) -
+	info.si_addr  = (void __user *)instruction_pointer(regs) -
 			 (thumb_mode(regs) ? 2 : 4);
 
 	force_sig_info(SIGILL, &info, current);
@@ -519,7 +519,7 @@
 	info.si_signo = SIGILL;
 	info.si_errno = 0;
 	info.si_code  = ILL_ILLOPC;
-	info.si_addr  = (void *)addr;
+	info.si_addr  = (void __user *)addr;
 
 	force_sig_info(SIGILL, &info, current);
 	die_if_kernel("unknown data abort code", regs, instr);
diff -urN linux-2.6.8-rc2/arch/arm/mach-ixp4xx/common-pci.c linux-2.6.8-rc3/arch/arm/mach-ixp4xx/common-pci.c
--- linux-2.6.8-rc2/arch/arm/mach-ixp4xx/common-pci.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/arch/arm/mach-ixp4xx/common-pci.c	2004-08-03 15:21:31.907528884 -0700
@@ -540,4 +540,6 @@
 EXPORT_SYMBOL(pci_set_dma_mask);
 EXPORT_SYMBOL(pci_dac_set_dma_mask);
 EXPORT_SYMBOL(pci_set_consistent_dma_mask);
+EXPORT_SYMBOL(ixp4xx_pci_read);
+EXPORT_SYMBOL(ixp4xx_pci_write);
 
diff -urN linux-2.6.8-rc2/arch/arm/mach-ixp4xx/coyote-setup.c linux-2.6.8-rc3/arch/arm/mach-ixp4xx/coyote-setup.c
--- linux-2.6.8-rc2/arch/arm/mach-ixp4xx/coyote-setup.c	2004-08-03 15:21:04.893420964 -0700
+++ linux-2.6.8-rc3/arch/arm/mach-ixp4xx/coyote-setup.c	2004-08-03 15:21:31.908528925 -0700
@@ -63,7 +63,7 @@
 	.flags		= IORESOURCE_MEM,
 };
 
-static struct platform_device coyote_flash_device = {
+static struct platform_device coyote_flash = {
 	.name		= "IXP4XX-Flash",
 	.id		= 0,
 	.dev		= {
@@ -73,9 +73,13 @@
 	.resource	= &coyote_flash_resource,
 };
 
+static struct platform_device *coyote_devices[] __initdata = {
+	&coyote_flash
+};
+
 static void __init coyote_init(void)
 {
-	platform_add_device(&coyote_flash_device);
+	platform_add_devices(&coyote_devices, ARRAY_SIZE(coyote_devices));
 }
 
 MACHINE_START(ADI_COYOTE, "ADI Engineering IXP4XX Coyote Development Platform")
diff -urN linux-2.6.8-rc2/arch/arm/mach-ixp4xx/ixdp425-setup.c linux-2.6.8-rc3/arch/arm/mach-ixp4xx/ixdp425-setup.c
--- linux-2.6.8-rc2/arch/arm/mach-ixp4xx/ixdp425-setup.c	2004-08-03 15:21:04.894421005 -0700
+++ linux-2.6.8-rc3/arch/arm/mach-ixp4xx/ixdp425-setup.c	2004-08-03 15:21:31.909528966 -0700
@@ -77,7 +77,7 @@
 	.flags		= IORESOURCE_MEM,
 };
 
-static struct platform_device ixdp425_flash_device = {
+static struct platform_device ixdp425_flash = {
 	.name		= "IXP4XX-Flash",
 	.id		= 0,
 	.dev		= {
@@ -101,10 +101,14 @@
 	.num_resources	= 0
 };
 
+static struct platform_device *ixdp425_devices[] __initdata = {
+	&ixdp425_i2c_controller,
+	&ixdp425_flash
+};
+
 static void __init ixdp425_init(void)
 {
-	platform_add_device(&ixdp425_flash_device);
-	platform_add_device(&ixdp425_i2c_controller);
+	platform_add_devices(&ixdp425_devices, ARRAY_SIZE(ixdp425_devices));
 }
 
 MACHINE_START(IXDP425, "Intel IXDP425 Development Platform")
diff -urN linux-2.6.8-rc2/arch/arm/mach-ixp4xx/prpmc1100-setup.c linux-2.6.8-rc3/arch/arm/mach-ixp4xx/prpmc1100-setup.c
--- linux-2.6.8-rc2/arch/arm/mach-ixp4xx/prpmc1100-setup.c	2004-08-03 15:21:04.894421005 -0700
+++ linux-2.6.8-rc3/arch/arm/mach-ixp4xx/prpmc1100-setup.c	2004-08-03 15:21:31.909528966 -0700
@@ -63,7 +63,7 @@
 	.flags		= IORESOURCE_MEM,
 };
 
-static struct platform_device prpmc1100_flash_device = {
+static struct platform_device prpmc1100_flash = {
 	.name		= "IXP4XX-Flash",
 	.id		= 0,
 	.dev		= {
@@ -73,9 +73,13 @@
 	.resource	= &prpmc1100_flash_resource,
 };
 
+static struct platform_device *prpmc1100_devices[] __initdata = {
+	&prpmc1100_flash
+};
+
 static void __init prpmc1100_init(void)
 {
-	platform_add_device(&prpmc1100_flash_device);
+	platform_add_devices(&prpmc1100_devices, ARRAY_SIZE(prpmc1100_devices));
 }
 
 MACHINE_START(PRPMC1100, "Motorola PrPMC1100")
diff -urN linux-2.6.8-rc2/arch/arm/mm/fault.c linux-2.6.8-rc3/arch/arm/mm/fault.c
--- linux-2.6.8-rc2/arch/arm/mm/fault.c	2004-06-15 22:19:36.000000000 -0700
+++ linux-2.6.8-rc3/arch/arm/mm/fault.c	2004-08-03 15:21:31.950530648 -0700
@@ -129,7 +129,7 @@
 	si.si_signo = SIGSEGV;
 	si.si_errno = 0;
 	si.si_code = code;
-	si.si_addr = (void *)addr;
+	si.si_addr = (void __user *)addr;
 	force_sig_info(SIGSEGV, &si, tsk);
 }
 
diff -urN linux-2.6.8-rc2/arch/arm/mm/init.c linux-2.6.8-rc3/arch/arm/mm/init.c
--- linux-2.6.8-rc2/arch/arm/mm/init.c	2004-08-03 15:21:04.994425102 -0700
+++ linux-2.6.8-rc3/arch/arm/mm/init.c	2004-08-03 15:21:31.951530689 -0700
@@ -502,7 +502,7 @@
 		 */
 		arch_adjust_zones(node, zone_size, zhole_size);
 
-		free_area_init_node(node, pgdat, 0, zone_size,
+		free_area_init_node(node, pgdat, NULL, zone_size,
 				bdata->node_boot_start >> PAGE_SHIFT, zhole_size);
 	}
 
diff -urN linux-2.6.8-rc2/arch/i386/Makefile linux-2.6.8-rc3/arch/i386/Makefile
--- linux-2.6.8-rc2/arch/i386/Makefile	2004-08-03 15:21:05.041427027 -0700
+++ linux-2.6.8-rc3/arch/i386/Makefile	2004-08-03 15:21:32.007532987 -0700
@@ -104,7 +104,8 @@
 libs-y 					+= arch/i386/lib/
 core-y					+= arch/i386/kernel/ \
 					   arch/i386/mm/ \
-					   arch/i386/$(mcore-y)/
+					   arch/i386/$(mcore-y)/ \
+					   arch/i386/crypto/
 drivers-$(CONFIG_MATH_EMULATION)	+= arch/i386/math-emu/
 drivers-$(CONFIG_PCI)			+= arch/i386/pci/
 # must be linked after kernel/
diff -urN linux-2.6.8-rc2/arch/i386/boot98/compressed/Makefile linux-2.6.8-rc3/arch/i386/boot98/compressed/Makefile
--- linux-2.6.8-rc2/arch/i386/boot98/compressed/Makefile	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/arch/i386/boot98/compressed/Makefile	1969-12-31 16:00:00.000000000 -0800
@@ -1,25 +0,0 @@
-#
-# linux/arch/i386/boot/compressed/Makefile
-#
-# create a compressed vmlinux image from the original vmlinux
-#
-
-targets		:= vmlinux vmlinux.bin vmlinux.bin.gz head.o misc.o piggy.o
-EXTRA_AFLAGS	:= -traditional
-
-LDFLAGS_vmlinux := -Ttext $(IMAGE_OFFSET) -e startup_32
-
-$(obj)/vmlinux: $(obj)/head.o $(obj)/misc.o $(obj)/piggy.o FORCE
-	$(call if_changed,ld)
-	@:
-
-$(obj)/vmlinux.bin: vmlinux FORCE
-	$(call if_changed,objcopy)
-
-$(obj)/vmlinux.bin.gz: $(obj)/vmlinux.bin FORCE
-	$(call if_changed,gzip)
-
-LDFLAGS_piggy.o := -r --format binary --oformat elf32-i386 -T
-
-$(obj)/piggy.o: $(obj)/vmlinux.scr $(obj)/vmlinux.bin.gz FORCE
-	$(call if_changed,ld)
diff -urN linux-2.6.8-rc2/arch/i386/boot98/compressed/head.S linux-2.6.8-rc3/arch/i386/boot98/compressed/head.S
--- linux-2.6.8-rc2/arch/i386/boot98/compressed/head.S	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/arch/i386/boot98/compressed/head.S	1969-12-31 16:00:00.000000000 -0800
@@ -1,128 +0,0 @@
-/*
- *  linux/boot/head.S
- *
- *  Copyright (C) 1991, 1992, 1993  Linus Torvalds
- */
-
-/*
- *  head.S contains the 32-bit startup code.
- *
- * NOTE!!! Startup happens at absolute address 0x00001000, which is also where
- * the page directory will exist. The startup code will be overwritten by
- * the page directory. [According to comments etc elsewhere on a compressed
- * kernel it will end up at 0x1000 + 1Mb I hope so as I assume this. - AC]
- *
- * Page 0 is deliberately kept safe, since System Management Mode code in 
- * laptops may need to access the BIOS data stored there.  This is also
- * useful for future device drivers that either access the BIOS via VM86 
- * mode.
- */
-
-/*
- * High loaded stuff by Hans Lermen & Werner Almesberger, Feb. 1996
- */
-.text
-
-#include <linux/linkage.h>
-#include <asm/segment.h>
-
-	.globl startup_32
-	
-startup_32:
-	cld
-	cli
-	movl $(__BOOT_DS),%eax
-	movl %eax,%ds
-	movl %eax,%es
-	movl %eax,%fs
-	movl %eax,%gs
-
-	lss stack_start,%esp
-	xorl %eax,%eax
-1:	incl %eax		# check that A20 really IS enabled
-	movl %eax,0x000000	# loop forever if it isn't
-	cmpl %eax,0x100000
-	je 1b
-
-/*
- * Initialize eflags.  Some BIOS's leave bits like NT set.  This would
- * confuse the debugger if this code is traced.
- * XXX - best to initialize before switching to protected mode.
- */
-	pushl $0
-	popfl
-/*
- * Clear BSS
- */
-	xorl %eax,%eax
-	movl $_edata,%edi
-	movl $_end,%ecx
-	subl %edi,%ecx
-	cld
-	rep
-	stosb
-/*
- * Do the decompression, and jump to the new kernel..
- */
-	subl $16,%esp	# place for structure on the stack
-	movl %esp,%eax
-	pushl %esi	# real mode pointer as second arg
-	pushl %eax	# address of structure as first arg
-	call decompress_kernel
-	orl  %eax,%eax 
-	jnz  3f
-	popl %esi	# discard address
-	popl %esi	# real mode pointer
-	xorl %ebx,%ebx
-	ljmp $(__BOOT_CS), $0x100000
-
-/*
- * We come here, if we were loaded high.
- * We need to move the move-in-place routine down to 0x1000
- * and then start it with the buffer addresses in registers,
- * which we got from the stack.
- */
-3:
-	movl $move_routine_start,%esi
-	movl $0x1000,%edi
-	movl $move_routine_end,%ecx
-	subl %esi,%ecx
-	addl $3,%ecx
-	shrl $2,%ecx
-	cld
-	rep
-	movsl
-
-	popl %esi	# discard the address
-	popl %ebx	# real mode pointer
-	popl %esi	# low_buffer_start
-	popl %ecx	# lcount
-	popl %edx	# high_buffer_start
-	popl %eax	# hcount
-	movl $0x100000,%edi
-	cli		# make sure we don't get interrupted
-	ljmp $(__BOOT_CS), $0x1000 # and jump to the move routine
-
-/*
- * Routine (template) for moving the decompressed kernel in place,
- * if we were high loaded. This _must_ PIC-code !
- */
-move_routine_start:
-	movl %ecx,%ebp
-	shrl $2,%ecx
-	rep
-	movsl
-	movl %ebp,%ecx
-	andl $3,%ecx
-	rep
-	movsb
-	movl %edx,%esi
-	movl %eax,%ecx	# NOTE: rep movsb won't move if %ecx == 0
-	addl $3,%ecx
-	shrl $2,%ecx
-	rep
-	movsl
-	movl %ebx,%esi	# Restore setup pointer
-	xorl %ebx,%ebx
-	ljmp $(__BOOT_CS), $0x100000
-move_routine_end:
diff -urN linux-2.6.8-rc2/arch/i386/boot98/compressed/misc.c linux-2.6.8-rc3/arch/i386/boot98/compressed/misc.c
--- linux-2.6.8-rc2/arch/i386/boot98/compressed/misc.c	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/arch/i386/boot98/compressed/misc.c	1969-12-31 16:00:00.000000000 -0800
@@ -1,379 +0,0 @@
-/*
- * misc.c
- * 
- * This is a collection of several routines from gzip-1.0.3 
- * adapted for Linux.
- *
- * malloc by Hannu Savolainen 1993 and Matthias Urlichs 1994
- * puts by Nick Holloway 1993, better puts by Martin Mares 1995
- * High loaded stuff by Hans Lermen & Werner Almesberger, Feb. 1996
- */
-
-#include <linux/linkage.h>
-#include <linux/vmalloc.h>
-#include <linux/tty.h>
-#include <asm/io.h>
-#ifdef STANDARD_MEMORY_BIOS_CALL
-#undef STANDARD_MEMORY_BIOS_CALL
-#endif
-
-/*
- * gzip declarations
- */
-
-#define OF(args)  args
-#define STATIC static
-
-#undef memset
-#undef memcpy
-
-/*
- * Why do we do this? Don't ask me..
- *
- * Incomprehensible are the ways of bootloaders.
- */
-static void* memset(void *, int, size_t);
-static void* memcpy(void *, __const void *, size_t);
-#define memzero(s, n)     memset ((s), 0, (n))
-
-typedef unsigned char  uch;
-typedef unsigned short ush;
-typedef unsigned long  ulg;
-
-#define WSIZE 0x8000		/* Window size must be at least 32k, */
-				/* and a power of two */
-
-static uch *inbuf;	     /* input buffer */
-static uch window[WSIZE];    /* Sliding window buffer */
-
-static unsigned insize = 0;  /* valid bytes in inbuf */
-static unsigned inptr = 0;   /* index of next byte to be processed in inbuf */
-static unsigned outcnt = 0;  /* bytes in output buffer */
-
-/* gzip flag byte */
-#define ASCII_FLAG   0x01 /* bit 0 set: file probably ASCII text */
-#define CONTINUATION 0x02 /* bit 1 set: continuation of multi-part gzip file */
-#define EXTRA_FIELD  0x04 /* bit 2 set: extra field present */
-#define ORIG_NAME    0x08 /* bit 3 set: original file name present */
-#define COMMENT      0x10 /* bit 4 set: file comment present */
-#define ENCRYPTED    0x20 /* bit 5 set: file is encrypted */
-#define RESERVED     0xC0 /* bit 6,7:   reserved */
-
-#define get_byte()  (inptr < insize ? inbuf[inptr++] : fill_inbuf())
-		
-/* Diagnostic functions */
-#ifdef DEBUG
-#  define Assert(cond,msg) {if(!(cond)) error(msg);}
-#  define Trace(x) fprintf x
-#  define Tracev(x) {if (verbose) fprintf x ;}
-#  define Tracevv(x) {if (verbose>1) fprintf x ;}
-#  define Tracec(c,x) {if (verbose && (c)) fprintf x ;}
-#  define Tracecv(c,x) {if (verbose>1 && (c)) fprintf x ;}
-#else
-#  define Assert(cond,msg)
-#  define Trace(x)
-#  define Tracev(x)
-#  define Tracevv(x)
-#  define Tracec(c,x)
-#  define Tracecv(c,x)
-#endif
-
-static int  fill_inbuf(void);
-static void flush_window(void);
-static void error(char *m);
-static void gzip_mark(void **);
-static void gzip_release(void **);
-  
-/*
- * This is set up by the setup-routine at boot-time
- */
-static unsigned char *real_mode; /* Pointer to real-mode data */
-
-#define EXT_MEM_K   (*(unsigned short *)(real_mode + 0x2))
-#ifndef STANDARD_MEMORY_BIOS_CALL
-#define ALT_MEM_K   (*(unsigned long *)(real_mode + 0x1e0))
-#endif
-#define SCREEN_INFO (*(struct screen_info *)(real_mode+0))
-
-extern char input_data[];
-extern int input_len;
-
-static long bytes_out = 0;
-static uch *output_data;
-static unsigned long output_ptr = 0;
-
-static void *malloc(int size);
-static void free(void *where);
-
-static void puts(const char *);
-
-extern int end;
-static long free_mem_ptr = (long)&end;
-static long free_mem_end_ptr;
-
-#define INPLACE_MOVE_ROUTINE  0x1000
-#define LOW_BUFFER_START      0x2000
-#define LOW_BUFFER_MAX       0x90000
-#define HEAP_SIZE             0x3000
-static unsigned int low_buffer_end, low_buffer_size;
-static int high_loaded =0;
-static uch *high_buffer_start /* = (uch *)(((ulg)&end) + HEAP_SIZE)*/;
-
-static char *vidmem = (char *)0xa0000;
-static int lines, cols;
-
-#ifdef CONFIG_X86_NUMAQ
-static void * xquad_portio = NULL;
-#endif
-
-#include "../../../../lib/inflate.c"
-
-static void *malloc(int size)
-{
-	void *p;
-
-	if (size <0) error("Malloc error");
-	if (free_mem_ptr <= 0) error("Memory error");
-
-	free_mem_ptr = (free_mem_ptr + 3) & ~3;	/* Align */
-
-	p = (void *)free_mem_ptr;
-	free_mem_ptr += size;
-
-	if (free_mem_ptr >= free_mem_end_ptr)
-		error("Out of memory");
-
-	return p;
-}
-
-static void free(void *where)
-{	/* Don't care */
-}
-
-static void gzip_mark(void **ptr)
-{
-	*ptr = (void *) free_mem_ptr;
-}
-
-static void gzip_release(void **ptr)
-{
-	free_mem_ptr = (long) *ptr;
-}
- 
-static void scroll(void)
-{
-	int i;
-
-	memcpy ( vidmem, vidmem + cols * 2, ( lines - 1 ) * cols * 2 );
-	for ( i = ( lines - 1 ) * cols * 2; i < lines * cols * 2; i += 2 )
-		vidmem[i] = ' ';
-}
-
-static void puts(const char *s)
-{
-	int x,y,pos;
-	char c;
-
-	x = SCREEN_INFO.orig_x;
-	y = SCREEN_INFO.orig_y;
-
-	while ( ( c = *s++ ) != '\0' ) {
-		if ( c == '\n' ) {
-			x = 0;
-			if ( ++y >= lines ) {
-				scroll();
-				y--;
-			}
-		} else {
-			vidmem [ ( x + cols * y ) * 2 ] = c; 
-			if ( ++x >= cols ) {
-				x = 0;
-				if ( ++y >= lines ) {
-					scroll();
-					y--;
-				}
-			}
-		}
-	}
-
-	SCREEN_INFO.orig_x = x;
-	SCREEN_INFO.orig_y = y;
-
-	pos = x + cols * y;	/* Update cursor position */
-	while (!(inb_p(0x60) & 4));
-	outb_p(0x49, 0x62);
-	outb_p(pos & 0xff, 0x60);
-	outb_p((pos >> 8) & 0xff, 0x60);
-}
-
-static void* memset(void* s, int c, size_t n)
-{
-	int i;
-	char *ss = (char*)s;
-
-	for (i=0;i<n;i++) ss[i] = c;
-	return s;
-}
-
-static void* memcpy(void* __dest, __const void* __src,
-			    size_t __n)
-{
-	int i;
-	char *d = (char *)__dest, *s = (char *)__src;
-
-	for (i=0;i<__n;i++) d[i] = s[i];
-	return __dest;
-}
-
-/* ===========================================================================
- * Fill the input buffer. This is called only when the buffer is empty
- * and at least one byte is really needed.
- */
-static int fill_inbuf(void)
-{
-	if (insize != 0) {
-		error("ran out of input data");
-	}
-
-	inbuf = input_data;
-	insize = input_len;
-	inptr = 1;
-	return inbuf[0];
-}
-
-/* ===========================================================================
- * Write the output window window[0..outcnt-1] and update crc and bytes_out.
- * (Used for the decompressed data only.)
- */
-static void flush_window_low(void)
-{
-    ulg c = crc;         /* temporary variable */
-    unsigned n;
-    uch *in, *out, ch;
-    
-    in = window;
-    out = &output_data[output_ptr]; 
-    for (n = 0; n < outcnt; n++) {
-	    ch = *out++ = *in++;
-	    c = crc_32_tab[((int)c ^ ch) & 0xff] ^ (c >> 8);
-    }
-    crc = c;
-    bytes_out += (ulg)outcnt;
-    output_ptr += (ulg)outcnt;
-    outcnt = 0;
-}
-
-static void flush_window_high(void)
-{
-    ulg c = crc;         /* temporary variable */
-    unsigned n;
-    uch *in,  ch;
-    in = window;
-    for (n = 0; n < outcnt; n++) {
-	ch = *output_data++ = *in++;
-	if ((ulg)output_data == low_buffer_end) output_data=high_buffer_start;
-	c = crc_32_tab[((int)c ^ ch) & 0xff] ^ (c >> 8);
-    }
-    crc = c;
-    bytes_out += (ulg)outcnt;
-    outcnt = 0;
-}
-
-static void flush_window(void)
-{
-	if (high_loaded) flush_window_high();
-	else flush_window_low();
-}
-
-static void error(char *x)
-{
-	puts("\n\n");
-	puts(x);
-	puts("\n\n -- System halted");
-
-	while(1);	/* Halt */
-}
-
-#define STACK_SIZE (4096)
-
-long user_stack [STACK_SIZE];
-
-struct {
-	long * a;
-	short b;
-	} stack_start = { & user_stack [STACK_SIZE] , __BOOT_DS };
-
-static void setup_normal_output_buffer(void)
-{
-#ifdef STANDARD_MEMORY_BIOS_CALL
-	if (EXT_MEM_K < 1024) error("Less than 2MB of memory");
-#else
-	if ((ALT_MEM_K > EXT_MEM_K ? ALT_MEM_K : EXT_MEM_K) < 1024) error("Less than 2MB of memory");
-#endif
-	output_data = (char *)0x100000; /* Points to 1M */
-	free_mem_end_ptr = (long)real_mode;
-}
-
-struct moveparams {
-	uch *low_buffer_start;  int lcount;
-	uch *high_buffer_start; int hcount;
-};
-
-static void setup_output_buffer_if_we_run_high(struct moveparams *mv)
-{
-	high_buffer_start = (uch *)(((ulg)&end) + HEAP_SIZE);
-#ifdef STANDARD_MEMORY_BIOS_CALL
-	if (EXT_MEM_K < (3*1024)) error("Less than 4MB of memory");
-#else
-	if ((ALT_MEM_K > EXT_MEM_K ? ALT_MEM_K : EXT_MEM_K) < (3*1024)) error("Less than 4MB of memory");
-#endif	
-	mv->low_buffer_start = output_data = (char *)LOW_BUFFER_START;
-	low_buffer_end = ((unsigned int)real_mode > LOW_BUFFER_MAX
-	  ? LOW_BUFFER_MAX : (unsigned int)real_mode) & ~0xfff;
-	low_buffer_size = low_buffer_end - LOW_BUFFER_START;
-	high_loaded = 1;
-	free_mem_end_ptr = (long)high_buffer_start;
-	if ( (0x100000 + low_buffer_size) > ((ulg)high_buffer_start)) {
-		high_buffer_start = (uch *)(0x100000 + low_buffer_size);
-		mv->hcount = 0; /* say: we need not to move high_buffer */
-	}
-	else mv->hcount = -1;
-	mv->high_buffer_start = high_buffer_start;
-}
-
-static void close_output_buffer_if_we_run_high(struct moveparams *mv)
-{
-	if (bytes_out > low_buffer_size) {
-		mv->lcount = low_buffer_size;
-		if (mv->hcount)
-			mv->hcount = bytes_out - low_buffer_size;
-	} else {
-		mv->lcount = bytes_out;
-		mv->hcount = 0;
-	}
-}
-
-
-asmlinkage int decompress_kernel(struct moveparams *mv, void *rmode)
-{
-	real_mode = rmode;
-
-	vidmem = (char *)(((unsigned int)SCREEN_INFO.orig_video_page) << 4);
-
-	lines = SCREEN_INFO.orig_video_lines;
-	cols = SCREEN_INFO.orig_video_cols;
-
-	if (free_mem_ptr < 0x100000) setup_normal_output_buffer();
-	else setup_output_buffer_if_we_run_high(mv);
-
-	makecrc();
-	puts("Uncompressing Linux... ");
-	gunzip();
-	puts("Ok, booting the kernel.\n");
-	if (high_loaded) close_output_buffer_if_we_run_high(mv);
-	return high_loaded;
-}
-
-/* We don't actually check for stack overflows this early. */
-__asm__(".globl mcount ; mcount: ret\n");
-
diff -urN linux-2.6.8-rc2/arch/i386/boot98/compressed/vmlinux.scr linux-2.6.8-rc3/arch/i386/boot98/compressed/vmlinux.scr
--- linux-2.6.8-rc2/arch/i386/boot98/compressed/vmlinux.scr	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/arch/i386/boot98/compressed/vmlinux.scr	1969-12-31 16:00:00.000000000 -0800
@@ -1,9 +0,0 @@
-SECTIONS
-{
-  .data : { 
-	input_len = .;
-	LONG(input_data_end - input_data) input_data = .; 
-	*(.data) 
-	input_data_end = .; 
-	}
-}
diff -urN linux-2.6.8-rc2/arch/i386/boot98/tools/build.c linux-2.6.8-rc3/arch/i386/boot98/tools/build.c
--- linux-2.6.8-rc2/arch/i386/boot98/tools/build.c	2004-06-15 22:19:42.000000000 -0700
+++ linux-2.6.8-rc3/arch/i386/boot98/tools/build.c	1969-12-31 16:00:00.000000000 -0800
@@ -1,185 +0,0 @@
-/*
- *  $Id: build.c,v 1.5 1997/05/19 12:29:58 mj Exp $
- *
- *  Copyright (C) 1991, 1992  Linus Torvalds
- *  Copyright (C) 1997 Martin Mares
- */
-
-/*
- * This file builds a disk-image from three different files:
- *
- * - bootsect: exactly 512 bytes of 8086 machine code, loads the rest
- * - setup: 8086 machine code, sets up system parm
- * - system: 80386 code for actual system
- *
- * It does some checking that all files are of the correct type, and
- * just writes the result to stdout, removing headers and padding to
- * the right amount. It also writes some system data to stderr.
- */
-
-/*
- * Changes by tytso to allow root device specification
- * High loaded stuff by Hans Lermen & Werner Almesberger, Feb. 1996
- * Cross compiling fixes by Gertjan van Wingerde, July 1996
- * Rewritten by Martin Mares, April 1997
- */
-
-#include <stdio.h>
-#include <string.h>
-#include <stdlib.h>
-#include <stdarg.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/sysmacros.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <asm/boot.h>
-
-typedef unsigned char byte;
-typedef unsigned short word;
-typedef unsigned long u32;
-
-#define DEFAULT_MAJOR_ROOT 0
-#define DEFAULT_MINOR_ROOT 0
-
-/* Minimal number of setup sectors (see also bootsect.S) */
-#define SETUP_SECTS 4
-
-byte buf[1024];
-int fd;
-int is_big_kernel;
-
-void die(const char * str, ...)
-{
-	va_list args;
-	va_start(args, str);
-	vfprintf(stderr, str, args);
-	fputc('\n', stderr);
-	exit(1);
-}
-
-void file_open(const char *name)
-{
-	if ((fd = open(name, O_RDONLY, 0)) < 0)
-		die("Unable to open `%s': %m", name);
-}
-
-void usage(void)
-{
-	die("Usage: build [-b] bootsect setup system [rootdev] [> image]");
-}
-
-int main(int argc, char ** argv)
-{
-	unsigned int i, c, sz, setup_sectors;
-	u32 sys_size;
-	byte major_root, minor_root;
-	struct stat sb;
-
-	if (argc > 2 && !strcmp(argv[1], "-b"))
-	  {
-	    is_big_kernel = 1;
-	    argc--, argv++;
-	  }
-	if ((argc < 4) || (argc > 5))
-		usage();
-	if (argc > 4) {
-		if (!strcmp(argv[4], "CURRENT")) {
-			if (stat("/", &sb)) {
-				perror("/");
-				die("Couldn't stat /");
-			}
-			major_root = major(sb.st_dev);
-			minor_root = minor(sb.st_dev);
-		} else if (strcmp(argv[4], "FLOPPY")) {
-			if (stat(argv[4], &sb)) {
-				perror(argv[4]);
-				die("Couldn't stat root device.");
-			}
-			major_root = major(sb.st_rdev);
-			minor_root = minor(sb.st_rdev);
-		} else {
-			major_root = 0;
-			minor_root = 0;
-		}
-	} else {
-		major_root = DEFAULT_MAJOR_ROOT;
-		minor_root = DEFAULT_MINOR_ROOT;
-	}
-	fprintf(stderr, "Root device is (%d, %d)\n", major_root, minor_root);
-
-	file_open(argv[1]);
-	i = read(fd, buf, sizeof(buf));
-	fprintf(stderr,"Boot sector %d bytes.\n",i);
-	if (i != 512)
-		die("Boot block must be exactly 512 bytes");
-	if (buf[510] != 0x55 || buf[511] != 0xaa)
-		die("Boot block hasn't got boot flag (0xAA55)");
-	buf[508] = minor_root;
-	buf[509] = major_root;
-	if (write(1, buf, 512) != 512)
-		die("Write call failed");
-	close (fd);
-
-	file_open(argv[2]);				    /* Copy the setup code */
-	for (i=0 ; (c=read(fd, buf, sizeof(buf)))>0 ; i+=c )
-		if (write(1, buf, c) != c)
-			die("Write call failed");
-	if (c != 0)
-		die("read-error on `setup'");
-	close (fd);
-
-	setup_sectors = (i + 511) / 512;	/* Pad unused space with zeros */
-	if (!(setup_sectors & 1))
-		setup_sectors++;    /* setup_sectors must be odd on NEC PC-9800 */
-	fprintf(stderr, "Setup is %d bytes.\n", i);
-	memset(buf, 0, sizeof(buf));
-	while (i < setup_sectors * 512) {
-		c = setup_sectors * 512 - i;
-		if (c > sizeof(buf))
-			c = sizeof(buf);
-		if (write(1, buf, c) != c)
-			die("Write call failed");
-		i += c;
-	}
-
-	file_open(argv[3]);
-	if (fstat (fd, &sb))
-		die("Unable to stat `%s': %m", argv[3]);
-	sz = sb.st_size;
-	fprintf (stderr, "System is %d kB\n", sz/1024);
-	sys_size = (sz + 15) / 16;
-	/* 0x40000*16 = 4.0 MB, reasonable estimate for the current maximum */
-	if (sys_size > (is_big_kernel ? 0x40000 : DEF_SYSSIZE))
-		die("System is too big. Try using %smodules.",
-			is_big_kernel ? "" : "bzImage or ");
-	while (sz > 0) {
-		int l, n;
-
-		l = (sz > sizeof(buf)) ? sizeof(buf) : sz;
-		if ((n=read(fd, buf, l)) != l) {
-			if (n < 0)
-				die("Error reading %s: %m", argv[3]);
-			else
-				die("%s: Unexpected EOF", argv[3]);
-		}
-		if (write(1, buf, l) != l)
-			die("Write failed");
-		sz -= l;
-	}
-	close(fd);
-
-	if (lseek(1, 497, SEEK_SET) != 497)		    /* Write sizes to the bootsector */
-		die("Output: seek failed");
-	buf[0] = setup_sectors;
-	if (write(1, buf, 1) != 1)
-		die("Write of setup sector count failed");
-	if (lseek(1, 500, SEEK_SET) != 500)
-		die("Output: seek failed");
-	buf[0] = (sys_size & 0xff);
-	buf[1] = ((sys_size >> 8) & 0xff);
-	if (write(1, buf, 2) != 2)
-		die("Write of image length failed");
-
-	return 0;					    /* Everything is OK */
-}
diff -urN linux-2.6.8-rc2/arch/i386/crypto/Makefile linux-2.6.8-rc3/arch/i386/crypto/Makefile
--- linux-2.6.8-rc2/arch/i386/crypto/Makefile	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/i386/crypto/Makefile	2004-08-03 15:21:32.032534012 -0700
@@ -0,0 +1,9 @@
+# 
+# i386/crypto/Makefile 
+# 
+# Arch-specific CryptoAPI modules.
+# 
+
+obj-$(CONFIG_CRYPTO_AES_586) += aes-i586.o
+
+aes-i586-y := aes-i586-asm.o aes-i586-glue.o
diff -urN linux-2.6.8-rc2/arch/i386/crypto/aes-i586-asm.S linux-2.6.8-rc3/arch/i386/crypto/aes-i586-asm.S
--- linux-2.6.8-rc2/arch/i386/crypto/aes-i586-asm.S	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/i386/crypto/aes-i586-asm.S	2004-08-03 15:21:32.035534136 -0700
@@ -0,0 +1,903 @@
+// Copyright (c) 2001, Dr Brian Gladman <brg@gladman.uk.net>, Worcester, UK.
+// All rights reserved.
+//
+// TERMS
+//
+//  Redistribution and use in source and binary forms, with or without
+//  modification, are permitted subject to the following conditions:
+//
+//  1. Redistributions of source code must retain the above copyright
+//     notice, this list of conditions and the following disclaimer.
+//
+//  2. Redistributions in binary form must reproduce the above copyright
+//     notice, this list of conditions and the following disclaimer in the
+//     documentation and/or other materials provided with the distribution.
+//
+//  3. The copyright holder's name must not be used to endorse or promote
+//     any products derived from this software without his specific prior
+//     written permission.
+//
+//  ALTERNATIVELY, provided that this notice is retained in full, this product
+//  may be distributed under the terms of the GNU General Public License (GPL),
+//  in which case the provisions of the GPL apply INSTEAD OF those given above.
+//
+//  This software is provided 'as is' with no express or implied warranties
+//  of correctness or fitness for purpose.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License as published by the Free
+// Software Foundation; either version 2 of the License, or (at your option) 
+// any later version.
+
+// Modified by Jari Ruusu,  December 24 2001
+//  - Converted syntax to GNU CPP/assembler syntax
+//  - C programming interface converted back to "old" API
+//  - Minor portability cleanups and speed optimizations
+
+// Modified by Jari Ruusu,  April 11 2002
+//  - Added above copyright and terms to resulting object code so that
+//    binary distributions can avoid legal trouble
+
+// Modified by Clemens Fruhwirth,  Feb 04 2003
+//  - Switched in/out to fit CryptoAPI calls.
+
+// Modified by James Morris,  July 31 2004
+//  - Added alternate GPL licensing clause with permission from Dr Gladman.
+
+// An AES (Rijndael) implementation for the Pentium. This version only
+// implements the standard AES block length (128 bits, 16 bytes). This code
+// does not preserve the eax, ecx or edx registers or the artihmetic status
+// flags. However, the ebx, esi, edi, and ebp registers are preserved across
+// calls.
+
+// void aes_set_key(aes_context *cx, const unsigned char key[], const int key_len, const int f)
+// void aes_encrypt(const aes_context *cx, unsigned char out_blk[], const unsigned char in_blk[])
+// void aes_decrypt(const aes_context *cx, unsigned char out_blk[], const unsigned char in_blk[])
+
+# define ALIGN32BYTES 32
+
+	.file	"aes-i586.S"
+	.globl	aes_set_key
+	.globl	aes_encrypt
+	.globl	aes_decrypt
+
+#define tlen	1024	// length of each of 4 'xor' arrays (256 32-bit words)
+
+// offsets to parameters with one register pushed onto stack
+
+#define ctx	8	// AES context structure
+#define out_blk	12	// output byte array address parameter
+#define in_blk	16	// input byte array address parameter
+
+// offsets in context structure
+
+#define nkey	0	// key length, size 4
+#define nrnd	4	// number of rounds, size 4
+#define ekey	8	// encryption key schedule base address, size 256
+#define dkey	264	// decryption key schedule base address, size 256
+
+// This macro performs a forward encryption cycle. It is entered with
+// the first previous round column values in %eax, %ebx, %esi and %edi and
+// exits with the final values in the same registers.
+
+#define fwd_rnd(p1,p2)			 \
+	mov	%ebx,(%esp)		;\
+	movzbl	%al,%edx		;\
+	mov	%eax,%ecx		;\
+	mov	p2(%ebp),%eax		;\
+	mov	%edi,4(%esp)		;\
+	mov	p2+12(%ebp),%edi	;\
+	xor	p1(,%edx,4),%eax	;\
+	movzbl	%ch,%edx		;\
+	shr	$16,%ecx		;\
+	mov	p2+4(%ebp),%ebx		;\
+	xor	p1+tlen(,%edx,4),%edi	;\
+	movzbl	%cl,%edx		;\
+	movzbl	%ch,%ecx		;\
+	xor	p1+3*tlen(,%ecx,4),%ebx	;\
+	mov	%esi,%ecx		;\
+	mov	p1+2*tlen(,%edx,4),%esi	;\
+	movzbl	%cl,%edx		;\
+	xor	p1(,%edx,4),%esi	;\
+	movzbl	%ch,%edx		;\
+	shr	$16,%ecx		;\
+	xor	p1+tlen(,%edx,4),%ebx	;\
+	movzbl	%cl,%edx		;\
+	movzbl	%ch,%ecx		;\
+	xor	p1+2*tlen(,%edx,4),%eax	;\
+	mov	(%esp),%edx		;\
+	xor	p1+3*tlen(,%ecx,4),%edi ;\
+	movzbl	%dl,%ecx		;\
+	xor	p2+8(%ebp),%esi		;\
+	xor	p1(,%ecx,4),%ebx	;\
+	movzbl	%dh,%ecx		;\
+	shr	$16,%edx		;\
+	xor	p1+tlen(,%ecx,4),%eax	;\
+	movzbl	%dl,%ecx		;\
+	movzbl	%dh,%edx		;\
+	xor	p1+2*tlen(,%ecx,4),%edi	;\
+	mov	4(%esp),%ecx		;\
+	xor	p1+3*tlen(,%edx,4),%esi ;\
+	movzbl	%cl,%edx		;\
+	xor	p1(,%edx,4),%edi	;\
+	movzbl	%ch,%edx		;\
+	shr	$16,%ecx		;\
+	xor	p1+tlen(,%edx,4),%esi	;\
+	movzbl	%cl,%edx		;\
+	movzbl	%ch,%ecx		;\
+	xor	p1+2*tlen(,%edx,4),%ebx	;\
+	xor	p1+3*tlen(,%ecx,4),%eax
+
+// This macro performs an inverse encryption cycle. It is entered with
+// the first previous round column values in %eax, %ebx, %esi and %edi and
+// exits with the final values in the same registers.
+
+#define inv_rnd(p1,p2)			 \
+	movzbl	%al,%edx		;\
+	mov	%ebx,(%esp)		;\
+	mov	%eax,%ecx		;\
+	mov	p2(%ebp),%eax		;\
+	mov	%edi,4(%esp)		;\
+	mov	p2+4(%ebp),%ebx		;\
+	xor	p1(,%edx,4),%eax	;\
+	movzbl	%ch,%edx		;\
+	shr	$16,%ecx		;\
+	mov	p2+12(%ebp),%edi	;\
+	xor	p1+tlen(,%edx,4),%ebx	;\
+	movzbl	%cl,%edx		;\
+	movzbl	%ch,%ecx		;\
+	xor	p1+3*tlen(,%ecx,4),%edi	;\
+	mov	%esi,%ecx		;\
+	mov	p1+2*tlen(,%edx,4),%esi	;\
+	movzbl	%cl,%edx		;\
+	xor	p1(,%edx,4),%esi	;\
+	movzbl	%ch,%edx		;\
+	shr	$16,%ecx		;\
+	xor	p1+tlen(,%edx,4),%edi	;\
+	movzbl	%cl,%edx		;\
+	movzbl	%ch,%ecx		;\
+	xor	p1+2*tlen(,%edx,4),%eax	;\
+	mov	(%esp),%edx		;\
+	xor	p1+3*tlen(,%ecx,4),%ebx ;\
+	movzbl	%dl,%ecx		;\
+	xor	p2+8(%ebp),%esi		;\
+	xor	p1(,%ecx,4),%ebx	;\
+	movzbl	%dh,%ecx		;\
+	shr	$16,%edx		;\
+	xor	p1+tlen(,%ecx,4),%esi	;\
+	movzbl	%dl,%ecx		;\
+	movzbl	%dh,%edx		;\
+	xor	p1+2*tlen(,%ecx,4),%edi	;\
+	mov	4(%esp),%ecx		;\
+	xor	p1+3*tlen(,%edx,4),%eax ;\
+	movzbl	%cl,%edx		;\
+	xor	p1(,%edx,4),%edi	;\
+	movzbl	%ch,%edx		;\
+	shr	$16,%ecx		;\
+	xor	p1+tlen(,%edx,4),%eax	;\
+	movzbl	%cl,%edx		;\
+	movzbl	%ch,%ecx		;\
+	xor	p1+2*tlen(,%edx,4),%ebx	;\
+	xor	p1+3*tlen(,%ecx,4),%esi
+
+// AES (Rijndael) Encryption Subroutine
+
+	.text
+	.align	ALIGN32BYTES
+aes_encrypt:
+	push	%ebp
+	mov	ctx(%esp),%ebp		// pointer to context
+	mov	in_blk(%esp),%ecx
+	push	%ebx
+	push	%esi
+	push	%edi
+	mov	nrnd(%ebp),%edx		// number of rounds
+	lea	ekey+16(%ebp),%ebp	// key pointer
+
+// input four columns and xor in first round key
+
+	mov	(%ecx),%eax
+	mov	4(%ecx),%ebx
+	mov	8(%ecx),%esi
+	mov	12(%ecx),%edi
+	xor	-16(%ebp),%eax
+	xor	-12(%ebp),%ebx
+	xor	-8(%ebp),%esi
+	xor	-4(%ebp),%edi
+
+	sub	$8,%esp			// space for register saves on stack
+
+	sub	$10,%edx
+	je	aes_15
+	add	$32,%ebp
+	sub	$2,%edx
+	je	aes_13
+	add	$32,%ebp
+
+	fwd_rnd(aes_ft_tab,-64)		// 14 rounds for 256-bit key
+	fwd_rnd(aes_ft_tab,-48)
+aes_13:	fwd_rnd(aes_ft_tab,-32)		// 12 rounds for 192-bit key
+	fwd_rnd(aes_ft_tab,-16)
+aes_15:	fwd_rnd(aes_ft_tab,0)		// 10 rounds for 128-bit key
+	fwd_rnd(aes_ft_tab,16)
+	fwd_rnd(aes_ft_tab,32)
+	fwd_rnd(aes_ft_tab,48)
+	fwd_rnd(aes_ft_tab,64)
+	fwd_rnd(aes_ft_tab,80)
+	fwd_rnd(aes_ft_tab,96)
+	fwd_rnd(aes_ft_tab,112)
+	fwd_rnd(aes_ft_tab,128)
+	fwd_rnd(aes_fl_tab,144)		// last round uses a different table
+
+// move final values to the output array.
+
+	mov	out_blk+20(%esp),%ebp
+	add	$8,%esp
+	mov	%eax,(%ebp)
+	mov	%ebx,4(%ebp)
+	mov	%esi,8(%ebp)
+	mov	%edi,12(%ebp)
+	pop	%edi
+	pop	%esi
+	pop	%ebx
+	pop	%ebp
+	ret
+
+
+// AES (Rijndael) Decryption Subroutine
+
+	.align	ALIGN32BYTES
+aes_decrypt:
+	push	%ebp
+	mov	ctx(%esp),%ebp		// pointer to context
+	mov	in_blk(%esp),%ecx
+	push	%ebx
+	push	%esi
+	push	%edi
+	mov	nrnd(%ebp),%edx		// number of rounds
+	lea	dkey+16(%ebp),%ebp	// key pointer
+
+// input four columns and xor in first round key
+
+	mov	(%ecx),%eax
+	mov	4(%ecx),%ebx
+	mov	8(%ecx),%esi
+	mov	12(%ecx),%edi
+	xor	-16(%ebp),%eax
+	xor	-12(%ebp),%ebx
+	xor	-8(%ebp),%esi
+	xor	-4(%ebp),%edi
+
+	sub	$8,%esp			// space for register saves on stack
+
+	sub	$10,%edx
+	je	aes_25
+	add	$32,%ebp
+	sub	$2,%edx
+	je	aes_23
+	add	$32,%ebp
+
+	inv_rnd(aes_it_tab,-64)		// 14 rounds for 256-bit key
+	inv_rnd(aes_it_tab,-48)
+aes_23:	inv_rnd(aes_it_tab,-32)		// 12 rounds for 192-bit key
+	inv_rnd(aes_it_tab,-16)
+aes_25:	inv_rnd(aes_it_tab,0)		// 10 rounds for 128-bit key
+	inv_rnd(aes_it_tab,16)
+	inv_rnd(aes_it_tab,32)
+	inv_rnd(aes_it_tab,48)
+	inv_rnd(aes_it_tab,64)
+	inv_rnd(aes_it_tab,80)
+	inv_rnd(aes_it_tab,96)
+	inv_rnd(aes_it_tab,112)
+	inv_rnd(aes_it_tab,128)
+	inv_rnd(aes_il_tab,144)		// last round uses a different table
+
+// move final values to the output array.
+
+	mov	out_blk+20(%esp),%ebp
+	add	$8,%esp
+	mov	%eax,(%ebp)
+	mov	%ebx,4(%ebp)
+	mov	%esi,8(%ebp)
+	mov	%edi,12(%ebp)
+	pop	%edi
+	pop	%esi
+	pop	%ebx
+	pop	%ebp
+	ret
+
+// AES (Rijndael) Key Schedule Subroutine
+
+// input/output parameters
+
+#define aes_cx	12	// AES context
+#define in_key	16	// key input array address
+#define key_ln	20	// key length, bytes (16,24,32) or bits (128,192,256)
+#define ed_flg	24	// 0=create both encr/decr keys, 1=create encr key only
+
+// offsets for locals
+
+#define cnt	-4
+#define kpf	-8
+#define slen	8
+
+// This macro performs a column mixing operation on an input 32-bit
+// word to give a 32-bit result. It uses each of the 4 bytes in the
+// the input column to index 4 different tables of 256 32-bit words
+// that are xored together to form the output value.
+
+#define mix_col(p1)			 \
+	movzbl	%bl,%ecx		;\
+	mov	p1(,%ecx,4),%eax	;\
+	movzbl	%bh,%ecx		;\
+	ror	$16,%ebx		;\
+	xor	p1+tlen(,%ecx,4),%eax	;\
+	movzbl	%bl,%ecx		;\
+	xor	p1+2*tlen(,%ecx,4),%eax	;\
+	movzbl	%bh,%ecx		;\
+	xor	p1+3*tlen(,%ecx,4),%eax
+
+// Key Schedule Macros
+
+#define ksc4(p1)			 \
+	rol	$24,%ebx		;\
+	mix_col(aes_fl_tab)		;\
+	ror	$8,%ebx			;\
+	xor	4*p1+aes_rcon_tab,%eax	;\
+	xor	%eax,%esi		;\
+	xor	%esi,%ebp		;\
+	mov	%esi,16*p1(%edi)	;\
+	mov	%ebp,16*p1+4(%edi)	;\
+	xor	%ebp,%edx		;\
+	xor	%edx,%ebx		;\
+	mov	%edx,16*p1+8(%edi)	;\
+	mov	%ebx,16*p1+12(%edi)
+
+#define ksc6(p1)			 \
+	rol	$24,%ebx		;\
+	mix_col(aes_fl_tab)		;\
+	ror	$8,%ebx			;\
+	xor	4*p1+aes_rcon_tab,%eax	;\
+	xor	24*p1-24(%edi),%eax	;\
+	mov	%eax,24*p1(%edi)	;\
+	xor	24*p1-20(%edi),%eax	;\
+	mov	%eax,24*p1+4(%edi)	;\
+	xor	%eax,%esi		;\
+	xor	%esi,%ebp		;\
+	mov	%esi,24*p1+8(%edi)	;\
+	mov	%ebp,24*p1+12(%edi)	;\
+	xor	%ebp,%edx		;\
+	xor	%edx,%ebx		;\
+	mov	%edx,24*p1+16(%edi)	;\
+	mov	%ebx,24*p1+20(%edi)
+
+#define ksc8(p1)			 \
+	rol	$24,%ebx		;\
+	mix_col(aes_fl_tab)		;\
+	ror	$8,%ebx			;\
+	xor	4*p1+aes_rcon_tab,%eax	;\
+	xor	32*p1-32(%edi),%eax	;\
+	mov	%eax,32*p1(%edi)	;\
+	xor	32*p1-28(%edi),%eax	;\
+	mov	%eax,32*p1+4(%edi)	;\
+	xor	32*p1-24(%edi),%eax	;\
+	mov	%eax,32*p1+8(%edi)	;\
+	xor	32*p1-20(%edi),%eax	;\
+	mov	%eax,32*p1+12(%edi)	;\
+	push	%ebx			;\
+	mov	%eax,%ebx		;\
+	mix_col(aes_fl_tab)		;\
+	pop	%ebx			;\
+	xor	%eax,%esi		;\
+	xor	%esi,%ebp		;\
+	mov	%esi,32*p1+16(%edi)	;\
+	mov	%ebp,32*p1+20(%edi)	;\
+	xor	%ebp,%edx		;\
+	xor	%edx,%ebx		;\
+	mov	%edx,32*p1+24(%edi)	;\
+	mov	%ebx,32*p1+28(%edi)
+
+	.align	ALIGN32BYTES
+aes_set_key:
+	pushfl
+	push	%ebp
+	mov	%esp,%ebp
+	sub	$slen,%esp
+	push	%ebx
+	push	%esi
+	push	%edi
+
+	mov	aes_cx(%ebp),%edx	// edx -> AES context
+
+	mov	key_ln(%ebp),%ecx	// key length
+	cmpl	$128,%ecx
+	jb	aes_30
+	shr	$3,%ecx
+aes_30:	cmpl	$32,%ecx
+	je	aes_32
+	cmpl	$24,%ecx
+	je	aes_32
+	mov	$16,%ecx
+aes_32:	shr	$2,%ecx
+	mov	%ecx,nkey(%edx)
+
+	lea	6(%ecx),%eax		// 10/12/14 for 4/6/8 32-bit key length
+	mov	%eax,nrnd(%edx)
+
+	mov	in_key(%ebp),%esi	// key input array
+	lea	ekey(%edx),%edi		// key position in AES context
+	cld
+	push	%ebp
+	mov	%ecx,%eax		// save key length in eax
+	rep ;	movsl			// words in the key schedule
+	mov	-4(%esi),%ebx		// put some values in registers
+	mov	-8(%esi),%edx		// to allow faster code
+	mov	-12(%esi),%ebp
+	mov	-16(%esi),%esi
+
+	cmpl	$4,%eax			// jump on key size
+	je	aes_36
+	cmpl	$6,%eax
+	je	aes_35
+
+	ksc8(0)
+	ksc8(1)
+	ksc8(2)
+	ksc8(3)
+	ksc8(4)
+	ksc8(5)
+	ksc8(6)
+	jmp	aes_37
+aes_35:	ksc6(0)
+	ksc6(1)
+	ksc6(2)
+	ksc6(3)
+	ksc6(4)
+	ksc6(5)
+	ksc6(6)
+	ksc6(7)
+	jmp	aes_37
+aes_36:	ksc4(0)
+	ksc4(1)
+	ksc4(2)
+	ksc4(3)
+	ksc4(4)
+	ksc4(5)
+	ksc4(6)
+	ksc4(7)
+	ksc4(8)
+	ksc4(9)
+aes_37:	pop	%ebp
+	mov	aes_cx(%ebp),%edx	// edx -> AES context
+	cmpl	$0,ed_flg(%ebp)
+	jne	aes_39
+
+// compile decryption key schedule from encryption schedule - reverse
+// order and do mix_column operation on round keys except first and last
+
+	mov	nrnd(%edx),%eax		// kt = cx->d_key + nc * cx->Nrnd
+	shl	$2,%eax
+	lea	dkey(%edx,%eax,4),%edi
+	lea	ekey(%edx),%esi		// kf = cx->e_key
+
+	movsl				// copy first round key (unmodified)
+	movsl
+	movsl
+	movsl
+	sub	$32,%edi
+	movl	$1,cnt(%ebp)
+aes_38:					// do mix column on each column of
+	lodsl				// each round key
+	mov	%eax,%ebx
+	mix_col(aes_im_tab)
+	stosl
+	lodsl
+	mov	%eax,%ebx
+	mix_col(aes_im_tab)
+	stosl
+	lodsl
+	mov	%eax,%ebx
+	mix_col(aes_im_tab)
+	stosl
+	lodsl
+	mov	%eax,%ebx
+	mix_col(aes_im_tab)
+	stosl
+	sub	$32,%edi
+
+	incl	cnt(%ebp)
+	mov	cnt(%ebp),%eax
+	cmp	nrnd(%edx),%eax
+	jb	aes_38
+
+	movsl				// copy last round key (unmodified)
+	movsl
+	movsl
+	movsl
+aes_39:	pop	%edi
+	pop	%esi
+	pop	%ebx
+	mov	%ebp,%esp
+	pop	%ebp
+	popfl
+	ret
+
+
+// finite field multiplies by {02}, {04} and {08}
+
+#define f2(x)	((x<<1)^(((x>>7)&1)*0x11b))
+#define f4(x)	((x<<2)^(((x>>6)&1)*0x11b)^(((x>>6)&2)*0x11b))
+#define f8(x)	((x<<3)^(((x>>5)&1)*0x11b)^(((x>>5)&2)*0x11b)^(((x>>5)&4)*0x11b))
+
+// finite field multiplies required in table generation
+
+#define f3(x)	(f2(x) ^ x)
+#define f9(x)	(f8(x) ^ x)
+#define fb(x)	(f8(x) ^ f2(x) ^ x)
+#define fd(x)	(f8(x) ^ f4(x) ^ x)
+#define fe(x)	(f8(x) ^ f4(x) ^ f2(x))
+
+// These defines generate the forward table entries
+
+#define u0(x)	((f3(x) << 24) | (x << 16) | (x << 8) | f2(x))
+#define u1(x)	((x << 24) | (x << 16) | (f2(x) << 8) | f3(x))
+#define u2(x)	((x << 24) | (f2(x) << 16) | (f3(x) << 8) | x)
+#define u3(x)	((f2(x) << 24) | (f3(x) << 16) | (x << 8) | x)
+
+// These defines generate the inverse table entries
+
+#define v0(x)	((fb(x) << 24) | (fd(x) << 16) | (f9(x) << 8) | fe(x))
+#define v1(x)	((fd(x) << 24) | (f9(x) << 16) | (fe(x) << 8) | fb(x))
+#define v2(x)	((f9(x) << 24) | (fe(x) << 16) | (fb(x) << 8) | fd(x))
+#define v3(x)	((fe(x) << 24) | (fb(x) << 16) | (fd(x) << 8) | f9(x))
+
+// These defines generate entries for the last round tables
+
+#define w0(x)	(x)
+#define w1(x)	(x <<  8)
+#define w2(x)	(x << 16)
+#define w3(x)	(x << 24)
+
+// macro to generate inverse mix column tables (needed for the key schedule)
+
+#define im_data0(p1) \
+	.long	p1(0x00),p1(0x01),p1(0x02),p1(0x03),p1(0x04),p1(0x05),p1(0x06),p1(0x07) ;\
+	.long	p1(0x08),p1(0x09),p1(0x0a),p1(0x0b),p1(0x0c),p1(0x0d),p1(0x0e),p1(0x0f) ;\
+	.long	p1(0x10),p1(0x11),p1(0x12),p1(0x13),p1(0x14),p1(0x15),p1(0x16),p1(0x17) ;\
+	.long	p1(0x18),p1(0x19),p1(0x1a),p1(0x1b),p1(0x1c),p1(0x1d),p1(0x1e),p1(0x1f)
+#define im_data1(p1) \
+	.long	p1(0x20),p1(0x21),p1(0x22),p1(0x23),p1(0x24),p1(0x25),p1(0x26),p1(0x27) ;\
+	.long	p1(0x28),p1(0x29),p1(0x2a),p1(0x2b),p1(0x2c),p1(0x2d),p1(0x2e),p1(0x2f) ;\
+	.long	p1(0x30),p1(0x31),p1(0x32),p1(0x33),p1(0x34),p1(0x35),p1(0x36),p1(0x37) ;\
+	.long	p1(0x38),p1(0x39),p1(0x3a),p1(0x3b),p1(0x3c),p1(0x3d),p1(0x3e),p1(0x3f)
+#define im_data2(p1) \
+	.long	p1(0x40),p1(0x41),p1(0x42),p1(0x43),p1(0x44),p1(0x45),p1(0x46),p1(0x47) ;\
+	.long	p1(0x48),p1(0x49),p1(0x4a),p1(0x4b),p1(0x4c),p1(0x4d),p1(0x4e),p1(0x4f) ;\
+	.long	p1(0x50),p1(0x51),p1(0x52),p1(0x53),p1(0x54),p1(0x55),p1(0x56),p1(0x57) ;\
+	.long	p1(0x58),p1(0x59),p1(0x5a),p1(0x5b),p1(0x5c),p1(0x5d),p1(0x5e),p1(0x5f)
+#define im_data3(p1) \
+	.long	p1(0x60),p1(0x61),p1(0x62),p1(0x63),p1(0x64),p1(0x65),p1(0x66),p1(0x67) ;\
+	.long	p1(0x68),p1(0x69),p1(0x6a),p1(0x6b),p1(0x6c),p1(0x6d),p1(0x6e),p1(0x6f) ;\
+	.long	p1(0x70),p1(0x71),p1(0x72),p1(0x73),p1(0x74),p1(0x75),p1(0x76),p1(0x77) ;\
+	.long	p1(0x78),p1(0x79),p1(0x7a),p1(0x7b),p1(0x7c),p1(0x7d),p1(0x7e),p1(0x7f)
+#define im_data4(p1) \
+	.long	p1(0x80),p1(0x81),p1(0x82),p1(0x83),p1(0x84),p1(0x85),p1(0x86),p1(0x87) ;\
+	.long	p1(0x88),p1(0x89),p1(0x8a),p1(0x8b),p1(0x8c),p1(0x8d),p1(0x8e),p1(0x8f) ;\
+	.long	p1(0x90),p1(0x91),p1(0x92),p1(0x93),p1(0x94),p1(0x95),p1(0x96),p1(0x97) ;\
+	.long	p1(0x98),p1(0x99),p1(0x9a),p1(0x9b),p1(0x9c),p1(0x9d),p1(0x9e),p1(0x9f)
+#define im_data5(p1) \
+	.long	p1(0xa0),p1(0xa1),p1(0xa2),p1(0xa3),p1(0xa4),p1(0xa5),p1(0xa6),p1(0xa7) ;\
+	.long	p1(0xa8),p1(0xa9),p1(0xaa),p1(0xab),p1(0xac),p1(0xad),p1(0xae),p1(0xaf) ;\
+	.long	p1(0xb0),p1(0xb1),p1(0xb2),p1(0xb3),p1(0xb4),p1(0xb5),p1(0xb6),p1(0xb7) ;\
+	.long	p1(0xb8),p1(0xb9),p1(0xba),p1(0xbb),p1(0xbc),p1(0xbd),p1(0xbe),p1(0xbf)
+#define im_data6(p1) \
+	.long	p1(0xc0),p1(0xc1),p1(0xc2),p1(0xc3),p1(0xc4),p1(0xc5),p1(0xc6),p1(0xc7) ;\
+	.long	p1(0xc8),p1(0xc9),p1(0xca),p1(0xcb),p1(0xcc),p1(0xcd),p1(0xce),p1(0xcf) ;\
+	.long	p1(0xd0),p1(0xd1),p1(0xd2),p1(0xd3),p1(0xd4),p1(0xd5),p1(0xd6),p1(0xd7) ;\
+	.long	p1(0xd8),p1(0xd9),p1(0xda),p1(0xdb),p1(0xdc),p1(0xdd),p1(0xde),p1(0xdf)
+#define im_data7(p1) \
+	.long	p1(0xe0),p1(0xe1),p1(0xe2),p1(0xe3),p1(0xe4),p1(0xe5),p1(0xe6),p1(0xe7) ;\
+	.long	p1(0xe8),p1(0xe9),p1(0xea),p1(0xeb),p1(0xec),p1(0xed),p1(0xee),p1(0xef) ;\
+	.long	p1(0xf0),p1(0xf1),p1(0xf2),p1(0xf3),p1(0xf4),p1(0xf5),p1(0xf6),p1(0xf7) ;\
+	.long	p1(0xf8),p1(0xf9),p1(0xfa),p1(0xfb),p1(0xfc),p1(0xfd),p1(0xfe),p1(0xff)
+
+// S-box data - 256 entries
+
+#define sb_data0(p1) \
+	.long	p1(0x63),p1(0x7c),p1(0x77),p1(0x7b),p1(0xf2),p1(0x6b),p1(0x6f),p1(0xc5) ;\
+	.long	p1(0x30),p1(0x01),p1(0x67),p1(0x2b),p1(0xfe),p1(0xd7),p1(0xab),p1(0x76) ;\
+	.long	p1(0xca),p1(0x82),p1(0xc9),p1(0x7d),p1(0xfa),p1(0x59),p1(0x47),p1(0xf0) ;\
+	.long	p1(0xad),p1(0xd4),p1(0xa2),p1(0xaf),p1(0x9c),p1(0xa4),p1(0x72),p1(0xc0)
+#define sb_data1(p1) \
+	.long	p1(0xb7),p1(0xfd),p1(0x93),p1(0x26),p1(0x36),p1(0x3f),p1(0xf7),p1(0xcc) ;\
+	.long	p1(0x34),p1(0xa5),p1(0xe5),p1(0xf1),p1(0x71),p1(0xd8),p1(0x31),p1(0x15) ;\
+	.long	p1(0x04),p1(0xc7),p1(0x23),p1(0xc3),p1(0x18),p1(0x96),p1(0x05),p1(0x9a) ;\
+	.long	p1(0x07),p1(0x12),p1(0x80),p1(0xe2),p1(0xeb),p1(0x27),p1(0xb2),p1(0x75)
+#define sb_data2(p1) \
+	.long	p1(0x09),p1(0x83),p1(0x2c),p1(0x1a),p1(0x1b),p1(0x6e),p1(0x5a),p1(0xa0) ;\
+	.long	p1(0x52),p1(0x3b),p1(0xd6),p1(0xb3),p1(0x29),p1(0xe3),p1(0x2f),p1(0x84) ;\
+	.long	p1(0x53),p1(0xd1),p1(0x00),p1(0xed),p1(0x20),p1(0xfc),p1(0xb1),p1(0x5b) ;\
+	.long	p1(0x6a),p1(0xcb),p1(0xbe),p1(0x39),p1(0x4a),p1(0x4c),p1(0x58),p1(0xcf)
+#define sb_data3(p1) \
+	.long	p1(0xd0),p1(0xef),p1(0xaa),p1(0xfb),p1(0x43),p1(0x4d),p1(0x33),p1(0x85) ;\
+	.long	p1(0x45),p1(0xf9),p1(0x02),p1(0x7f),p1(0x50),p1(0x3c),p1(0x9f),p1(0xa8) ;\
+	.long	p1(0x51),p1(0xa3),p1(0x40),p1(0x8f),p1(0x92),p1(0x9d),p1(0x38),p1(0xf5) ;\
+	.long	p1(0xbc),p1(0xb6),p1(0xda),p1(0x21),p1(0x10),p1(0xff),p1(0xf3),p1(0xd2)
+#define sb_data4(p1) \
+	.long	p1(0xcd),p1(0x0c),p1(0x13),p1(0xec),p1(0x5f),p1(0x97),p1(0x44),p1(0x17) ;\
+	.long	p1(0xc4),p1(0xa7),p1(0x7e),p1(0x3d),p1(0x64),p1(0x5d),p1(0x19),p1(0x73) ;\
+	.long	p1(0x60),p1(0x81),p1(0x4f),p1(0xdc),p1(0x22),p1(0x2a),p1(0x90),p1(0x88) ;\
+	.long	p1(0x46),p1(0xee),p1(0xb8),p1(0x14),p1(0xde),p1(0x5e),p1(0x0b),p1(0xdb)
+#define sb_data5(p1) \
+	.long	p1(0xe0),p1(0x32),p1(0x3a),p1(0x0a),p1(0x49),p1(0x06),p1(0x24),p1(0x5c) ;\
+	.long	p1(0xc2),p1(0xd3),p1(0xac),p1(0x62),p1(0x91),p1(0x95),p1(0xe4),p1(0x79) ;\
+	.long	p1(0xe7),p1(0xc8),p1(0x37),p1(0x6d),p1(0x8d),p1(0xd5),p1(0x4e),p1(0xa9) ;\
+	.long	p1(0x6c),p1(0x56),p1(0xf4),p1(0xea),p1(0x65),p1(0x7a),p1(0xae),p1(0x08)
+#define sb_data6(p1) \
+	.long	p1(0xba),p1(0x78),p1(0x25),p1(0x2e),p1(0x1c),p1(0xa6),p1(0xb4),p1(0xc6) ;\
+	.long	p1(0xe8),p1(0xdd),p1(0x74),p1(0x1f),p1(0x4b),p1(0xbd),p1(0x8b),p1(0x8a) ;\
+	.long	p1(0x70),p1(0x3e),p1(0xb5),p1(0x66),p1(0x48),p1(0x03),p1(0xf6),p1(0x0e) ;\
+	.long	p1(0x61),p1(0x35),p1(0x57),p1(0xb9),p1(0x86),p1(0xc1),p1(0x1d),p1(0x9e)
+#define sb_data7(p1) \
+	.long	p1(0xe1),p1(0xf8),p1(0x98),p1(0x11),p1(0x69),p1(0xd9),p1(0x8e),p1(0x94) ;\
+	.long	p1(0x9b),p1(0x1e),p1(0x87),p1(0xe9),p1(0xce),p1(0x55),p1(0x28),p1(0xdf) ;\
+	.long	p1(0x8c),p1(0xa1),p1(0x89),p1(0x0d),p1(0xbf),p1(0xe6),p1(0x42),p1(0x68) ;\
+	.long	p1(0x41),p1(0x99),p1(0x2d),p1(0x0f),p1(0xb0),p1(0x54),p1(0xbb),p1(0x16)
+
+// Inverse S-box data - 256 entries
+
+#define ib_data0(p1) \
+	.long	p1(0x52),p1(0x09),p1(0x6a),p1(0xd5),p1(0x30),p1(0x36),p1(0xa5),p1(0x38) ;\
+	.long	p1(0xbf),p1(0x40),p1(0xa3),p1(0x9e),p1(0x81),p1(0xf3),p1(0xd7),p1(0xfb) ;\
+	.long	p1(0x7c),p1(0xe3),p1(0x39),p1(0x82),p1(0x9b),p1(0x2f),p1(0xff),p1(0x87) ;\
+	.long	p1(0x34),p1(0x8e),p1(0x43),p1(0x44),p1(0xc4),p1(0xde),p1(0xe9),p1(0xcb)
+#define ib_data1(p1) \
+	.long	p1(0x54),p1(0x7b),p1(0x94),p1(0x32),p1(0xa6),p1(0xc2),p1(0x23),p1(0x3d) ;\
+	.long	p1(0xee),p1(0x4c),p1(0x95),p1(0x0b),p1(0x42),p1(0xfa),p1(0xc3),p1(0x4e) ;\
+	.long	p1(0x08),p1(0x2e),p1(0xa1),p1(0x66),p1(0x28),p1(0xd9),p1(0x24),p1(0xb2) ;\
+	.long	p1(0x76),p1(0x5b),p1(0xa2),p1(0x49),p1(0x6d),p1(0x8b),p1(0xd1),p1(0x25)
+#define ib_data2(p1) \
+	.long	p1(0x72),p1(0xf8),p1(0xf6),p1(0x64),p1(0x86),p1(0x68),p1(0x98),p1(0x16) ;\
+	.long	p1(0xd4),p1(0xa4),p1(0x5c),p1(0xcc),p1(0x5d),p1(0x65),p1(0xb6),p1(0x92) ;\
+	.long	p1(0x6c),p1(0x70),p1(0x48),p1(0x50),p1(0xfd),p1(0xed),p1(0xb9),p1(0xda) ;\
+	.long	p1(0x5e),p1(0x15),p1(0x46),p1(0x57),p1(0xa7),p1(0x8d),p1(0x9d),p1(0x84)
+#define ib_data3(p1) \
+	.long	p1(0x90),p1(0xd8),p1(0xab),p1(0x00),p1(0x8c),p1(0xbc),p1(0xd3),p1(0x0a) ;\
+	.long	p1(0xf7),p1(0xe4),p1(0x58),p1(0x05),p1(0xb8),p1(0xb3),p1(0x45),p1(0x06) ;\
+	.long	p1(0xd0),p1(0x2c),p1(0x1e),p1(0x8f),p1(0xca),p1(0x3f),p1(0x0f),p1(0x02) ;\
+	.long	p1(0xc1),p1(0xaf),p1(0xbd),p1(0x03),p1(0x01),p1(0x13),p1(0x8a),p1(0x6b)
+#define ib_data4(p1) \
+	.long	p1(0x3a),p1(0x91),p1(0x11),p1(0x41),p1(0x4f),p1(0x67),p1(0xdc),p1(0xea) ;\
+	.long	p1(0x97),p1(0xf2),p1(0xcf),p1(0xce),p1(0xf0),p1(0xb4),p1(0xe6),p1(0x73) ;\
+	.long	p1(0x96),p1(0xac),p1(0x74),p1(0x22),p1(0xe7),p1(0xad),p1(0x35),p1(0x85) ;\
+	.long	p1(0xe2),p1(0xf9),p1(0x37),p1(0xe8),p1(0x1c),p1(0x75),p1(0xdf),p1(0x6e)
+#define ib_data5(p1) \
+	.long	p1(0x47),p1(0xf1),p1(0x1a),p1(0x71),p1(0x1d),p1(0x29),p1(0xc5),p1(0x89) ;\
+	.long	p1(0x6f),p1(0xb7),p1(0x62),p1(0x0e),p1(0xaa),p1(0x18),p1(0xbe),p1(0x1b) ;\
+	.long	p1(0xfc),p1(0x56),p1(0x3e),p1(0x4b),p1(0xc6),p1(0xd2),p1(0x79),p1(0x20) ;\
+	.long	p1(0x9a),p1(0xdb),p1(0xc0),p1(0xfe),p1(0x78),p1(0xcd),p1(0x5a),p1(0xf4)
+#define ib_data6(p1) \
+	.long	p1(0x1f),p1(0xdd),p1(0xa8),p1(0x33),p1(0x88),p1(0x07),p1(0xc7),p1(0x31) ;\
+	.long	p1(0xb1),p1(0x12),p1(0x10),p1(0x59),p1(0x27),p1(0x80),p1(0xec),p1(0x5f) ;\
+	.long	p1(0x60),p1(0x51),p1(0x7f),p1(0xa9),p1(0x19),p1(0xb5),p1(0x4a),p1(0x0d) ;\
+	.long	p1(0x2d),p1(0xe5),p1(0x7a),p1(0x9f),p1(0x93),p1(0xc9),p1(0x9c),p1(0xef)
+#define ib_data7(p1) \
+	.long	p1(0xa0),p1(0xe0),p1(0x3b),p1(0x4d),p1(0xae),p1(0x2a),p1(0xf5),p1(0xb0) ;\
+	.long	p1(0xc8),p1(0xeb),p1(0xbb),p1(0x3c),p1(0x83),p1(0x53),p1(0x99),p1(0x61) ;\
+	.long	p1(0x17),p1(0x2b),p1(0x04),p1(0x7e),p1(0xba),p1(0x77),p1(0xd6),p1(0x26) ;\
+	.long	p1(0xe1),p1(0x69),p1(0x14),p1(0x63),p1(0x55),p1(0x21),p1(0x0c),p1(0x7d)
+
+// The rcon_table (needed for the key schedule)
+//
+// Here is original Dr Brian Gladman's source code:
+//	_rcon_tab:
+//	%assign x   1
+//	%rep 29
+//	    dd  x
+//	%assign x f2(x)
+//	%endrep
+//
+// Here is precomputed output (it's more portable this way):
+
+	.align	ALIGN32BYTES
+aes_rcon_tab:
+	.long	0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80
+	.long	0x1b,0x36,0x6c,0xd8,0xab,0x4d,0x9a,0x2f
+	.long	0x5e,0xbc,0x63,0xc6,0x97,0x35,0x6a,0xd4
+	.long	0xb3,0x7d,0xfa,0xef,0xc5
+
+// The forward xor tables
+
+	.align	ALIGN32BYTES
+aes_ft_tab:
+	sb_data0(u0)
+	sb_data1(u0)
+	sb_data2(u0)
+	sb_data3(u0)
+	sb_data4(u0)
+	sb_data5(u0)
+	sb_data6(u0)
+	sb_data7(u0)
+
+	sb_data0(u1)
+	sb_data1(u1)
+	sb_data2(u1)
+	sb_data3(u1)
+	sb_data4(u1)
+	sb_data5(u1)
+	sb_data6(u1)
+	sb_data7(u1)
+
+	sb_data0(u2)
+	sb_data1(u2)
+	sb_data2(u2)
+	sb_data3(u2)
+	sb_data4(u2)
+	sb_data5(u2)
+	sb_data6(u2)
+	sb_data7(u2)
+
+	sb_data0(u3)
+	sb_data1(u3)
+	sb_data2(u3)
+	sb_data3(u3)
+	sb_data4(u3)
+	sb_data5(u3)
+	sb_data6(u3)
+	sb_data7(u3)
+
+	.align	ALIGN32BYTES
+aes_fl_tab:
+	sb_data0(w0)
+	sb_data1(w0)
+	sb_data2(w0)
+	sb_data3(w0)
+	sb_data4(w0)
+	sb_data5(w0)
+	sb_data6(w0)
+	sb_data7(w0)
+
+	sb_data0(w1)
+	sb_data1(w1)
+	sb_data2(w1)
+	sb_data3(w1)
+	sb_data4(w1)
+	sb_data5(w1)
+	sb_data6(w1)
+	sb_data7(w1)
+
+	sb_data0(w2)
+	sb_data1(w2)
+	sb_data2(w2)
+	sb_data3(w2)
+	sb_data4(w2)
+	sb_data5(w2)
+	sb_data6(w2)
+	sb_data7(w2)
+
+	sb_data0(w3)
+	sb_data1(w3)
+	sb_data2(w3)
+	sb_data3(w3)
+	sb_data4(w3)
+	sb_data5(w3)
+	sb_data6(w3)
+	sb_data7(w3)
+
+// The inverse xor tables
+
+	.align	ALIGN32BYTES
+aes_it_tab:
+	ib_data0(v0)
+	ib_data1(v0)
+	ib_data2(v0)
+	ib_data3(v0)
+	ib_data4(v0)
+	ib_data5(v0)
+	ib_data6(v0)
+	ib_data7(v0)
+
+	ib_data0(v1)
+	ib_data1(v1)
+	ib_data2(v1)
+	ib_data3(v1)
+	ib_data4(v1)
+	ib_data5(v1)
+	ib_data6(v1)
+	ib_data7(v1)
+
+	ib_data0(v2)
+	ib_data1(v2)
+	ib_data2(v2)
+	ib_data3(v2)
+	ib_data4(v2)
+	ib_data5(v2)
+	ib_data6(v2)
+	ib_data7(v2)
+
+	ib_data0(v3)
+	ib_data1(v3)
+	ib_data2(v3)
+	ib_data3(v3)
+	ib_data4(v3)
+	ib_data5(v3)
+	ib_data6(v3)
+	ib_data7(v3)
+
+	.align	ALIGN32BYTES
+aes_il_tab:
+	ib_data0(w0)
+	ib_data1(w0)
+	ib_data2(w0)
+	ib_data3(w0)
+	ib_data4(w0)
+	ib_data5(w0)
+	ib_data6(w0)
+	ib_data7(w0)
+
+	ib_data0(w1)
+	ib_data1(w1)
+	ib_data2(w1)
+	ib_data3(w1)
+	ib_data4(w1)
+	ib_data5(w1)
+	ib_data6(w1)
+	ib_data7(w1)
+
+	ib_data0(w2)
+	ib_data1(w2)
+	ib_data2(w2)
+	ib_data3(w2)
+	ib_data4(w2)
+	ib_data5(w2)
+	ib_data6(w2)
+	ib_data7(w2)
+
+	ib_data0(w3)
+	ib_data1(w3)
+	ib_data2(w3)
+	ib_data3(w3)
+	ib_data4(w3)
+	ib_data5(w3)
+	ib_data6(w3)
+	ib_data7(w3)
+
+// The inverse mix column tables
+
+	.align	ALIGN32BYTES
+aes_im_tab:
+	im_data0(v0)
+	im_data1(v0)
+	im_data2(v0)
+	im_data3(v0)
+	im_data4(v0)
+	im_data5(v0)
+	im_data6(v0)
+	im_data7(v0)
+
+	im_data0(v1)
+	im_data1(v1)
+	im_data2(v1)
+	im_data3(v1)
+	im_data4(v1)
+	im_data5(v1)
+	im_data6(v1)
+	im_data7(v1)
+
+	im_data0(v2)
+	im_data1(v2)
+	im_data2(v2)
+	im_data3(v2)
+	im_data4(v2)
+	im_data5(v2)
+	im_data6(v2)
+	im_data7(v2)
+
+	im_data0(v3)
+	im_data1(v3)
+	im_data2(v3)
+	im_data3(v3)
+	im_data4(v3)
+	im_data5(v3)
+	im_data6(v3)
+	im_data7(v3)
diff -urN linux-2.6.8-rc2/arch/i386/crypto/aes-i586-glue.c linux-2.6.8-rc3/arch/i386/crypto/aes-i586-glue.c
--- linux-2.6.8-rc2/arch/i386/crypto/aes-i586-glue.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/i386/crypto/aes-i586-glue.c	2004-08-03 15:21:32.036534177 -0700
@@ -0,0 +1,105 @@
+/* 
+ * 
+ * Glue Code for optimized 586 assembler version of AES
+ *
+ * Copyright (c) 2001, Dr Brian Gladman <brg@gladman.uk.net>, Worcester, UK.
+ * Copyright (c) 2003, Adam J. Richter <adam@yggdrasil.com> (conversion to
+ * 2.5 API).
+ * Copyright (c) 2003, 2004 Fruhwirth Clemens <clemens@endorphin.org>
+*/
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/crypto.h>
+#include <linux/linkage.h>
+
+#define AES_MIN_KEY_SIZE	16
+#define AES_MAX_KEY_SIZE	32
+#define AES_BLOCK_SIZE		16
+#define AES_KS_LENGTH   4 * AES_BLOCK_SIZE
+#define AES_RC_LENGTH   (9 * AES_BLOCK_SIZE) / 8 - 8
+
+typedef struct
+{
+    u_int32_t	 aes_Nkey;	// the number of words in the key input block
+    u_int32_t	 aes_Nrnd;	// the number of cipher rounds
+    u_int32_t	 aes_e_key[AES_KS_LENGTH];   // the encryption key schedule
+    u_int32_t	 aes_d_key[AES_KS_LENGTH];   // the decryption key schedule
+    u_int32_t	 aes_Ncol;	// the number of columns in the cipher state
+} aes_context;
+
+/*
+ * The Cipher Interface
+ */
+ 
+asmlinkage void aes_set_key(void *, const unsigned char [], const int, const int);
+
+
+
+/* Actually:
+ * extern void aes_encrypt(const aes_context *, unsigned char [], const unsigned char []);
+ * extern void aes_decrypt(const aes_context *, unsigned char [], const unsigned char []);
+*/
+ 
+asmlinkage void aes_encrypt(void*, unsigned char [], const unsigned char []);
+asmlinkage void aes_decrypt(void*, unsigned char [], const unsigned char []);
+
+static int aes_set_key_glue(void *cx, const u8 *key,unsigned int key_length, u32 *flags)
+{
+	if(key_length != 16 && key_length != 24 && key_length != 32)
+	{
+ 		*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
+		return -EINVAL;
+	}
+	aes_set_key(cx, key,key_length,0);
+	return 0;
+}
+
+#ifdef CONFIG_REGPARM
+static void aes_encrypt_glue(void* a, unsigned char b[], const unsigned char c[]) {
+	aes_encrypt(a,b,c);
+}
+static void aes_decrypt_glue(void* a, unsigned char b[], const unsigned char c[]) {
+	aes_decrypt(a,b,c);
+}
+#else
+#define aes_encrypt_glue aes_encrypt
+#define aes_decrypt_glue aes_decrypt
+#endif /* CONFIG_REGPARM */
+
+static struct crypto_alg aes_alg = {
+	.cra_name		=	"aes",
+	.cra_flags		=	CRYPTO_ALG_TYPE_CIPHER,
+	.cra_blocksize		=	AES_BLOCK_SIZE,
+	.cra_ctxsize		=	sizeof(aes_context),
+	.cra_module		=	THIS_MODULE,
+	.cra_list		=	LIST_HEAD_INIT(aes_alg.cra_list),
+	.cra_u			=	{
+		.cipher = {
+			.cia_min_keysize	=	AES_MIN_KEY_SIZE,
+			.cia_max_keysize	=	AES_MAX_KEY_SIZE,
+			.cia_setkey	   	= 	aes_set_key_glue,
+			.cia_encrypt	 	=	aes_encrypt_glue,
+			.cia_decrypt	  	=	aes_decrypt_glue
+		}
+	}
+};
+
+static int __init aes_init(void)
+{
+	return crypto_register_alg(&aes_alg);
+}
+
+static void __exit aes_fini(void)
+{
+	crypto_unregister_alg(&aes_alg);
+}
+
+module_init(aes_init);
+module_exit(aes_fini);
+
+MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm, i586 asm optimized");
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Fruhwirth Clemens");
+MODULE_ALIAS("aes");
diff -urN linux-2.6.8-rc2/arch/i386/kernel/cpu/mtrr/if.c linux-2.6.8-rc3/arch/i386/kernel/cpu/mtrr/if.c
--- linux-2.6.8-rc2/arch/i386/kernel/cpu/mtrr/if.c	2004-06-15 22:19:02.000000000 -0700
+++ linux-2.6.8-rc3/arch/i386/kernel/cpu/mtrr/if.c	2004-08-03 15:21:32.044534505 -0700
@@ -160,7 +160,7 @@
 
 	switch (cmd) {
 	default:
-		return -ENOIOCTLCMD;
+		return -ENOTTY;
 	case MTRRIOC_ADD_ENTRY:
 		if (!capable(CAP_SYS_ADMIN))
 			return -EPERM;
diff -urN linux-2.6.8-rc2/arch/i386/kernel/io_apic.c linux-2.6.8-rc3/arch/i386/kernel/io_apic.c
--- linux-2.6.8-rc2/arch/i386/kernel/io_apic.c	2004-08-03 15:21:05.083428748 -0700
+++ linux-2.6.8-rc3/arch/i386/kernel/io_apic.c	2004-08-03 15:21:32.052534833 -0700
@@ -73,7 +73,7 @@
 } irq_2_pin[PIN_MAP_SIZE];
 
 int vector_irq[NR_VECTORS] = { [0 ... NR_VECTORS - 1] = -1};
-#ifdef CONFIG_PCI_USE_VECTOR
+#ifdef CONFIG_PCI_MSI
 #define vector_to_irq(vector) 	\
 	(platform_legacy_irq(vector) ? vector : vector_irq[vector])
 #else
@@ -1114,7 +1114,7 @@
 /* irq_vectors is indexed by the sum of all RTEs in all I/O APICs. */
 u8 irq_vector[NR_IRQ_VECTORS] = { FIRST_DEVICE_VECTOR , 0 };
 
-#ifdef CONFIG_PCI_USE_VECTOR
+#ifdef CONFIG_PCI_MSI
 int assign_irq_vector(int irq)
 #else
 int __init assign_irq_vector(int irq)
@@ -1868,7 +1868,7 @@
 	}
 }
 
-#ifdef CONFIG_PCI_USE_VECTOR
+#ifdef CONFIG_PCI_MSI
 static unsigned int startup_edge_ioapic_vector(unsigned int vector)
 {
 	int irq = vector_to_irq(vector);
@@ -2212,7 +2212,7 @@
 		return;
 	}
 	printk(" failed :(.\n");
-	panic("IO-APIC + timer doesn't work! pester mingo@redhat.com");
+	panic("IO-APIC + timer doesn't work! Try using the 'noapic' kernel parameter\n");
 }
 
 /*
diff -urN linux-2.6.8-rc2/arch/i386/kernel/sys_i386.c linux-2.6.8-rc3/arch/i386/kernel/sys_i386.c
--- linux-2.6.8-rc2/arch/i386/kernel/sys_i386.c	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/arch/i386/kernel/sys_i386.c	2004-08-03 15:21:32.088536310 -0700
@@ -149,7 +149,7 @@
 		union semun fourth;
 		if (!ptr)
 			return -EINVAL;
-		if (get_user(fourth.__pad, (void * __user *) ptr))
+		if (get_user(fourth.__pad, (void __user * __user *) ptr))
 			return -EFAULT;
 		return sys_semctl (first, second, third, fourth);
 	}
diff -urN linux-2.6.8-rc2/arch/i386/pci/irq.c linux-2.6.8-rc3/arch/i386/pci/irq.c
--- linux-2.6.8-rc2/arch/i386/pci/irq.c	2004-08-03 15:21:05.141431124 -0700
+++ linux-2.6.8-rc3/arch/i386/pci/irq.c	2004-08-03 15:21:32.200540905 -0700
@@ -817,7 +817,7 @@
 		    	if ( dev2->irq && dev2->irq != irq && \
 			(!(pci_probe & PCI_USE_PIRQ_MASK) || \
 			((1 << dev2->irq) & mask)) ) {
-#ifndef CONFIG_PCI_USE_VECTOR
+#ifndef CONFIG_PCI_MSI
 		    		printk(KERN_INFO "IRQ routing conflict for %s, have irq %d, want irq %d\n",
 				       pci_name(dev2), dev2->irq, irq);
 #endif
@@ -1034,7 +1034,7 @@
 				}
 				dev = temp_dev;
 				if (irq >= 0) {
-#ifdef CONFIG_PCI_USE_VECTOR
+#ifdef CONFIG_PCI_MSI
 					if (!platform_legacy_irq(irq))
 						irq = IO_APIC_VECTOR(irq);
 #endif
diff -urN linux-2.6.8-rc2/arch/ia64/configs/sn2_defconfig linux-2.6.8-rc3/arch/ia64/configs/sn2_defconfig
--- linux-2.6.8-rc2/arch/ia64/configs/sn2_defconfig	2004-08-03 15:21:05.154431657 -0700
+++ linux-2.6.8-rc3/arch/ia64/configs/sn2_defconfig	2004-08-03 15:21:32.205541110 -0700
@@ -24,6 +24,7 @@
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
+# CONFIG_KALLSYMS_EXTRA_PASS is not set
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_IOSCHED_NOOP=y
@@ -85,6 +86,7 @@
 # Firmware Drivers
 #
 CONFIG_EFI_VARS=y
+# CONFIG_EFI_PCDP is not set
 CONFIG_BINFMT_ELF=y
 # CONFIG_BINFMT_MISC is not set
 
@@ -271,7 +273,6 @@
 # CONFIG_SCSI_AIC7XXX is not set
 # CONFIG_SCSI_AIC7XXX_OLD is not set
 # CONFIG_SCSI_AIC79XX is not set
-# CONFIG_SCSI_ADVANSYS is not set
 # CONFIG_SCSI_MEGARAID is not set
 CONFIG_SCSI_SATA=y
 # CONFIG_SCSI_SATA_SVW is not set
@@ -527,8 +528,6 @@
 # CONFIG_SYNCLINKMP is not set
 # CONFIG_N_HDLC is not set
 # CONFIG_STALDRV is not set
-CONFIG_SGI_L1_SERIAL=y
-CONFIG_SGI_L1_SERIAL_CONSOLE=y
 
 #
 # Serial drivers
@@ -538,6 +537,8 @@
 #
 # Non-8250 serial port support
 #
+CONFIG_SERIAL_CORE=y
+CONFIG_SERIAL_SGI_L1_CONSOLE=y
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
@@ -573,6 +574,11 @@
 # CONFIG_I2C is not set
 
 #
+# Dallas's 1-wire bus
+#
+# CONFIG_W1 is not set
+
+#
 # Misc devices
 #
 
@@ -751,6 +757,7 @@
 CONFIG_JOLIET=y
 # CONFIG_ZISOFS is not set
 CONFIG_UDF_FS=m
+CONFIG_UDF_NLS=y
 
 #
 # DOS/FAT/NT Filesystems
@@ -785,6 +792,7 @@
 # CONFIG_BEFS_FS is not set
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
+# CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_HPFS_FS is not set
@@ -885,6 +893,7 @@
 #
 # Library routines
 #
+# CONFIG_CRC_CCITT is not set
 CONFIG_CRC32=y
 # CONFIG_LIBCRC32C is not set
 CONFIG_ZLIB_INFLATE=m
@@ -935,6 +944,7 @@
 # CONFIG_CRYPTO_AES is not set
 # CONFIG_CRYPTO_CAST5 is not set
 # CONFIG_CRYPTO_CAST6 is not set
+# CONFIG_CRYPTO_TEA is not set
 # CONFIG_CRYPTO_ARC4 is not set
 CONFIG_CRYPTO_DEFLATE=m
 # CONFIG_CRYPTO_MICHAEL_MIC is not set
diff -urN linux-2.6.8-rc2/arch/ia64/defconfig linux-2.6.8-rc3/arch/ia64/defconfig
--- linux-2.6.8-rc2/arch/ia64/defconfig	2004-08-03 15:21:05.155431698 -0700
+++ linux-2.6.8-rc3/arch/ia64/defconfig	2004-08-03 15:21:32.253543079 -0700
@@ -18,6 +18,7 @@
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_BSD_PROCESS_ACCT=y
+# CONFIG_BSD_PROCESS_ACCT_V3 is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
 CONFIG_LOG_BUF_SHIFT=16
@@ -27,6 +28,7 @@
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
+# CONFIG_KALLSYMS_EXTRA_PASS is not set
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_IOSCHED_NOOP=y
@@ -86,6 +88,7 @@
 # Firmware Drivers
 #
 CONFIG_EFI_VARS=y
+CONFIG_EFI_PCDP=y
 CONFIG_BINFMT_ELF=y
 CONFIG_BINFMT_MISC=y
 
@@ -136,6 +139,7 @@
 #
 # Generic Driver Options
 #
+CONFIG_PREVENT_FIRMWARE_BUILD=y
 # CONFIG_FW_LOADER is not set
 # CONFIG_DEBUG_DRIVER is not set
 
@@ -163,7 +167,7 @@
 CONFIG_BLK_DEV_LOOP=y
 # CONFIG_BLK_DEV_CRYPTOLOOP is not set
 # CONFIG_BLK_DEV_NBD is not set
-# CONFIG_BLK_DEV_CARMEL is not set
+# CONFIG_BLK_DEV_SX8 is not set
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=4096
 CONFIG_BLK_DEV_INITRD=y
@@ -177,6 +181,7 @@
 #
 # Please see Documentation/ide.txt for help/info on IDE drives
 #
+# CONFIG_BLK_DEV_IDE_SATA is not set
 CONFIG_BLK_DEV_IDEDISK=y
 CONFIG_IDEDISK_MULTI_MODE=y
 CONFIG_BLK_DEV_IDECD=y
@@ -259,6 +264,7 @@
 # SCSI low-level drivers
 #
 # CONFIG_BLK_DEV_3W_XXXX_RAID is not set
+# CONFIG_SCSI_3W_9XXX is not set
 # CONFIG_SCSI_ACARD is not set
 # CONFIG_SCSI_AACRAID is not set
 # CONFIG_SCSI_AIC7XXX is not set
@@ -312,6 +318,9 @@
 CONFIG_MD_MULTIPATH=m
 CONFIG_BLK_DEV_DM=m
 # CONFIG_DM_CRYPT is not set
+# CONFIG_DM_SNAPSHOT is not set
+# CONFIG_DM_MIRROR is not set
+# CONFIG_DM_ZERO is not set
 
 #
 # Fusion MPT device support
@@ -400,6 +409,7 @@
 # QoS and/or fair queueing
 #
 # CONFIG_NET_SCHED is not set
+# CONFIG_NET_CLS_ROUTE is not set
 
 #
 # Network testing
@@ -454,6 +464,7 @@
 # CONFIG_EPIC100 is not set
 # CONFIG_SUNDANCE is not set
 # CONFIG_VIA_RHINE is not set
+# CONFIG_VIA_VELOCITY is not set
 
 #
 # Ethernet (1000 Mbit)
@@ -557,7 +568,6 @@
 #
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
-CONFIG_SERIAL_8250_HCDP=y
 CONFIG_SERIAL_8250_ACPI=y
 CONFIG_SERIAL_8250_NR_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
@@ -606,6 +616,7 @@
 # CONFIG_DRM_MGA is not set
 # CONFIG_DRM_SIS is not set
 # CONFIG_RAW_DRIVER is not set
+# CONFIG_HPET is not set
 
 #
 # I2C support
@@ -647,12 +658,15 @@
 #
 # CONFIG_I2C_SENSOR is not set
 # CONFIG_SENSORS_ADM1021 is not set
+# CONFIG_SENSORS_ADM1025 is not set
+# CONFIG_SENSORS_ADM1031 is not set
 # CONFIG_SENSORS_ASB100 is not set
 # CONFIG_SENSORS_DS1621 is not set
 # CONFIG_SENSORS_FSCHER is not set
 # CONFIG_SENSORS_GL518SM is not set
 # CONFIG_SENSORS_IT87 is not set
 # CONFIG_SENSORS_LM75 is not set
+# CONFIG_SENSORS_LM77 is not set
 # CONFIG_SENSORS_LM78 is not set
 # CONFIG_SENSORS_LM80 is not set
 # CONFIG_SENSORS_LM83 is not set
@@ -677,6 +691,11 @@
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# Dallas's 1-wire bus
+#
+# CONFIG_W1 is not set
+
+#
 # Misc devices
 #
 
@@ -700,6 +719,7 @@
 # CONFIG_FB_ASILIANT is not set
 # CONFIG_FB_IMSTT is not set
 CONFIG_FB_RIVA=m
+CONFIG_FB_RIVA_I2C=y
 # CONFIG_FB_MATROX is not set
 # CONFIG_FB_RADEON_OLD is not set
 CONFIG_FB_RADEON=m
@@ -723,7 +743,6 @@
 # CONFIG_MDA_CONSOLE is not set
 CONFIG_DUMMY_CONSOLE=y
 CONFIG_FRAMEBUFFER_CONSOLE=y
-CONFIG_PCI_CONSOLE=y
 # CONFIG_FONTS is not set
 CONFIG_FONT_8x8=y
 CONFIG_FONT_8x16=y
@@ -950,6 +969,7 @@
 CONFIG_JOLIET=y
 # CONFIG_ZISOFS is not set
 CONFIG_UDF_FS=y
+CONFIG_UDF_NLS=y
 
 #
 # DOS/FAT/NT Filesystems
@@ -957,6 +977,8 @@
 CONFIG_FAT_FS=y
 CONFIG_MSDOS_FS=y
 CONFIG_VFAT_FS=y
+CONFIG_FAT_DEFAULT_CODEPAGE=437
+CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
 # CONFIG_NTFS_FS is not set
 
 #
@@ -982,6 +1004,7 @@
 # CONFIG_BEFS_FS is not set
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
+# CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_HPFS_FS is not set
@@ -999,7 +1022,7 @@
 CONFIG_NFSD=y
 CONFIG_NFSD_V3=y
 # CONFIG_NFSD_V4 is not set
-CONFIG_NFSD_TCP=y
+# CONFIG_NFSD_TCP is not set
 CONFIG_LOCKD=y
 CONFIG_LOCKD_V4=y
 CONFIG_EXPORTFS=y
@@ -1027,7 +1050,6 @@
 # CONFIG_SOLARIS_X86_PARTITION is not set
 # CONFIG_UNIXWARE_DISKLABEL is not set
 # CONFIG_LDM_PARTITION is not set
-# CONFIG_NEC98_PARTITION is not set
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
@@ -1039,46 +1061,48 @@
 CONFIG_NLS=y
 CONFIG_NLS_DEFAULT="iso8859-1"
 CONFIG_NLS_CODEPAGE_437=y
-CONFIG_NLS_CODEPAGE_737=y
-CONFIG_NLS_CODEPAGE_775=y
-CONFIG_NLS_CODEPAGE_850=y
-CONFIG_NLS_CODEPAGE_852=y
-CONFIG_NLS_CODEPAGE_855=y
-CONFIG_NLS_CODEPAGE_857=y
-CONFIG_NLS_CODEPAGE_860=y
-CONFIG_NLS_CODEPAGE_861=y
-CONFIG_NLS_CODEPAGE_862=y
-CONFIG_NLS_CODEPAGE_863=y
-CONFIG_NLS_CODEPAGE_864=y
-CONFIG_NLS_CODEPAGE_865=y
-CONFIG_NLS_CODEPAGE_866=y
-CONFIG_NLS_CODEPAGE_869=y
-CONFIG_NLS_CODEPAGE_936=y
-CONFIG_NLS_CODEPAGE_950=y
-CONFIG_NLS_CODEPAGE_932=y
-CONFIG_NLS_CODEPAGE_949=y
-CONFIG_NLS_CODEPAGE_874=y
-CONFIG_NLS_ISO8859_8=y
+# CONFIG_NLS_CODEPAGE_737 is not set
+# CONFIG_NLS_CODEPAGE_775 is not set
+# CONFIG_NLS_CODEPAGE_850 is not set
+# CONFIG_NLS_CODEPAGE_852 is not set
+# CONFIG_NLS_CODEPAGE_855 is not set
+# CONFIG_NLS_CODEPAGE_857 is not set
+# CONFIG_NLS_CODEPAGE_860 is not set
+# CONFIG_NLS_CODEPAGE_861 is not set
+# CONFIG_NLS_CODEPAGE_862 is not set
+# CONFIG_NLS_CODEPAGE_863 is not set
+# CONFIG_NLS_CODEPAGE_864 is not set
+# CONFIG_NLS_CODEPAGE_865 is not set
+# CONFIG_NLS_CODEPAGE_866 is not set
+# CONFIG_NLS_CODEPAGE_869 is not set
+# CONFIG_NLS_CODEPAGE_936 is not set
+# CONFIG_NLS_CODEPAGE_950 is not set
+# CONFIG_NLS_CODEPAGE_932 is not set
+# CONFIG_NLS_CODEPAGE_949 is not set
+# CONFIG_NLS_CODEPAGE_874 is not set
+# CONFIG_NLS_ISO8859_8 is not set
 # CONFIG_NLS_CODEPAGE_1250 is not set
-CONFIG_NLS_CODEPAGE_1251=y
+# CONFIG_NLS_CODEPAGE_1251 is not set
+CONFIG_NLS_ASCII=y
 CONFIG_NLS_ISO8859_1=y
-CONFIG_NLS_ISO8859_2=y
-CONFIG_NLS_ISO8859_3=y
-CONFIG_NLS_ISO8859_4=y
-CONFIG_NLS_ISO8859_5=y
-CONFIG_NLS_ISO8859_6=y
-CONFIG_NLS_ISO8859_7=y
-CONFIG_NLS_ISO8859_9=y
-CONFIG_NLS_ISO8859_13=y
-CONFIG_NLS_ISO8859_14=y
-CONFIG_NLS_ISO8859_15=y
-CONFIG_NLS_KOI8_R=y
-CONFIG_NLS_KOI8_U=y
-CONFIG_NLS_UTF8=y
+# CONFIG_NLS_ISO8859_2 is not set
+# CONFIG_NLS_ISO8859_3 is not set
+# CONFIG_NLS_ISO8859_4 is not set
+# CONFIG_NLS_ISO8859_5 is not set
+# CONFIG_NLS_ISO8859_6 is not set
+# CONFIG_NLS_ISO8859_7 is not set
+# CONFIG_NLS_ISO8859_9 is not set
+# CONFIG_NLS_ISO8859_13 is not set
+# CONFIG_NLS_ISO8859_14 is not set
+# CONFIG_NLS_ISO8859_15 is not set
+# CONFIG_NLS_KOI8_R is not set
+# CONFIG_NLS_KOI8_U is not set
+# CONFIG_NLS_UTF8 is not set
 
 #
 # Library routines
 #
+# CONFIG_CRC_CCITT is not set
 CONFIG_CRC32=y
 # CONFIG_LIBCRC32C is not set
 
@@ -1128,6 +1152,7 @@
 # CONFIG_CRYPTO_AES is not set
 # CONFIG_CRYPTO_CAST5 is not set
 # CONFIG_CRYPTO_CAST6 is not set
+# CONFIG_CRYPTO_TEA is not set
 # CONFIG_CRYPTO_ARC4 is not set
 # CONFIG_CRYPTO_DEFLATE is not set
 # CONFIG_CRYPTO_MICHAEL_MIC is not set
diff -urN linux-2.6.8-rc2/arch/ia64/hp/sim/hpsim_irq.c linux-2.6.8-rc3/arch/ia64/hp/sim/hpsim_irq.c
--- linux-2.6.8-rc2/arch/ia64/hp/sim/hpsim_irq.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/arch/ia64/hp/sim/hpsim_irq.c	2004-08-03 15:21:32.254543120 -0700
@@ -21,6 +21,11 @@
 {
 }
 
+static void
+hpsim_set_affinity_noop (unsigned int a, cpumask_t b)
+{
+}
+
 static struct hw_interrupt_type irq_type_hp_sim = {
 	.typename =	"hpsim",
 	.startup =	hpsim_irq_startup,
@@ -29,7 +34,7 @@
 	.disable =	hpsim_irq_noop,
 	.ack =		hpsim_irq_noop,
 	.end =		hpsim_irq_noop,
-	.set_affinity =	(void (*)(unsigned int, unsigned long)) hpsim_irq_noop,
+	.set_affinity =	hpsim_set_affinity_noop,
 };
 
 void __init
diff -urN linux-2.6.8-rc2/arch/ia64/hp/sim/simeth.c linux-2.6.8-rc3/arch/ia64/hp/sim/simeth.c
--- linux-2.6.8-rc2/arch/ia64/hp/sim/simeth.c	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/arch/ia64/hp/sim/simeth.c	2004-08-03 15:21:32.254543120 -0700
@@ -527,13 +527,4 @@
 	printk(KERN_WARNING "%s: set_multicast_list called\n", dev->name);
 }
 
-#ifdef CONFIG_NET_FASTROUTE
-static int
-simeth_accept_fastpath(struct net_device *dev, struct dst_entry *dst)
-{
-	printk(KERN_WARNING "%s: simeth_accept_fastpath called\n", dev->name);
-	return -1;
-}
-#endif
-
 __initcall(simeth_probe);
diff -urN linux-2.6.8-rc2/arch/ia64/ia32/binfmt_elf32.c linux-2.6.8-rc3/arch/ia64/ia32/binfmt_elf32.c
--- linux-2.6.8-rc2/arch/ia64/ia32/binfmt_elf32.c	2004-08-03 15:21:05.156431739 -0700
+++ linux-2.6.8-rc3/arch/ia64/ia32/binfmt_elf32.c	2004-08-03 15:21:32.255543161 -0700
@@ -41,6 +41,8 @@
 #undef SET_PERSONALITY
 #define SET_PERSONALITY(ex, ibcs2)	elf32_set_personality()
 
+#define elf_read_implies_exec(ex, have_pt_gnu_stack)	(!(have_pt_gnu_stack))
+
 /* Ugly but avoids duplication */
 #include "../../../fs/binfmt_elf.c"
 
@@ -163,7 +165,8 @@
 	if (!mpnt)
 		return -ENOMEM;
 
-	if (security_vm_enough_memory((IA32_STACK_TOP - (PAGE_MASK & (unsigned long) bprm->p))>>PAGE_SHIFT)) {
+	if (security_vm_enough_memory((IA32_STACK_TOP - (PAGE_MASK & (unsigned long) bprm->p))
+				      >> PAGE_SHIFT)) {
 		kmem_cache_free(vm_area_cachep, mpnt);
 		return -ENOMEM;
 	}
@@ -210,7 +213,6 @@
 	set_personality(PER_LINUX32);
 	current->thread.map_base  = IA32_PAGE_OFFSET/3;
 	current->thread.task_size = IA32_PAGE_OFFSET;	/* use what Linux/x86 uses... */
-	current->thread.flags |= IA64_THREAD_XSTACK;	/* data must be executable */
 	set_fs(USER_DS);				/* set addr limit for new TASK_SIZE */
 }
 
diff -urN linux-2.6.8-rc2/arch/ia64/ia32/ia32_entry.S linux-2.6.8-rc3/arch/ia64/ia32/ia32_entry.S
--- linux-2.6.8-rc2/arch/ia64/ia32/ia32_entry.S	2004-08-03 15:21:05.157431780 -0700
+++ linux-2.6.8-rc3/arch/ia64/ia32/ia32_entry.S	2004-08-03 15:21:32.256543202 -0700
@@ -478,8 +478,8 @@
  	data8 compat_clock_gettime /* 265 */
  	data8 compat_clock_getres
  	data8 compat_clock_nanosleep
-	data8 sys_statfs64
-	data8 sys_fstatfs64
+	data8 compat_statfs64
+	data8 compat_fstatfs64
  	data8 sys_tgkill	/* 270 */
  	data8 compat_sys_utimes
  	data8 sys32_fadvise64_64
diff -urN linux-2.6.8-rc2/arch/ia64/kernel/acpi.c linux-2.6.8-rc3/arch/ia64/kernel/acpi.c
--- linux-2.6.8-rc2/arch/ia64/kernel/acpi.c	2004-08-03 15:21:05.161431944 -0700
+++ linux-2.6.8-rc3/arch/ia64/kernel/acpi.c	2004-08-03 15:21:32.261543407 -0700
@@ -171,8 +171,6 @@
 	if (BAD_MADT_ENTRY(lapic, end))
 		return -EINVAL;
 
-	acpi_table_print_madt_entry(header);
-
 	if (lapic->address) {
 		iounmap((void *) ipi_base_addr);
 		ipi_base_addr = (unsigned long) ioremap(lapic->address, 0);
@@ -191,25 +189,13 @@
 	if (BAD_MADT_ENTRY(lsapic, end))
 		return -EINVAL;
 
-	acpi_table_print_madt_entry(header);
-
-	printk(KERN_INFO "CPU %d (0x%04x)", total_cpus, (lsapic->id << 8) | lsapic->eid);
-
-	if (!lsapic->flags.enabled)
-		printk(" disabled");
-	else {
-		printk(" enabled");
+	if (lsapic->flags.enabled) {
 #ifdef CONFIG_SMP
 		smp_boot_data.cpu_phys_id[available_cpus] = (lsapic->id << 8) | lsapic->eid;
-		if (hard_smp_processor_id()
-		    == (unsigned int) smp_boot_data.cpu_phys_id[available_cpus])
-			printk(" (BSP)");
 #endif
 		++available_cpus;
 	}
 
-	printk("\n");
-
 	total_cpus++;
 	return 0;
 }
@@ -225,8 +211,6 @@
 	if (BAD_MADT_ENTRY(lacpi_nmi, end))
 		return -EINVAL;
 
-	acpi_table_print_madt_entry(header);
-
 	/* TBD: Support lapic_nmi entries */
 	return 0;
 }
@@ -242,8 +226,6 @@
 	if (BAD_MADT_ENTRY(iosapic, end))
 		return -EINVAL;
 
-	acpi_table_print_madt_entry(header);
-
 	iosapic_init(iosapic->address, iosapic->global_irq_base);
 
 	return 0;
@@ -262,8 +244,6 @@
 	if (BAD_MADT_ENTRY(plintsrc, end))
 		return -EINVAL;
 
-	acpi_table_print_madt_entry(header);
-
 	/*
 	 * Get vector assignment for this interrupt, set attributes,
 	 * and program the IOSAPIC routing table.
@@ -292,8 +272,6 @@
 	if (BAD_MADT_ENTRY(p, end))
 		return -EINVAL;
 
-	acpi_table_print_madt_entry(header);
-
 	iosapic_override_isa_irq(p->bus_irq, p->global_irq,
 				 (p->flags.polarity == 1) ? IOSAPIC_POL_HIGH : IOSAPIC_POL_LOW,
 				 (p->flags.trigger == 1) ? IOSAPIC_EDGE : IOSAPIC_LEVEL);
@@ -311,8 +289,6 @@
 	if (BAD_MADT_ENTRY(nmi_src, end))
 		return -EINVAL;
 
-	acpi_table_print_madt_entry(header);
-
 	/* TBD: Support nimsrc entries */
 	return 0;
 }
diff -urN linux-2.6.8-rc2/arch/ia64/kernel/irq.c linux-2.6.8-rc3/arch/ia64/kernel/irq.c
--- linux-2.6.8-rc2/arch/ia64/kernel/irq.c	2004-08-03 15:21:05.185432927 -0700
+++ linux-2.6.8-rc3/arch/ia64/kernel/irq.c	2004-08-03 15:21:32.317545705 -0700
@@ -87,7 +87,8 @@
 /*
  * This is updated when the user sets irq affinity via /proc
  */
-cpumask_t    __cacheline_aligned pending_irq_cpumask[NR_IRQS];
+cpumask_t __cacheline_aligned pending_irq_cpumask[NR_IRQS];
+static unsigned long pending_irq_redir[BITS_TO_LONGS(NR_IRQS)];
 
 #ifdef CONFIG_IA64_GENERIC
 irq_desc_t * __ia64_irq_desc (unsigned int irq)
@@ -973,6 +974,7 @@
 	int prelen;
 	irq_desc_t *desc = irq_descp(irq);
 	unsigned long flags;
+	int redir = 0;
 
 	if (!desc->handler->set_affinity)
 		return -EIO;
@@ -995,7 +997,7 @@
 	prelen = 0;
 	if (tolower(*rbuf) == 'r') {
 		prelen = strspn(rbuf, "Rr ");
-		irq |= IA64_IRQ_REDIRECTED;
+		redir++;
 	}
 
 	err = cpumask_parse(buffer+prelen, count-prelen, new_value);
@@ -1013,6 +1015,10 @@
 
 	spin_lock_irqsave(&desc->lock, flags);
 	pending_irq_cpumask[irq] = new_value;
+	if (redir)
+		set_bit(irq, pending_irq_redir);
+	else
+		clear_bit(irq, pending_irq_redir);
 	spin_unlock_irqrestore(&desc->lock, flags);
 
 	return full_count;
@@ -1023,11 +1029,13 @@
 	/* note - we hold desc->lock */
 	cpumask_t tmp;
 	irq_desc_t *desc = irq_descp(irq);
+	int redir = test_bit(irq, pending_irq_redir);
 
 	if (!cpus_empty(pending_irq_cpumask[irq])) {
 		cpus_and(tmp, pending_irq_cpumask[irq], cpu_online_map);
 		if (unlikely(!cpus_empty(tmp))) {
-			desc->handler->set_affinity(irq, pending_irq_cpumask[irq]);
+			desc->handler->set_affinity(irq | (redir ? IA64_IRQ_REDIRECTED : 0),
+						    pending_irq_cpumask[irq]);
 		}
 		cpus_clear(pending_irq_cpumask[irq]);
 	}
diff -urN linux-2.6.8-rc2/arch/ia64/kernel/mca.c linux-2.6.8-rc3/arch/ia64/kernel/mca.c
--- linux-2.6.8-rc2/arch/ia64/kernel/mca.c	2004-08-03 15:21:05.188433050 -0700
+++ linux-2.6.8-rc3/arch/ia64/kernel/mca.c	2004-08-03 15:21:32.320545828 -0700
@@ -128,8 +128,6 @@
  */
 static int cpe_poll_enabled = 1;
 
-static int cpe_vector = -1;
-
 extern void salinfo_log_wakeup(int type, u8 *buffer, u64 size, int irqsafe);
 
 /*
@@ -274,6 +272,8 @@
 
 #ifdef CONFIG_ACPI
 
+static int cpe_vector = -1;
+
 static irqreturn_t
 ia64_mca_cpe_int_handler (int cpe_irq, void *arg, struct pt_regs *ptregs)
 {
diff -urN linux-2.6.8-rc2/arch/ia64/kernel/perfmon.c linux-2.6.8-rc3/arch/ia64/kernel/perfmon.c
--- linux-2.6.8-rc2/arch/ia64/kernel/perfmon.c	2004-08-03 15:21:05.210433951 -0700
+++ linux-2.6.8-rc3/arch/ia64/kernel/perfmon.c	2004-08-03 15:21:32.363547592 -0700
@@ -4729,6 +4729,11 @@
 	if (task == current || ctx->ctx_fl_system) return 0;
 
 	/*
+	 * if context is UNLOADED we are safe to go
+	 */
+	if (state == PFM_CTX_UNLOADED) return 0;
+
+	/*
 	 * no command can operate on a zombie context
 	 */
 	if (state == PFM_CTX_ZOMBIE) {
@@ -4737,12 +4742,9 @@
 	}
 
 	/*
-	 * if context is UNLOADED, MASKED we are safe to go
-	 */
-	if (state != PFM_CTX_LOADED) return 0;
-
-	/*
-	 * context is LOADED, we must make sure the task is stopped
+	 * context is LOADED or MASKED. Some commands may need to have 
+	 * the task stopped.
+	 *
 	 * We could lift this restriction for UP but it would mean that
 	 * the user has no guarantee the task would not run between
 	 * two successive calls to perfmonctl(). That's probably OK.
diff -urN linux-2.6.8-rc2/arch/ia64/kernel/process.c linux-2.6.8-rc3/arch/ia64/kernel/process.c
--- linux-2.6.8-rc2/arch/ia64/kernel/process.c	2004-08-03 15:21:05.211433992 -0700
+++ linux-2.6.8-rc3/arch/ia64/kernel/process.c	2004-08-03 15:21:32.364547633 -0700
@@ -616,16 +616,6 @@
 	return error;
 }
 
-void
-ia64_set_personality (struct elf64_hdr *elf_ex, int ibcs2_interpreter)
-{
-	set_personality(PER_LINUX);
-	if (elf_ex->e_flags & EF_IA_64_LINUX_EXECUTABLE_STACK)
-		current->thread.flags |= IA64_THREAD_XSTACK;
-	else
-		current->thread.flags &= ~IA64_THREAD_XSTACK;
-}
-
 pid_t
 kernel_thread (int (*fn)(void *), void *arg, unsigned long flags)
 {
diff -urN linux-2.6.8-rc2/arch/ia64/mm/init.c linux-2.6.8-rc3/arch/ia64/mm/init.c
--- linux-2.6.8-rc2/arch/ia64/mm/init.c	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/arch/ia64/mm/init.c	2004-08-03 15:21:32.371547920 -0700
@@ -128,7 +128,7 @@
 		vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
 		vma->vm_end = vma->vm_start + PAGE_SIZE;
 		vma->vm_page_prot = protection_map[VM_DATA_DEFAULT_FLAGS & 0x7];
-		vma->vm_flags = VM_READ|VM_WRITE|VM_MAYREAD|VM_MAYWRITE|VM_GROWSUP;
+		vma->vm_flags = VM_DATA_DEFAULT_FLAGS | VM_GROWSUP;
 		insert_vm_struct(current->mm, vma);
 	}
 
@@ -169,7 +169,7 @@
 {
 	struct page *page;
 	/*
-	 * EFI uses 4KB pages while the kernel can use 4KB  or bigger.
+	 * EFI uses 4KB pages while the kernel can use 4KB or bigger.
 	 * Thus EFI and the kernel may have different page sizes. It is
 	 * therefore possible to have the initrd share the same page as
 	 * the end of the kernel (given current setup).
@@ -580,7 +580,7 @@
 		if (!fsyscall_table[i] || nolwsys)
 			fsyscall_table[i] = sys_call_table[i] | 1;
 	}
-	setup_gate();	/* setup gate pages before we free up boot memory... */
+	setup_gate();
 
 #ifdef CONFIG_IA32_SUPPORT
 	ia32_boot_gdt_init();
diff -urN linux-2.6.8-rc2/arch/ia64/sn/io/sn2/bte_error.c linux-2.6.8-rc3/arch/ia64/sn/io/sn2/bte_error.c
--- linux-2.6.8-rc2/arch/ia64/sn/io/sn2/bte_error.c	2004-08-03 15:21:05.248435508 -0700
+++ linux-2.6.8-rc3/arch/ia64/sn/io/sn2/bte_error.c	2004-08-03 15:21:32.396548945 -0700
@@ -90,6 +90,7 @@
 	ii_icrb0_d_u_t icrbd;	/* II CRB Register D */
 	ii_ibcr_u_t ibcr;
 	ii_icmr_u_t icmr;
+	ii_ieclr_u_t ieclr;
 
 
 	BTE_PRINTK(("bte_error_handler(%p) - %d\n", err_nodepda,
@@ -177,6 +178,14 @@
 	imem.ii_imem_fld_s.i_b0_esd = imem.ii_imem_fld_s.i_b1_esd = 1;
 	REMOTE_HUB_S(nasid, IIO_IMEM, imem.ii_imem_regval);
 
+	/* Clear IBLS0/1 error bits */
+	ieclr.ii_ieclr_regval = 0;
+	if (err_nodepda->bte_if[0].bh_error != BTE_SUCCESS)
+		ieclr.ii_ieclr_fld_s.i_e_bte_0 = 1;
+	if (err_nodepda->bte_if[1].bh_error != BTE_SUCCESS)
+                ieclr.ii_ieclr_fld_s.i_e_bte_1 = 1;
+	REMOTE_HUB_S(nasid, IIO_IECLR, ieclr.ii_ieclr_regval);
+
 	/* Reinitialize both BTE state machines. */
 	ibcr.ii_ibcr_regval = REMOTE_HUB_L(nasid, IIO_IBCR);
 	ibcr.ii_ibcr_fld_s.i_soft_reset = 1;
diff -urN linux-2.6.8-rc2/arch/ia64/sn/kernel/bte.c linux-2.6.8-rc3/arch/ia64/sn/kernel/bte.c
--- linux-2.6.8-rc2/arch/ia64/sn/kernel/bte.c	2004-08-03 15:21:05.251435631 -0700
+++ linux-2.6.8-rc3/arch/ia64/sn/kernel/bte.c	2004-08-03 15:21:32.400549110 -0700
@@ -16,7 +16,6 @@
 #include <asm/sn/pda.h>
 #include <asm/sn/sn2/shubio.h>
 #include <asm/nodedata.h>
-#include <asm/delay.h>
 
 #include <linux/bootmem.h>
 #include <linux/string.h>
@@ -71,6 +70,7 @@
 bte_copy(u64 src, u64 dest, u64 len, u64 mode, void *notification)
 {
 	u64 transfer_size;
+	u64 transfer_stat;
 	struct bteinfo_s *bte;
 	bte_result_t bte_status;
 	unsigned long irq_flags;
@@ -148,9 +148,6 @@
 		if (!(mode & BTE_WACQUIRE)) {
 			return BTEFAIL_NOTAVAIL;
 		}
-
-		/* Wait until a bte is available. */
-		udelay(1);
 	} while (1);
 
 
@@ -194,15 +191,15 @@
 		return BTE_SUCCESS;
 	}
 
-	while (*bte->most_rcnt_na == -1UL) {
+	while ((transfer_stat = *bte->most_rcnt_na) == -1UL) {
 	}
 
 
 	BTE_PRINTKV((" Delay Done.  IBLS = 0x%lx, most_rcnt_na = 0x%lx\n",
 				BTE_LNSTAT_LOAD(bte), *bte->most_rcnt_na));
 
-	if (*bte->most_rcnt_na & IBLS_ERROR) {
-		bte_status = *bte->most_rcnt_na & ~IBLS_ERROR;
+	if (transfer_stat & IBLS_ERROR) {
+		bte_status = transfer_stat & ~IBLS_ERROR;
 		*bte->most_rcnt_na = 0L;
 	} else {
 		bte_status = BTE_SUCCESS;
diff -urN linux-2.6.8-rc2/arch/ia64/sn/kernel/mca.c linux-2.6.8-rc3/arch/ia64/sn/kernel/mca.c
--- linux-2.6.8-rc2/arch/ia64/sn/kernel/mca.c	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/arch/ia64/sn/kernel/mca.c	2004-08-03 15:21:32.401549151 -0700
@@ -123,7 +123,8 @@
 	*oemdata_size = 0;
 	vfree(*oemdata);
 	*oemdata = NULL;
-	if (efi_guidcmp(guid, SAL_PLAT_SPECIFIC_ERR_SECT_GUID) == 0)
+	if (efi_guidcmp(guid, SAL_PLAT_SPECIFIC_ERR_SECT_GUID) == 0 ||
+	    efi_guidcmp(guid, SAL_PLAT_MEM_DEV_ERR_SECT_GUID) == 0)
 		return sn_platform_plat_specific_err_print(sect_header, oemdata, oemdata_size);
 	return 0;
 }
diff -urN linux-2.6.8-rc2/arch/m68k/bvme6000/config.c linux-2.6.8-rc3/arch/m68k/bvme6000/config.c
--- linux-2.6.8-rc2/arch/m68k/bvme6000/config.c	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/arch/m68k/bvme6000/config.c	2004-08-03 15:21:32.408549438 -0700
@@ -70,7 +70,7 @@
 		return 1;
 }
 
-void bvme6000_reset()
+void bvme6000_reset(void)
 {
 	volatile PitRegsPtr pit = (PitRegsPtr)BVME_PIT_BASE;
 
diff -urN linux-2.6.8-rc2/arch/m68k/ifpsp060/iskeleton.S linux-2.6.8-rc3/arch/m68k/ifpsp060/iskeleton.S
--- linux-2.6.8-rc2/arch/m68k/ifpsp060/iskeleton.S	2004-08-03 15:21:05.255435795 -0700
+++ linux-2.6.8-rc3/arch/m68k/ifpsp060/iskeleton.S	2004-08-03 15:21:32.409549479 -0700
@@ -204,11 +204,12 @@
 _060_real_lock_page:
 	move.l	%d2,-(%sp)
 	| load sfc/dfc
-	moveq	#5,%d0
 	tst.b	%d0
 	jne	1f
 	moveq	#1,%d0
-1:	movec.l	%dfc,%d2
+	jra	2f
+1:	moveq	#5,%d0
+2:	movec.l	%dfc,%d2
 	movec.l	%d0,%dfc
 	movec.l	%d0,%sfc
 
diff -urN linux-2.6.8-rc2/arch/m68k/kernel/setup.c linux-2.6.8-rc3/arch/m68k/kernel/setup.c
--- linux-2.6.8-rc2/arch/m68k/kernel/setup.c	2004-08-03 15:21:05.285437024 -0700
+++ linux-2.6.8-rc3/arch/m68k/kernel/setup.c	2004-08-03 15:21:32.410549520 -0700
@@ -237,6 +237,18 @@
 	}
 #endif
 
+	if (CPU_IS_060) {
+		u32 pcr;
+
+		asm (".chip 68060; movec %%pcr,%0; .chip 68k"
+		     : "=d" (pcr));
+		if (((pcr >> 8) & 0xff) <= 5) {
+			printk("Enabling workaround for errata I14\n");
+			asm (".chip 68060; movec %0,%%pcr; .chip 68k"
+			     : : "d" (pcr | 0x20));
+		}
+	}
+
 	init_mm.start_code = PAGE_OFFSET;
 	init_mm.end_code = (unsigned long) &_etext;
 	init_mm.end_data = (unsigned long) &_edata;
diff -urN linux-2.6.8-rc2/arch/m68k/kernel/signal.c linux-2.6.8-rc3/arch/m68k/kernel/signal.c
--- linux-2.6.8-rc2/arch/m68k/kernel/signal.c	2004-08-03 15:21:05.286437065 -0700
+++ linux-2.6.8-rc3/arch/m68k/kernel/signal.c	2004-08-03 15:21:32.411549561 -0700
@@ -349,7 +349,7 @@
 		/*
 		 * user process trying to return with weird frame format
 		 */
-#if DEBUG
+#ifdef DEBUG
 		printk("user process returning with weird frame format\n");
 #endif
 		goto badframe;
@@ -450,7 +450,7 @@
 		/*
 		 * user process trying to return with weird frame format
 		 */
-#if DEBUG
+#ifdef DEBUG
 		printk("user process returning with weird frame format\n");
 #endif
 		goto badframe;
@@ -829,7 +829,7 @@
 	if (regs->stkadj) {
 		struct pt_regs *tregs =
 			(struct pt_regs *)((ulong)regs + regs->stkadj);
-#if DEBUG
+#ifdef DEBUG
 		printk("Performing stackadjust=%04x\n", regs->stkadj);
 #endif
 		/* This must be copied with decreasing addresses to
@@ -912,7 +912,7 @@
 	if (regs->stkadj) {
 		struct pt_regs *tregs =
 			(struct pt_regs *)((ulong)regs + regs->stkadj);
-#if DEBUG
+#ifdef DEBUG
 		printk("Performing stackadjust=%04x\n", regs->stkadj);
 #endif
 		/* This must be copied with decreasing addresses to
diff -urN linux-2.6.8-rc2/arch/m68k/kernel/traps.c linux-2.6.8-rc3/arch/m68k/kernel/traps.c
--- linux-2.6.8-rc2/arch/m68k/kernel/traps.c	2004-08-03 15:21:05.287437106 -0700
+++ linux-2.6.8-rc3/arch/m68k/kernel/traps.c	2004-08-03 15:21:32.463551694 -0700
@@ -541,7 +541,7 @@
 	unsigned short ssw = fp->un.fmtb.ssw;
 	extern unsigned long _sun3_map_test_start, _sun3_map_test_end;
 
-#if DEBUG
+#ifdef DEBUG
 	if (ssw & (FC | FB))
 		printk ("Instruction fault at %#010lx\n",
 			ssw & FC ?
@@ -670,7 +670,7 @@
 	unsigned short mmusr;
 	unsigned long addr, errorcode;
 	unsigned short ssw = fp->un.fmtb.ssw;
-#if DEBUG
+#ifdef DEBUG
 	unsigned long desc;
 
 	printk ("pid = %x  ", current->pid);
@@ -696,7 +696,7 @@
 	if (ssw & DF) {
 		addr = fp->un.fmtb.daddr;
 
-#if DEBUG
+#ifdef DEBUG
 		asm volatile ("ptestr %3,%2@,#7,%0\n\t"
 			      "pmove %%psr,%1@"
 			      : "=a&" (desc)
@@ -708,7 +708,7 @@
 #endif
 		mmusr = temp;
 
-#if DEBUG
+#ifdef DEBUG
 		printk("mmusr is %#x for addr %#lx in task %p\n",
 		       mmusr, addr, current);
 		printk("descriptor address is %#lx, contents %#lx\n",
@@ -767,7 +767,7 @@
 				      : "a" (&tlong));
 			printk("tt1 is %#lx\n", tlong);
 #endif
-#if DEBUG
+#ifdef DEBUG
 			printk("Unknown SIGSEGV - 1\n");
 #endif
 			die_if_kernel("Oops",&fp->ptregs,mmusr);
@@ -812,7 +812,7 @@
 		   should still create the ATC entry.  */
 		goto create_atc_entry;
 
-#if DEBUG
+#ifdef DEBUG
 	asm volatile ("ptestr #1,%2@,#7,%0\n\t"
 		      "pmove %%psr,%1@"
 		      : "=a&" (desc)
@@ -836,7 +836,7 @@
 	else if (mmusr & (MMU_B|MMU_L|MMU_S)) {
 		printk ("invalid insn access at %#lx from pc %#lx\n",
 			addr, fp->ptregs.pc);
-#if DEBUG
+#ifdef DEBUG
 		printk("Unknown SIGSEGV - 2\n");
 #endif
 		die_if_kernel("Oops",&fp->ptregs,mmusr);
@@ -858,7 +858,7 @@
 	if (user_mode(&fp->ptregs))
 		current->thread.esp0 = (unsigned long) fp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk ("*** Bus Error *** Format is %x\n", fp->ptregs.format);
 #endif
 
@@ -881,7 +881,7 @@
 #endif
 	default:
 	  die_if_kernel("bad frame format",&fp->ptregs,0);
-#if DEBUG
+#ifdef DEBUG
 	  printk("Unknown SIGSEGV - 4\n");
 #endif
 	  force_sig(SIGSEGV, current);
@@ -990,7 +990,7 @@
 	printk ("\n");
 }
 
-extern void show_stack(struct task_struct *task, unsigned long *stack)
+void show_stack(struct task_struct *task, unsigned long *stack)
 {
 	unsigned long *endstack;
 	int i;
diff -urN linux-2.6.8-rc2/arch/m68k/lib/checksum.c linux-2.6.8-rc3/arch/m68k/lib/checksum.c
--- linux-2.6.8-rc2/arch/m68k/lib/checksum.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/arch/m68k/lib/checksum.c	2004-08-03 15:21:32.463551694 -0700
@@ -32,6 +32,7 @@
  *		csum_partial_copy_from_user.
  */
 
+#include <linux/module.h>
 #include <net/checksum.h>
 
 /*
diff -urN linux-2.6.8-rc2/arch/m68k/mac/macints.c linux-2.6.8-rc3/arch/m68k/mac/macints.c
--- linux-2.6.8-rc2/arch/m68k/mac/macints.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/arch/m68k/mac/macints.c	2004-08-03 15:21:32.471552022 -0700
@@ -545,7 +545,8 @@
 #endif
 
 	if (irq < VIA1_SOURCE_BASE) {
-		return cpu_free_irq(irq, dev_id);
+		cpu_free_irq(irq, dev_id);
+		return;
 	}
 
 	if (irq >= NUM_MAC_SOURCES) {
diff -urN linux-2.6.8-rc2/arch/m68k/mm/kmap.c linux-2.6.8-rc3/arch/m68k/mm/kmap.c
--- linux-2.6.8-rc2/arch/m68k/mm/kmap.c	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/arch/m68k/mm/kmap.c	2004-08-03 15:21:32.472552063 -0700
@@ -45,7 +45,7 @@
 
 static inline void free_io_area(void *addr)
 {
-	return vfree((void *)(PAGE_MASK & (unsigned long)addr));
+	vfree((void *)(PAGE_MASK & (unsigned long)addr));
 }
 
 #else
diff -urN linux-2.6.8-rc2/arch/m68k/mm/memory.c linux-2.6.8-rc3/arch/m68k/mm/memory.c
--- linux-2.6.8-rc2/arch/m68k/mm/memory.c	2004-08-03 15:21:05.290437229 -0700
+++ linux-2.6.8-rc3/arch/m68k/mm/memory.c	2004-08-03 15:21:32.473552104 -0700
@@ -129,7 +129,7 @@
 	return 0;
 }
 
-#if DEBUG_INVALID_PTOV
+#ifdef DEBUG_INVALID_PTOV
 int mm_inv_cnt = 5;
 #endif
 
@@ -179,7 +179,7 @@
 		voff += m68k_memory[i].size;
 	} while (++i < m68k_num_memory);
 
-#if DEBUG_INVALID_PTOV
+#ifdef DEBUG_INVALID_PTOV
 	if (mm_inv_cnt > 0) {
 		mm_inv_cnt--;
 		printk("Invalid use of phys_to_virt(0x%lx) at 0x%p!\n",
diff -urN linux-2.6.8-rc2/arch/m68k/mvme147/config.c linux-2.6.8-rc3/arch/m68k/mvme147/config.c
--- linux-2.6.8-rc2/arch/m68k/mvme147/config.c	2004-06-15 22:19:02.000000000 -0700
+++ linux-2.6.8-rc3/arch/m68k/mvme147/config.c	2004-08-03 15:21:32.485552597 -0700
@@ -69,7 +69,7 @@
 		return 1;
 }
 
-void mvme147_reset()
+void mvme147_reset(void)
 {
 	printk ("\r\n\nCalled mvme147_reset\r\n");
 	m147_pcc->watchdog = 0x0a;	/* Clear timer */
diff -urN linux-2.6.8-rc2/arch/m68k/mvme16x/config.c linux-2.6.8-rc3/arch/m68k/mvme16x/config.c
--- linux-2.6.8-rc2/arch/m68k/mvme16x/config.c	2004-06-15 22:19:09.000000000 -0700
+++ linux-2.6.8-rc3/arch/m68k/mvme16x/config.c	2004-08-03 15:21:32.485552597 -0700
@@ -75,7 +75,7 @@
 		return 1;
 }
 
-void mvme16x_reset()
+void mvme16x_reset(void)
 {
 	printk ("\r\n\nCalled mvme16x_reset\r\n"
 			"\r\r\r\r\r\r\r\r\r\r\r\r\r\r\r\r\r\r");
diff -urN linux-2.6.8-rc2/arch/m68k/q40/config.c linux-2.6.8-rc3/arch/m68k/q40/config.c
--- linux-2.6.8-rc2/arch/m68k/q40/config.c	2004-08-03 15:21:05.290437229 -0700
+++ linux-2.6.8-rc3/arch/m68k/q40/config.c	2004-08-03 15:21:32.486552638 -0700
@@ -122,7 +122,7 @@
 }
 #endif
 
-void q40_reset()
+void q40_reset(void)
 {
         halted=1;
         printk ("\n\n*******************************************\n"
@@ -131,7 +131,7 @@
 	Q40_LED_ON();
 	while(1) ;
 }
-void q40_halt()
+void q40_halt(void)
 {
         halted=1;
         printk ("\n\n*******************\n"
@@ -295,7 +295,7 @@
 	return 0;
 }
 
-unsigned int q40_get_ss()
+unsigned int q40_get_ss(void)
 {
 	return bcd2bin(Q40_RTC_SECS);
 }
diff -urN linux-2.6.8-rc2/arch/ppc/8260_io/enet.c linux-2.6.8-rc3/arch/ppc/8260_io/enet.c
--- linux-2.6.8-rc2/arch/ppc/8260_io/enet.c	2004-08-03 15:21:05.637451445 -0700
+++ linux-2.6.8-rc3/arch/ppc/8260_io/enet.c	2004-08-03 15:21:32.898569540 -0700
@@ -613,7 +613,7 @@
 	struct net_device *dev;
 	struct scc_enet_private *cep;
 	int i, j, err;
-	void * dpaddr;
+	uint dp_offset;
 	unsigned char	*eap;
 	unsigned long	mem_addr;
 	bd_t		*bd;
@@ -681,13 +681,13 @@
 	 * These are relative offsets in the DP ram address space.
 	 * Initialize base addresses for the buffer descriptors.
 	 */
-	dpaddr = cpm2_dpalloc(sizeof(cbd_t) * RX_RING_SIZE, 8);
-	ep->sen_genscc.scc_rbase = cpm2_dpram_offset(dpaddr);
-	cep->rx_bd_base = (cbd_t *)dpaddr;
-
-	dpaddr = cpm2_dpalloc(sizeof(cbd_t) * TX_RING_SIZE, 8);
-	ep->sen_genscc.scc_tbase = cpm2_dpram_offset(dpaddr);
-	cep->tx_bd_base = (cbd_t *)dpaddr;
+	dp_offset = cpm_dpalloc(sizeof(cbd_t) * RX_RING_SIZE, 8);
+	ep->sen_genscc.scc_rbase = dp_offset;
+	cep->rx_bd_base = (cbd_t *)cpm_dpram_addr(dp_offset);
+
+	dp_offset = cpm_dpalloc(sizeof(cbd_t) * TX_RING_SIZE, 8);
+	ep->sen_genscc.scc_tbase = dp_offset;
+	cep->tx_bd_base = (cbd_t *)cpm_dpram_addr(dp_offset);
 
 	cep->dirty_tx = cep->cur_tx = cep->tx_bd_base;
 	cep->cur_rx = cep->rx_bd_base;
diff -urN linux-2.6.8-rc2/arch/ppc/8xx_io/commproc.c linux-2.6.8-rc3/arch/ppc/8xx_io/commproc.c
--- linux-2.6.8-rc2/arch/ppc/8xx_io/commproc.c	2004-08-03 15:21:05.657452265 -0700
+++ linux-2.6.8-rc3/arch/ppc/8xx_io/commproc.c	2004-08-03 15:21:33.580597519 -0700
@@ -286,7 +286,7 @@
 #define BRG_UART_CLK_DIV16	(BRG_UART_CLK/16)
 
 void
-m8xx_cpm_setbrg(uint brg, uint rate)
+cpm_setbrg(uint brg, uint rate)
 {
 	volatile uint	*bp;
 
@@ -336,8 +336,7 @@
 	 * with the processor and the microcode patches applied / activated.
 	 * But the following should be at least safe.
 	 */
-	rh_attach_region(&cpm_dpmem_info, cp->cp_dpmem + CPM_DATAONLY_BASE,
-			CPM_DATAONLY_SIZE);
+	rh_attach_region(&cpm_dpmem_info, (void *)CPM_DATAONLY_BASE, CPM_DATAONLY_SIZE);
 }
 
 /*
@@ -346,59 +345,55 @@
  * Now it returns the actuall physical address of that area.
  * use m8xx_cpm_dpram_offset() to get the index
  */
-void *m8xx_cpm_dpalloc(int size)
+uint cpm_dpalloc(uint size, uint align)
 {
 	void *start;
 	unsigned long flags;
 
 	spin_lock_irqsave(&cpm_dpmem_lock, flags);
+	cpm_dpmem_info.alignment = align;
 	start = rh_alloc(&cpm_dpmem_info, size, "commproc");
 	spin_unlock_irqrestore(&cpm_dpmem_lock, flags);
 
-	return start;
+	return (uint)start;
 }
-EXPORT_SYMBOL(m8xx_cpm_dpalloc);
+EXPORT_SYMBOL(cpm_dpalloc);
 
-int m8xx_cpm_dpfree(void *addr)
+int cpm_dpfree(uint offset)
 {
 	int ret;
 	unsigned long flags;
 
 	spin_lock_irqsave(&cpm_dpmem_lock, flags);
-	ret = rh_free(&cpm_dpmem_info, addr);
+	ret = rh_free(&cpm_dpmem_info, (void *)offset);
 	spin_unlock_irqrestore(&cpm_dpmem_lock, flags);
 
 	return ret;
 }
-EXPORT_SYMBOL(m8xx_cpm_dpfree);
+EXPORT_SYMBOL(cpm_dpfree);
 
-void *m8xx_cpm_dpalloc_fixed(void *addr, int size)
+uint cpm_dpalloc_fixed(uint offset, uint size, uint align)
 {
 	void *start;
 	unsigned long flags;
 
 	spin_lock_irqsave(&cpm_dpmem_lock, flags);
-	start = rh_alloc_fixed(&cpm_dpmem_info, addr, size, "commproc");
+	cpm_dpmem_info.alignment = align;
+	start = rh_alloc_fixed(&cpm_dpmem_info, (void *)offset, size, "commproc");
 	spin_unlock_irqrestore(&cpm_dpmem_lock, flags);
 
-	return start;
+	return (uint)start;
 }
-EXPORT_SYMBOL(m8xx_cpm_dpalloc_fixed);
+EXPORT_SYMBOL(cpm_dpalloc_fixed);
 
-void m8xx_cpm_dpdump(void)
+void cpm_dpdump(void)
 {
 	rh_dump(&cpm_dpmem_info);
 }
-EXPORT_SYMBOL(m8xx_cpm_dpdump);
+EXPORT_SYMBOL(cpm_dpdump);
 
-int m8xx_cpm_dpram_offset(void *addr)
-{
-	return (u_char *)addr - ((immap_t *)IMAP_ADDR)->im_cpm.cp_dpmem;
-}
-EXPORT_SYMBOL(m8xx_cpm_dpram_offset);
-
-void *m8xx_cpm_dpram_addr(int offset)
+void *cpm_dpram_addr(uint offset)
 {
 	return ((immap_t *)IMAP_ADDR)->im_cpm.cp_dpmem + offset;
 }
-EXPORT_SYMBOL(m8xx_cpm_dpram_addr);
+EXPORT_SYMBOL(cpm_dpram_addr);
diff -urN linux-2.6.8-rc2/arch/ppc/8xx_io/cs4218_tdm.c linux-2.6.8-rc3/arch/ppc/8xx_io/cs4218_tdm.c
--- linux-2.6.8-rc2/arch/ppc/8xx_io/cs4218_tdm.c	2004-08-03 15:21:05.659452347 -0700
+++ linux-2.6.8-rc3/arch/ppc/8xx_io/cs4218_tdm.c	2004-08-03 15:21:33.581597560 -0700
@@ -2463,7 +2463,7 @@
 int __init tdm8xx_sound_init(void)
 {
 	int i, has_sound;
-	uint			dp_addr, dp_mem;
+	uint			dp_offset;
 	volatile uint		*sirp;
 	volatile cbd_t		*bdp;
 	volatile cpm8xx_t	*cp;
@@ -2525,15 +2525,14 @@
 	/* We need to allocate a transmit and receive buffer
 	 * descriptors from dual port ram.
 	 */
-	dp_mem = m8xx_cpm_dpalloc(sizeof(cbd_t) * numReadBufs);
-	dp_addr = m8xx_cpm_dpram_offset(dp_mem);
+	dp_addr = cpm_dpalloc(sizeof(cbd_t) * numReadBufs, 8);
 
 	/* Set the physical address of the host memory
 	 * buffers in the buffer descriptors, and the
 	 * virtual address for us to work with.
 	 */
 	bdp = (cbd_t *)&cp->cp_dpmem[dp_addr];
-	up->smc_rbase = dp_mem;
+	up->smc_rbase = dp_offset;
 	rx_cur = rx_base = (cbd_t *)bdp;
 
 	for (i=0; i<(numReadBufs-1); i++) {
@@ -2548,11 +2547,10 @@
 
 	/* Now, do the same for the transmit buffers.
 	*/
-	dp_mem = m8xx_cpm_dpalloc(sizeof(cbd_t) * numBufs);
-	dp_addr = m8xx_cpm_dpram_offset(dp_mem);
+	dp_offset = cpm_dpalloc(sizeof(cbd_t) * numBufs, 8);
 
 	bdp = (cbd_t *)&cp->cp_dpmem[dp_addr];
-	up->smc_tbase = dp_mem;
+	up->smc_tbase = dp_offset;
 	tx_cur = tx_base = (cbd_t *)bdp;
 
 	for (i=0; i<(numBufs-1); i++) {
diff -urN linux-2.6.8-rc2/arch/ppc/8xx_io/enet.c linux-2.6.8-rc3/arch/ppc/8xx_io/enet.c
--- linux-2.6.8-rc2/arch/ppc/8xx_io/enet.c	2004-08-03 15:21:05.660452388 -0700
+++ linux-2.6.8-rc3/arch/ppc/8xx_io/enet.c	2004-08-03 15:21:33.582597601 -0700
@@ -644,8 +644,7 @@
 	struct net_device *dev;
 	struct scc_enet_private *cep;
 	int i, j, k, err;
-	void *dp_mem;
-	unsigned int dp_addr;
+	uint dp_offset;
 	unsigned char	*eap, *ba;
 	dma_addr_t	mem_addr;
 	bd_t		*bd;
@@ -740,15 +739,13 @@
 	 * These are relative offsets in the DP ram address space.
 	 * Initialize base addresses for the buffer descriptors.
 	 */
-	dp_mem = m8xx_cpm_dpalloc(sizeof(cbd_t) * RX_RING_SIZE);
-	dp_addr = m8xx_cpm_dpram_offset(dp_mem);
-	ep->sen_genscc.scc_rbase = dp_mem;
-	cep->rx_bd_base = (cbd_t *)&cp->cp_dpmem[dp_addr];
-
-	dp_mem = m8xx_cpm_dpalloc(sizeof(cbd_t) * TX_RING_SIZE);
-	dp_addr = m8xx_cpm_dpram_offset(dp_mem);
-	ep->sen_genscc.scc_tbase = dp_mem;
-	cep->tx_bd_base = (cbd_t *)&cp->cp_dpmem[dp_addr];
+	dp_offset = cpm_dpalloc(sizeof(cbd_t) * RX_RING_SIZE, 8);
+	ep->sen_genscc.scc_rbase = dp_offset;
+	cep->rx_bd_base = cpm_dpram_addr(dp_offset);
+
+	dp_offset = cpm_dpalloc(sizeof(cbd_t) * TX_RING_SIZE, 8);
+	ep->sen_genscc.scc_tbase = dp_offset;
+	cep->tx_bd_base = cpm_dpram_addr(dp_offset);
 
 	cep->dirty_tx = cep->cur_tx = cep->tx_bd_base;
 	cep->cur_rx = cep->rx_bd_base;
diff -urN linux-2.6.8-rc2/arch/ppc/8xx_io/uart.c linux-2.6.8-rc3/arch/ppc/8xx_io/uart.c
--- linux-2.6.8-rc2/arch/ppc/8xx_io/uart.c	2004-08-03 15:21:05.662452469 -0700
+++ linux-2.6.8-rc3/arch/ppc/8xx_io/uart.c	2004-08-03 15:21:33.585597724 -0700
@@ -2491,7 +2491,7 @@
 {
 	struct serial_state * state;
 	ser_info_t	*info;
-	uint		mem_addr, dp_addr, dp_mem, iobits;
+	uint		mem_addr, iobits, dp_offset;
 	int		i, j, idx;
 	ushort		chan;
 	volatile	cbd_t		*bdp;
@@ -2623,8 +2623,7 @@
 			 * descriptors from dual port ram, and a character
 			 * buffer area from host mem.
 			 */
-			dp_mem = m8xx_cpm_dpalloc(sizeof(cbd_t) * RX_NUM_FIFO);
-			dp_addr = m8xx_cpm_dpram_offset(dp_mem);
+			dp_offset = cpm_dpalloc(sizeof(cbd_t) * RX_NUM_FIFO, 8);
 
 			/* Allocate space for FIFOs in the host memory.
 			*/
@@ -2635,7 +2634,7 @@
 			 * buffers in the buffer descriptors, and the
 			 * virtual address for us to work with.
 			 */
-			bdp = (cbd_t *)&cp->cp_dpmem[dp_addr];
+			bdp = (cbd_t *)&cp->cp_dpmem[dp_offset];
 			info->rx_cur = info->rx_bd_base = (cbd_t *)bdp;
 
 			for (j=0; j<(RX_NUM_FIFO-1); j++) {
@@ -2651,16 +2650,15 @@
 			if (info->state->smc_scc_num & NUM_IS_SCC) {
 				scp = &cp->cp_scc[idx];
 				sup = (scc_uart_t *)&cp->cp_dparam[state->port];
-				sup->scc_genscc.scc_rbase = dp_mem;
+				sup->scc_genscc.scc_rbase = dp_offset;
 			}
 			else {
 				sp = &cp->cp_smc[idx];
 				up = (smc_uart_t *)&cp->cp_dparam[state->port];
-				up->smc_rbase = dp_mem;
+				up->smc_rbase = dp_offset;
 			}
 
-			dp_mem = m8xx_cpm_dpalloc(sizeof(cbd_t) * TX_NUM_FIFO);
-			dp_addr = m8xx_cpm_dpram_offset(dp_mem);
+			dp_offset = cpm_dpalloc(sizeof(cbd_t) * TX_NUM_FIFO, 8);
 
 			/* Allocate space for FIFOs in the host memory.
 			*/
@@ -2671,7 +2669,7 @@
 			 * buffers in the buffer descriptors, and the
 			 * virtual address for us to work with.
 			 */
-			bdp = (cbd_t *)&cp->cp_dpmem[dp_addr];
+			bdp = (cbd_t *)&cp->cp_dpmem[dp_offset];
 			info->tx_cur = info->tx_bd_base = (cbd_t *)bdp;
 
 			for (j=0; j<(TX_NUM_FIFO-1); j++) {
@@ -2684,7 +2682,7 @@
 			bdp->cbd_sc = (BD_SC_WRAP | BD_SC_INTRPT);
 
 			if (info->state->smc_scc_num & NUM_IS_SCC) {
-				sup->scc_genscc.scc_tbase = dp_mem;
+				sup->scc_genscc.scc_tbase = dp_offset;
 
 				/* Set up the uart parameters in the
 				 * parameter ram.
@@ -2781,7 +2779,7 @@
 				cp->cp_simode &= ~(0xffff << (idx * 16));
 				cp->cp_simode |= (i << ((idx * 16) + 12));
 
-				up->smc_tbase = dp_mem;
+				up->smc_tbase = dp_offset;
 
 				/* Set up the uart parameters in the
 				 * parameter ram.
@@ -2845,7 +2843,7 @@
 static int __init serial_console_setup(struct console *co, char *options)
 {
 	struct		serial_state *ser;
-	uint		mem_addr, dp_addr, dp_mem, bidx, idx;
+	uint		mem_addr, bidx, idx, dp_offset;
 	ushort		chan;
 	volatile	cbd_t		*bdp;
 	volatile	cpm8xx_t	*cp;
@@ -2891,19 +2889,17 @@
 	 * memory yet because vm allocator isn't initialized
 	 * during this early console init.
 	 */
-	dp_mem = m8xx_cpm_dpalloc(8);
-	dp_addr = m8xx_cpm_dpram_offset(dp_mem);
-	mem_addr = (uint)(&cpmp->cp_dpmem[dp_addr]);
+	dp_offset = cpm_dpalloc(8, 8);
+	mem_addr = (uint)(&cpmp->cp_dpmem[dp_offset]);
 
 	/* Allocate space for two buffer descriptors in the DP ram.
 	*/
-	dp_mem = m8xx_cpm_dpalloc(sizeof(cbd_t) * 2);
-	dp_addr = m8xx_cpm_dpram_offset(dp_mem);
+	dp_offset = cpm_dpalloc(sizeof(cbd_t) * 2, 8);
 
 	/* Set the physical address of the host memory buffers in
 	 * the buffer descriptors.
 	 */
-	bdp = (cbd_t *)&cp->cp_dpmem[dp_addr];
+	bdp = (cbd_t *)&cp->cp_dpmem[dp_offset];
 	bdp->cbd_bufaddr = iopa(mem_addr);
 	(bdp+1)->cbd_bufaddr = iopa(mem_addr+4);
 
@@ -2922,8 +2918,8 @@
 	*/
 	if (ser->smc_scc_num & NUM_IS_SCC) {
 
-		sup->scc_genscc.scc_rbase = dp_mem;
-		sup->scc_genscc.scc_tbase = dp_mem + sizeof(cbd_t);
+		sup->scc_genscc.scc_rbase = dp_offset;
+		sup->scc_genscc.scc_tbase = dp_offset + sizeof(cbd_t);
 
 		/* Set up the uart parameters in the
 		 * parameter ram.
@@ -2981,8 +2977,8 @@
 
 	}
 	else {
-		up->smc_rbase = dp_mem;	/* Base of receive buffer desc. */
-		up->smc_tbase = dp_mem+sizeof(cbd_t);	/* Base of xmt buffer desc. */
+		up->smc_rbase = dp_offset;	/* Base of receive buffer desc. */
+		up->smc_tbase = dp_offset+sizeof(cbd_t);	/* Base of xmt buffer desc. */
 		up->smc_rfcr = SMC_EB;
 		up->smc_tfcr = SMC_EB;
 
diff -urN linux-2.6.8-rc2/arch/ppc/Kconfig linux-2.6.8-rc3/arch/ppc/Kconfig
--- linux-2.6.8-rc2/arch/ppc/Kconfig	2004-08-03 15:21:05.664452551 -0700
+++ linux-2.6.8-rc3/arch/ppc/Kconfig	2004-08-03 15:21:33.587597806 -0700
@@ -44,18 +44,18 @@
 	default 6xx
 
 config 6xx
-	bool "6xx/7xx/74xx/8260"
+	bool "6xx/7xx/74xx/52xx/8260"
 	help
 	  There are four types of PowerPC chips supported.  The more common
 	  types (601, 603, 604, 740, 750, 7400), the Motorola embedded
-	  versions (821, 823, 850, 855, 860, 8260), the IBM embedded versions
-	  (403 and 405) and the high end 64 bit Power processors (POWER 3,
-	  POWER4, and IBM 970 also known as G5)
+	  versions (821, 823, 850, 855, 860, 52xx, 8260), the IBM embedded
+	  versions (403 and 405) and the high end 64 bit Power processors 
+	  (POWER 3, POWER4, and IBM 970 also known as G5)
 	  Unless you are building a kernel for one of the embedded processor
 	  systems, 64 bit IBM RS/6000 or an Apple G5, choose 6xx.
 	  Note that the kernel runs in 32-bit mode even on 64-bit chips.
-	  Also note that because the 82xx family has a 603e core, specific
-	  support for that chipset is asked later on.
+	  Also note that because the 52xx & 82xx family has a 603e core,
+	  specific support for that chipset is asked later on.
 
 config 40x
 	bool "40x"
@@ -191,7 +191,7 @@
 	  fly. This is a nice method to save battery power on notebooks,
 	  because the lower the clock speed, the less power the CPU consumes.
 
-	  For more information, take a look at linux/Documentation/cpu-freq or
+	  For more information, take a look at <file:Documentation/cpu-freq> or
 	  at <http://www.brodo.de/cpufreq/>
 
 	  If in doubt, say N.
@@ -583,7 +583,7 @@
 config SBS8260
 	bool "SBS8260"
 
-config RPX6
+config RPX8260
 	bool "RPXSUPER"
 
 config TQM8260
@@ -601,6 +601,15 @@
 config ADS8272
 	bool "ADS8272"
 
+config LITE5200
+	bool "Freescale LITE5200 / (IceCube)"
+	select PPC_MPC52xx
+	help
+	  Support for the LITE5200 dev board for the MPC5200 from Freescale.
+	  This is for the LITE5200 version 2.0 board. Don't know if it changes
+	  much but it's only been tested on this board version. I think this
+	  board is also known as IceCube.
+
 endchoice
 
 config PQ2ADS
@@ -617,11 +626,14 @@
 	bool
 	depends on 8xx || 8260
 	default y
+	
+config PPC_MPC52xx
+	bool
 
 config 8260
 	bool "CPM2 Support" if WILLOW
 	depends on 6xx
-	default y if TQM8260 || RPXSUPER || EST8260 || SBS8260 || SBC82xx
+	default y if TQM8260 || RPX8260 || EST8260 || SBS8260 || SBC82xx
 	help
 	  The MPC8260 is a typical embedded CPU made by Motorola.  Selecting
 	  this option means that you wish to build a kernel for a machine with
@@ -638,7 +650,7 @@
 
 config CPM2
 	bool
-	depends on 8260
+	depends on 8260 || MPC8560
 	default y
 	help
 	  The CPM2 (Communications Processor Module) is a coprocessor on
@@ -707,7 +719,7 @@
 
 config FSL_OCP
 	bool
-	depends on MPC10X_BRIDGE
+	depends on MPC10X_BRIDGE || PPC_MPC52xx
 	default y
 
 config MPC10X_OPENPIC
@@ -1295,7 +1307,7 @@
 
 config KGDB
 	bool "Include kgdb kernel debugger"
-	depends on DEBUG_KERNEL
+	depends on DEBUG_KERNEL && (BROKEN || PPC_GEN550 || 4xx)
 	select DEBUG_INFO
 	help
 	  Include in-kernel hooks for kgdb, the Linux kernel source level
@@ -1363,7 +1375,7 @@
 
 config SERIAL_TEXT_DEBUG
 	bool "Support for early boot texts over serial port"
-	depends on 4xx || GT64260 || LOPEC || PPLUS || PRPMC800 || PPC_GEN550
+	depends on 4xx || GT64260 || LOPEC || PPLUS || PRPMC800 || PPC_GEN550 || PPC_MPC52xx
 
 config PPC_OCP
 	bool
diff -urN linux-2.6.8-rc2/arch/ppc/Makefile linux-2.6.8-rc3/arch/ppc/Makefile
--- linux-2.6.8-rc2/arch/ppc/Makefile	2004-08-03 15:21:05.664452551 -0700
+++ linux-2.6.8-rc3/arch/ppc/Makefile	2004-08-03 15:21:33.587597806 -0700
@@ -22,19 +22,27 @@
 
 LDFLAGS_vmlinux	:= -Ttext $(KERNELLOAD) -Bstatic
 CPPFLAGS	+= -Iarch/$(ARCH)
-AFLAGS		+= -Iarch/$(ARCH)
+aflags-y	+= -Iarch/$(ARCH)
 cflags-y	+= -Iarch/$(ARCH) -msoft-float -pipe \
 		-ffixed-r2 -Wno-uninitialized -mmultiple
 CPP		= $(CC) -E $(CFLAGS)
 
+CHECK		:= $(CHECK) -D__powerpc__=1
+
 ifndef CONFIG_E500
 cflags-y	+= -mstring
 endif
 
+aflags-$(CONFIG_4xx)		+= -m405
 cflags-$(CONFIG_4xx)		+= -Wa,-m405
+aflags-$(CONFIG_6xx)		+= -maltivec
+cflags-$(CONFIG_6xx)		+= -Wa,-maltivec
+aflags-$(CONFIG_E500)		+= -me500
 cflags-$(CONFIG_E500)		+= -Wa,-me500
+aflags-$(CONFIG_PPC64BRIDGE)	+= -mppc64bridge
 cflags-$(CONFIG_PPC64BRIDGE)	+= -Wa,-mppc64bridge
 
+AFLAGS += $(aflags-y)
 CFLAGS += $(cflags-y)
 
 head-y				:= arch/ppc/kernel/head.o
@@ -106,17 +114,24 @@
 else
 NEW_AS	:= 0
 endif
+# gcc-3.4 and binutils-2.14 are a fatal combination.
+GCC_VERSION	:= $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-version.sh $(CC))
+BAD_GCC_AS	:= $(shell echo mftb 5 | $(AS) -mppc -many -o /dev/null >/dev/null 2>&1 && echo 0 || echo 1)
 
-ifneq ($(NEW_AS),0)
 checkbin:
+ifeq ($(GCC_VERSION)$(BAD_GCC_AS),03041)
+	@echo -n '*** ${VERSION}.${PATCHLEVEL} kernels no longer build '
+	@echo 'correctly with gcc-3.4 and your version of binutils.'
+	@echo '*** Please upgrade your binutils or downgrade your gcc'
+	@false
+endif
+ifneq ($(NEW_AS),0)
 	@echo -n '*** ${VERSION}.${PATCHLEVEL} kernels no longer build '
 	@echo 'correctly with old versions of binutils.'
 	@echo '*** Please upgrade your binutils to ${GOODVER} or newer'
 	@false
-else
-checkbin:
-	@true
 endif
+	@true
 
 CLEAN_FILES +=	include/asm-$(ARCH)/offsets.h \
 		arch/$(ARCH)/kernel/asm-offsets.s
diff -urN linux-2.6.8-rc2/arch/ppc/boot/common/misc-common.c linux-2.6.8-rc3/arch/ppc/boot/common/misc-common.c
--- linux-2.6.8-rc2/arch/ppc/boot/common/misc-common.c	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/boot/common/misc-common.c	2004-08-03 15:21:33.588597847 -0700
@@ -59,7 +59,8 @@
 void _vprintk(void(*putc)(const char), const char *fmt0, va_list ap);
 unsigned char *ISA_io = NULL;
 
-#if defined(CONFIG_SERIAL_CONSOLE) || defined(CONFIG_SERIAL_8250_CONSOLE)
+#if defined(CONFIG_SERIAL_CPM_CONSOLE) || defined(CONFIG_SERIAL_8250_CONSOLE) \
+	|| defined(CONFIG_SERIAL_MPC52xx_CONSOLE)
 extern unsigned long com_port;
 
 extern int serial_tstc(unsigned long com_port);
@@ -80,7 +81,8 @@
 
 int tstc(void)
 {
-#if defined(CONFIG_SERIAL_CONSOLE) || defined(CONFIG_SERIAL_8250_CONSOLE)
+#if defined(CONFIG_SERIAL_CPM_CONSOLE) || defined(CONFIG_SERIAL_8250_CONSOLE) \
+	|| defined(CONFIG_SERIAL_MPC52xx_CONSOLE)
 	if(keyb_present)
 		return (CRT_tstc() || serial_tstc(com_port));
 	else
@@ -93,7 +95,8 @@
 int getc(void)
 {
 	while (1) {
-#if defined(CONFIG_SERIAL_CONSOLE) || defined(CONFIG_SERIAL_8250_CONSOLE)
+#if defined(CONFIG_SERIAL_CPM_CONSOLE) || defined(CONFIG_SERIAL_8250_CONSOLE) \
+	|| defined(CONFIG_SERIAL_MPC52xx_CONSOLE)
 		if (serial_tstc(com_port))
 			return (serial_getc(com_port));
 #endif /* serial console */
@@ -108,7 +111,8 @@
 {
 	int x,y;
 
-#if defined(CONFIG_SERIAL_CONSOLE) || defined(CONFIG_SERIAL_8250_CONSOLE)
+#if defined(CONFIG_SERIAL_CPM_CONSOLE) || defined(CONFIG_SERIAL_8250_CONSOLE) \
+	|| defined(CONFIG_SERIAL_MPC52xx_CONSOLE)
 	serial_putc(com_port, c);
 	if ( c == '\n' )
 		serial_putc(com_port, '\r');
@@ -155,7 +159,8 @@
 	y = orig_y;
 
 	while ( ( c = *s++ ) != '\0' ) {
-#if defined(CONFIG_SERIAL_CONSOLE) || defined(CONFIG_SERIAL_8250_CONSOLE)
+#if defined(CONFIG_SERIAL_CPM_CONSOLE) || defined(CONFIG_SERIAL_8250_CONSOLE) \
+	|| defined(CONFIG_SERIAL_MPC52xx_CONSOLE)
 	        serial_putc(com_port, c);
 	        if ( c == '\n' ) serial_putc(com_port, '\r');
 #endif /* serial console */
diff -urN linux-2.6.8-rc2/arch/ppc/boot/simple/Makefile linux-2.6.8-rc3/arch/ppc/boot/simple/Makefile
--- linux-2.6.8-rc2/arch/ppc/boot/simple/Makefile	2004-06-15 22:18:38.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/boot/simple/Makefile	2004-08-03 15:21:33.589597888 -0700
@@ -113,6 +113,12 @@
   entrypoint-$(CONFIG_SPRUCE)		:= 0x00800000
         misc-$(CONFIG_SPRUCE)		+= misc-spruce.o
 
+      zimage-$(CONFIG_LITE5200)		:= zImage-STRIPELF
+zimageinitrd-$(CONFIG_LITE5200)		:= zImage.initrd-STRIPELF
+         end-$(CONFIG_LITE5200)		:= lite5200
+   cacheflag-$(CONFIG_LITE5200)		:= -include $(clear_L2_L3)
+
+
 # SMP images should have a '.smp' suffix.
          end-$(CONFIG_SMP)             := $(end-y).smp
 
@@ -139,11 +145,12 @@
 boot-$(CONFIG_RPXCLASSIC)	+= iic.o pci.o qspan_pci.o
 boot-$(CONFIG_RPXLITE)		+= iic.o
 # Different boards need different serial implementations.
-ifeq ($(CONFIG_SERIAL_CONSOLE),y)
+ifeq ($(CONFIG_SERIAL_CPM_CONSOLE),y)
 boot-$(CONFIG_8xx)		+= m8xx_tty.o
 boot-$(CONFIG_8260)		+= m8260_tty.o
-boot-$(CONFIG_GT64260_CONSOLE)	+= gt64260_tty.o
 endif
+boot-$(CONFIG_SERIAL_MPC52xx_CONSOLE) += mpc52xx_tty.o
+boot-$(CONFIG_GT64260_CONSOLE)	+= gt64260_tty.o
 
 LIBS				:= $(common)/lib.a $(bootlib)/lib.a
 ifeq ($(CONFIG_PPC_PREP),y)
diff -urN linux-2.6.8-rc2/arch/ppc/boot/simple/embed_config.c linux-2.6.8-rc3/arch/ppc/boot/simple/embed_config.c
--- linux-2.6.8-rc2/arch/ppc/boot/simple/embed_config.c	2004-08-03 15:21:05.665452592 -0700
+++ linux-2.6.8-rc3/arch/ppc/boot/simple/embed_config.c	2004-08-03 15:21:33.590597929 -0700
@@ -97,7 +97,7 @@
 #endif /* CONFIG_MBX */
 
 #if defined(CONFIG_RPXLITE) || defined(CONFIG_RPXCLASSIC) || \
-	defined(CONFIG_RPX6) || defined(CONFIG_EP405)
+	defined(CONFIG_RPX8260) || defined(CONFIG_EP405)
 /* Helper functions for Embedded Planet boards.
 */
 /* Because I didn't find anything that would do this.......
@@ -147,7 +147,7 @@
 	}
 }
 
-#ifdef CONFIG_RPX6
+#ifdef CONFIG_RPX8260
 static uint
 rpx_baseten(u_char *cp)
 {
@@ -588,7 +588,7 @@
 }
 #endif /* SBS8260 */
 
-#ifdef CONFIG_RPX6
+#ifdef CONFIG_RPX8260
 void
 embed_config(bd_t **bdp)
 {
diff -urN linux-2.6.8-rc2/arch/ppc/boot/simple/head.S linux-2.6.8-rc3/arch/ppc/boot/simple/head.S
--- linux-2.6.8-rc2/arch/ppc/boot/simple/head.S	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/boot/simple/head.S	2004-08-03 15:21:33.590597929 -0700
@@ -57,7 +57,7 @@
 	isync
 #endif
 
-#if defined(CONFIG_MBX) || defined(CONFIG_RPX6) || defined(CONFIG_PPC_PREP)
+#if defined(CONFIG_MBX) || defined(CONFIG_RPX8260) || defined(CONFIG_PPC_PREP)
 	mr	r29,r3	/* On the MBX860, r3 is the board info pointer.
 			 * On the RPXSUPER, r3 points to the NVRAM
 			 * configuration keys.
@@ -129,7 +129,7 @@
 	mr	r3, r29
 #endif
 
-#if defined(CONFIG_MBX) || defined(CONFIG_RPX6) || defined(CONFIG_PPC_PREP)
+#if defined(CONFIG_MBX) || defined(CONFIG_RPX8260) || defined(CONFIG_PPC_PREP)
 	mr	r4,r29	/* put the board info pointer where the relocate
 			 * routine will find it
 			 */
diff -urN linux-2.6.8-rc2/arch/ppc/boot/simple/m8260_tty.c linux-2.6.8-rc3/arch/ppc/boot/simple/m8260_tty.c
--- linux-2.6.8-rc2/arch/ppc/boot/simple/m8260_tty.c	2004-08-03 15:21:05.666452633 -0700
+++ linux-2.6.8-rc3/arch/ppc/boot/simple/m8260_tty.c	2004-08-03 15:21:33.591597970 -0700
@@ -15,19 +15,22 @@
 /* If defined, enables serial console.  The value (1 through 4)
  * should designate which SCC is used, but this isn't complete.  Only
  * SCC1 is known to work at this time.
+ * We're only linked if SERIAL_CPM_CONSOLE=y, so we only need to test
+ * SERIAL_CPM_SCC1.
  */
-#ifdef CONFIG_SCC_CONSOLE
+#ifdef CONFIG_SERIAL_CPM_SCC1
 #define SCC_CONSOLE 1
 #endif
 
 unsigned long
 serial_init(int ignored, bd_t *bd)
 {
-	volatile smc_t		*sp;
-	volatile smc_uart_t	*up;
 #ifdef SCC_CONSOLE
 	volatile scc_t		*sccp;
 	volatile scc_uart_t	*sup;
+#else
+	volatile smc_t		*sp;
+	volatile smc_uart_t	*up;
 #endif
 	volatile cbd_t	*tbdf, *rbdf;
 	volatile cpm2_map_t	*ip;
@@ -222,8 +225,11 @@
 {
 	volatile cbd_t		*rbdf;
 	volatile char		*buf;
-	volatile smc_uart_t	*up;
+#ifdef SCC_CONSOLE
 	volatile scc_uart_t	*sup;
+#else
+	volatile smc_uart_t	*up;
+#endif
 	volatile cpm2_map_t	*ip;
 	int	i, nc;
 
@@ -254,10 +260,12 @@
 {
 	volatile cbd_t		*tbdf;
 	volatile char		*buf;
-	volatile smc_uart_t	*up;
+#ifdef SCC_CONSOLE
 	volatile scc_uart_t	*sup;
+#else
+	volatile smc_uart_t	*up;
+#endif
 	volatile cpm2_map_t	*ip;
-	extern bd_t		*board_info;
 
 	ip = (cpm2_map_t *)CPM_MAP_ADDR;
 #ifdef SCC_CONSOLE
@@ -297,8 +305,11 @@
 serial_tstc(void *ignored)
 {
 	volatile cbd_t		*rbdf;
-	volatile smc_uart_t	*up;
+#ifdef SCC_CONSOLE
 	volatile scc_uart_t	*sup;
+#else
+	volatile smc_uart_t	*up;
+#endif
 	volatile cpm2_map_t	*ip;
 
 	ip = (cpm2_map_t *)CPM_MAP_ADDR;
diff -urN linux-2.6.8-rc2/arch/ppc/boot/simple/misc-embedded.c linux-2.6.8-rc3/arch/ppc/boot/simple/misc-embedded.c
--- linux-2.6.8-rc2/arch/ppc/boot/simple/misc-embedded.c	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/boot/simple/misc-embedded.c	2004-08-03 15:21:33.591597970 -0700
@@ -83,7 +83,7 @@
 	 * initialize the serial console port.
 	 */
 	embed_config(&bp);
-#if defined(CONFIG_SERIAL_CONSOLE) || defined(CONFIG_SERIAL_8250_CONSOLE)
+#if defined(CONFIG_SERIAL_CPM_CONSOLE) || defined(CONFIG_SERIAL_8250_CONSOLE)
 	com_port = serial_init(0, bp);
 #endif
 
@@ -260,7 +260,9 @@
 		rec = (struct bi_record *)((unsigned long)rec + rec->size);
 	}
 	puts("Now booting the kernel\n");
+#if defined(CONFIG_SERIAL_CPM_CONSOLE) || defined(CONFIG_SERIAL_8250_CONSOLE)
 	serial_close(com_port);
+#endif
 
 	return (unsigned long)hold_residual;
 }
diff -urN linux-2.6.8-rc2/arch/ppc/boot/simple/misc.c linux-2.6.8-rc3/arch/ppc/boot/simple/misc.c
--- linux-2.6.8-rc2/arch/ppc/boot/simple/misc.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/boot/simple/misc.c	2004-08-03 15:21:33.592598011 -0700
@@ -221,7 +221,7 @@
 	puts("\n");
 
 	puts("Uncompressing Linux...");
-	gunzip(0, 0x400000, zimage_start, &zimage_size);
+	gunzip(NULL, 0x400000, zimage_start, &zimage_size);
 	puts("done.\n");
 
 	/* get the bi_rec address */
diff -urN linux-2.6.8-rc2/arch/ppc/boot/simple/mpc52xx_tty.c linux-2.6.8-rc3/arch/ppc/boot/simple/mpc52xx_tty.c
--- linux-2.6.8-rc2/arch/ppc/boot/simple/mpc52xx_tty.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc/boot/simple/mpc52xx_tty.c	2004-08-03 15:21:33.593598052 -0700
@@ -0,0 +1,138 @@
+/*
+ * arch/ppc/boot/simple/mpc52xx_tty.c
+ *
+ * Minimal serial functions needed to send messages out a MPC52xx
+ * Programmable Serial Controller (PSC).
+ *
+ * Author: Dale Farnsworth <dfarnsworth@mvista.com>
+ *
+ * 2003-2004 (c) MontaVista, Software, Inc.  This file is licensed under the
+ * terms of the GNU General Public License version 2.  This program is licensed
+ * "as is" without any warranty of any kind, whether express or implied.
+ */
+
+#include <linux/config.h>
+#include <linux/types.h>
+#include <asm/uaccess.h>
+#include <asm/mpc52xx.h>
+#include <asm/mpc52xx_psc.h>
+#include <asm/serial.h>
+#include <asm/time.h>
+
+#if MPC52xx_PF_CONSOLE_PORT == 0
+#define MPC52xx_CONSOLE		MPC52xx_PSC1
+#define MPC52xx_PSC_CONFIG_SHIFT	0
+#elif MPC52xx_PF_CONSOLE_PORT == 1
+#define MPC52xx_CONSOLE		MPC52xx_PSC2
+#define MPC52xx_PSC_CONFIG_SHIFT	4
+#elif MPC52xx_PF_CONSOLE_PORT == 2
+#define MPC52xx_CONSOLE		MPC52xx_PSC3
+#define MPC52xx_PSC_CONFIG_SHIFT	8
+#else
+#error "MPC52xx_PF_CONSOLE_PORT not defined"
+#endif
+
+static struct mpc52xx_psc *psc = (struct mpc52xx_psc *)MPC52xx_CONSOLE;
+
+/* The decrementer counts at the system bus clock frequency
+ * divided by four.  The most accurate time base is connected to the
+ * rtc.  We read the decrementer change during one rtc tick (one second)
+ * and multiply by 4 to get the system bus clock frequency.
+ */
+int
+mpc52xx_ipbfreq(void)
+{
+	struct mpc52xx_rtc *rtc = (struct mpc52xx_rtc*)MPC52xx_RTC;
+	struct mpc52xx_cdm *cdm = (struct mpc52xx_cdm*)MPC52xx_CDM;
+	int current_time, previous_time;
+	int tbl_start, tbl_end;
+	int xlbfreq, ipbfreq;
+
+	out_be32(&rtc->dividers, 0x8f1f0000);	/* Set RTC 64x faster */
+	previous_time = in_be32(&rtc->time);
+	while ((current_time = in_be32(&rtc->time)) == previous_time) ;
+	tbl_start = get_tbl();
+	previous_time = current_time;
+	while ((current_time = in_be32(&rtc->time)) == previous_time) ;
+	tbl_end = get_tbl();
+	out_be32(&rtc->dividers, 0xffff0000);   /* Restore RTC */
+
+	xlbfreq = (tbl_end - tbl_start) << 8;
+	ipbfreq = (in_8(&cdm->ipb_clk_sel) & 1) ? xlbfreq / 2 : xlbfreq;
+
+	return ipbfreq;
+}
+
+unsigned long
+serial_init(int ignored, void *ignored2)
+{
+	struct mpc52xx_gpio *gpio = (struct mpc52xx_gpio *)MPC52xx_GPIO;
+	int divisor;
+	int mode1;
+	int mode2;
+	u32 val32;
+
+	static int been_here = 0;
+
+	if (been_here)
+		return 0;
+
+	been_here = 1;
+
+	val32 = in_be32(&gpio->port_config);
+	val32 &= ~(0x7 << MPC52xx_PSC_CONFIG_SHIFT);
+	val32 |= MPC52xx_GPIO_PSC_CONFIG_UART_WITHOUT_CD
+				<< MPC52xx_PSC_CONFIG_SHIFT;
+	out_be32(&gpio->port_config, val32);
+
+	out_8(&psc->command, MPC52xx_PSC_RST_TX
+			| MPC52xx_PSC_RX_DISABLE | MPC52xx_PSC_TX_ENABLE);
+	out_8(&psc->command, MPC52xx_PSC_RST_RX);
+
+	out_be32(&psc->sicr, 0x0);
+	out_be16(&psc->mpc52xx_psc_clock_select, 0xdd00);
+	out_be16(&psc->tfalarm, 0xf8);
+
+	out_8(&psc->command, MPC52xx_PSC_SEL_MODE_REG_1
+			| MPC52xx_PSC_RX_ENABLE
+			| MPC52xx_PSC_TX_ENABLE);
+
+	divisor = ((mpc52xx_ipbfreq()
+			/ (CONFIG_SERIAL_MPC52xx_CONSOLE_BAUD * 16)) + 1) >> 1;
+
+	mode1 = MPC52xx_PSC_MODE_8_BITS | MPC52xx_PSC_MODE_PARNONE
+			| MPC52xx_PSC_MODE_ERR;
+	mode2 = MPC52xx_PSC_MODE_ONE_STOP;
+
+	out_8(&psc->ctur, divisor>>8);
+	out_8(&psc->ctlr, divisor);
+	out_8(&psc->command, MPC52xx_PSC_SEL_MODE_REG_1);
+	out_8(&psc->mode, mode1);
+	out_8(&psc->mode, mode2);
+
+	return 0;	/* ignored */
+}
+
+void
+serial_putc(void *ignored, const char c)
+{
+	serial_init(0, 0);
+
+	while (!(in_be16(&psc->mpc52xx_psc_status) & MPC52xx_PSC_SR_TXEMP)) ;
+	out_8(&psc->mpc52xx_psc_buffer_8, c);
+	while (!(in_be16(&psc->mpc52xx_psc_status) & MPC52xx_PSC_SR_TXEMP)) ;
+}
+
+char
+serial_getc(void *ignored)
+{
+	while (!(in_be16(&psc->mpc52xx_psc_status) & MPC52xx_PSC_SR_RXRDY)) ;
+
+	return in_8(&psc->mpc52xx_psc_buffer_8);
+}
+
+int
+serial_tstc(void *ignored)
+{
+	return (in_be16(&psc->mpc52xx_psc_status) & MPC52xx_PSC_SR_RXRDY) != 0;
+}
diff -urN linux-2.6.8-rc2/arch/ppc/configs/lite5200_defconfig linux-2.6.8-rc3/arch/ppc/configs/lite5200_defconfig
--- linux-2.6.8-rc2/arch/ppc/configs/lite5200_defconfig	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc/configs/lite5200_defconfig	2004-08-03 15:21:33.596598175 -0700
@@ -0,0 +1,436 @@
+#
+# Automatically generated make config: don't edit
+#
+CONFIG_MMU=y
+CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_HAVE_DEC_LOCK=y
+CONFIG_PPC=y
+CONFIG_PPC32=y
+CONFIG_GENERIC_NVRAM=y
+#
+# Code maturity level options
+#
+CONFIG_EXPERIMENTAL=y
+CONFIG_CLEAN_COMPILE=y
+CONFIG_STANDALONE=y
+CONFIG_BROKEN_ON_SMP=y
+#
+# General setup
+#
+CONFIG_SWAP=y
+CONFIG_SYSVIPC=y
+# CONFIG_BSD_PROCESS_ACCT is not set
+CONFIG_SYSCTL=y
+# CONFIG_AUDIT is not set
+CONFIG_LOG_BUF_SHIFT=14
+# CONFIG_HOTPLUG is not set
+# CONFIG_IKCONFIG is not set
+# CONFIG_EMBEDDED is not set
+CONFIG_KALLSYMS=y
+# CONFIG_KALLSYMS_ALL is not set
+# CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_FUTEX=y
+CONFIG_EPOLL=y
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_AS=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_CFQ=y
+# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+#
+# Loadable module support
+#
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_MODULE_FORCE_UNLOAD is not set
+CONFIG_OBSOLETE_MODPARM=y
+CONFIG_MODVERSIONS=y
+CONFIG_KMOD=y
+#
+# Processor
+#
+CONFIG_6xx=y
+# CONFIG_40x is not set
+# CONFIG_44x is not set
+# CONFIG_POWER3 is not set
+# CONFIG_POWER4 is not set
+# CONFIG_8xx is not set
+# CONFIG_E500 is not set
+# CONFIG_ALTIVEC is not set
+# CONFIG_TAU is not set
+# CONFIG_CPU_FREQ is not set
+CONFIG_FSL_OCP=y
+CONFIG_PPC_STD_MMU=y
+#
+# Platform options
+#
+# CONFIG_PPC_MULTIPLATFORM is not set
+# CONFIG_APUS is not set
+# CONFIG_WILLOW is not set
+# CONFIG_PCORE is not set
+# CONFIG_POWERPMC250 is not set
+# CONFIG_EV64260 is not set
+# CONFIG_SPRUCE is not set
+# CONFIG_LOPEC is not set
+# CONFIG_MCPN765 is not set
+# CONFIG_MVME5100 is not set
+# CONFIG_PPLUS is not set
+# CONFIG_PRPMC750 is not set
+# CONFIG_PRPMC800 is not set
+# CONFIG_SANDPOINT is not set
+# CONFIG_ADIR is not set
+# CONFIG_K2 is not set
+# CONFIG_PAL4 is not set
+# CONFIG_GEMINI is not set
+# CONFIG_EST8260 is not set
+# CONFIG_SBC82xx is not set
+# CONFIG_SBS8260 is not set
+# CONFIG_RPX6 is not set
+# CONFIG_TQM8260 is not set
+# CONFIG_ADS8272 is not set
+CONFIG_LITE5200=y
+CONFIG_PPC_MPC52xx=y
+# CONFIG_SMP is not set
+# CONFIG_PREEMPT is not set
+# CONFIG_HIGHMEM is not set
+CONFIG_KERNEL_ELF=y
+CONFIG_BINFMT_ELF=y
+# CONFIG_BINFMT_MISC is not set
+CONFIG_CMDLINE_BOOL=y
+CONFIG_CMDLINE="console=ttyS0 root=/dev/ram0 rw"
+#
+# Bus options
+#
+CONFIG_GENERIC_ISA_DMA=y
+CONFIG_PCI=y
+CONFIG_PCI_DOMAINS=y
+# CONFIG_PCI_LEGACY_PROC is not set
+# CONFIG_PCI_NAMES is not set
+#
+# Advanced setup
+#
+CONFIG_ADVANCED_OPTIONS=y
+CONFIG_HIGHMEM_START=0xfe000000
+# CONFIG_LOWMEM_SIZE_BOOL is not set
+CONFIG_LOWMEM_SIZE=0x30000000
+# CONFIG_KERNEL_START_BOOL is not set
+CONFIG_KERNEL_START=0xc0000000
+# CONFIG_TASK_SIZE_BOOL is not set
+CONFIG_TASK_SIZE=0x80000000
+# CONFIG_BOOT_LOAD_BOOL is not set
+CONFIG_BOOT_LOAD=0x00800000
+#
+# Device Drivers
+#
+#
+# Generic Driver Options
+#
+CONFIG_PREVENT_FIRMWARE_BUILD=y
+# CONFIG_DEBUG_DRIVER is not set
+#
+# Memory Technology Devices (MTD)
+#
+# CONFIG_MTD is not set
+#
+# Parallel port support
+#
+# CONFIG_PARPORT is not set
+#
+# Plug and Play support
+#
+#
+# Block devices
+#
+# CONFIG_BLK_DEV_FD is not set
+# CONFIG_BLK_CPQ_DA is not set
+# CONFIG_BLK_CPQ_CISS_DA is not set
+# CONFIG_BLK_DEV_DAC960 is not set
+# CONFIG_BLK_DEV_UMEM is not set
+# CONFIG_BLK_DEV_LOOP is not set
+# CONFIG_BLK_DEV_SX8 is not set
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_INITRD=y
+# CONFIG_LBD is not set
+#
+# ATA/ATAPI/MFM/RLL support
+#
+# CONFIG_IDE is not set
+#
+# SCSI device support
+#
+# CONFIG_SCSI is not set
+#
+# Multi-device support (RAID and LVM)
+#
+# CONFIG_MD is not set
+#
+# Fusion MPT device support
+#
+#
+# IEEE 1394 (FireWire) support
+#
+# CONFIG_IEEE1394 is not set
+#
+# I2O device support
+#
+# CONFIG_I2O is not set
+#
+# Macintosh device drivers
+#
+#
+# Networking support
+#
+# CONFIG_NET is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
+#
+# ISDN subsystem
+#
+#
+# Telephony Support
+#
+# CONFIG_PHONE is not set
+#
+# Input device support
+#
+CONFIG_INPUT=y
+#
+# Userland interfaces
+#
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_MOUSEDEV_PSAUX=y
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+# CONFIG_INPUT_JOYDEV is not set
+# CONFIG_INPUT_TSDEV is not set
+CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_EVBUG=y
+#
+# Input I/O drivers
+#
+# CONFIG_GAMEPORT is not set
+CONFIG_SOUND_GAMEPORT=y
+CONFIG_SERIO=y
+# CONFIG_SERIO_I8042 is not set
+CONFIG_SERIO_SERPORT=y
+# CONFIG_SERIO_CT82C710 is not set
+# CONFIG_SERIO_PCIPS2 is not set
+#
+# Input Device Drivers
+#
+# CONFIG_INPUT_KEYBOARD is not set
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_INPUT_JOYSTICK is not set
+# CONFIG_INPUT_TOUCHSCREEN is not set
+# CONFIG_INPUT_MISC is not set
+#
+# Character devices
+#
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_HW_CONSOLE=y
+# CONFIG_SERIAL_NONSTANDARD is not set
+#
+# Serial drivers
+#
+# CONFIG_SERIAL_8250 is not set
+#
+# Non-8250 serial port support
+#
+CONFIG_SERIAL_CORE=y
+CONFIG_SERIAL_CORE_CONSOLE=y
+CONFIG_SERIAL_MPC52xx=y
+CONFIG_SERIAL_MPC52xx_CONSOLE=y
+CONFIG_SERIAL_MPC52xx_CONSOLE_BAUD=9600
+CONFIG_UNIX98_PTYS=y
+CONFIG_LEGACY_PTYS=y
+CONFIG_LEGACY_PTY_COUNT=256
+# CONFIG_QIC02_TAPE is not set
+#
+# IPMI
+#
+# CONFIG_IPMI_HANDLER is not set
+#
+# Watchdog Cards
+#
+# CONFIG_WATCHDOG is not set
+# CONFIG_NVRAM is not set
+# CONFIG_GEN_RTC is not set
+# CONFIG_DTLK is not set
+# CONFIG_R3964 is not set
+# CONFIG_APPLICOM is not set
+#
+# Ftape, the floppy tape device driver
+#
+# CONFIG_FTAPE is not set
+# CONFIG_AGP is not set
+# CONFIG_DRM is not set
+# CONFIG_RAW_DRIVER is not set
+#
+# I2C support
+#
+# CONFIG_I2C is not set
+#
+# Misc devices
+#
+#
+# Multimedia devices
+#
+# CONFIG_VIDEO_DEV is not set
+#
+# Digital Video Broadcasting Devices
+#
+#
+# Graphics support
+#
+# CONFIG_FB is not set
+#
+# Console display driver support
+#
+CONFIG_VGA_CONSOLE=y
+# CONFIG_MDA_CONSOLE is not set
+CONFIG_DUMMY_CONSOLE=y
+#
+# Sound
+#
+# CONFIG_SOUND is not set
+#
+# USB support
+#
+# CONFIG_USB is not set
+#
+# USB Gadget Support
+#
+# CONFIG_USB_GADGET is not set
+#
+# File systems
+#
+CONFIG_EXT2_FS=y
+# CONFIG_EXT2_FS_XATTR is not set
+# CONFIG_EXT3_FS is not set
+# CONFIG_JBD is not set
+# CONFIG_REISERFS_FS is not set
+# CONFIG_JFS_FS is not set
+# CONFIG_XFS_FS is not set
+# CONFIG_MINIX_FS is not set
+# CONFIG_ROMFS_FS is not set
+# CONFIG_QUOTA is not set
+# CONFIG_AUTOFS_FS is not set
+# CONFIG_AUTOFS4_FS is not set
+#
+# CD-ROM/DVD Filesystems
+#
+# CONFIG_ISO9660_FS is not set
+# CONFIG_UDF_FS is not set
+#
+# DOS/FAT/NT Filesystems
+#
+# CONFIG_FAT_FS is not set
+# CONFIG_NTFS_FS is not set
+#
+# Pseudo filesystems
+#
+CONFIG_PROC_FS=y
+CONFIG_PROC_KCORE=y
+CONFIG_SYSFS=y
+# CONFIG_DEVFS_FS is not set
+# CONFIG_DEVPTS_FS_XATTR is not set
+CONFIG_TMPFS=y
+# CONFIG_HUGETLB_PAGE is not set
+CONFIG_RAMFS=y
+#
+# Miscellaneous filesystems
+#
+# CONFIG_ADFS_FS is not set
+# CONFIG_AFFS_FS is not set
+# CONFIG_HFS_FS is not set
+# CONFIG_HFSPLUS_FS is not set
+# CONFIG_BEFS_FS is not set
+# CONFIG_BFS_FS is not set
+# CONFIG_EFS_FS is not set
+# CONFIG_CRAMFS is not set
+# CONFIG_VXFS_FS is not set
+# CONFIG_HPFS_FS is not set
+# CONFIG_QNX4FS_FS is not set
+# CONFIG_SYSV_FS is not set
+# CONFIG_UFS_FS is not set
+#
+# Partition Types
+#
+# CONFIG_PARTITION_ADVANCED is not set
+CONFIG_MSDOS_PARTITION=y
+#
+# Native Language Support
+#
+CONFIG_NLS=y
+CONFIG_NLS_DEFAULT="iso8859-1"
+# CONFIG_NLS_CODEPAGE_437 is not set
+# CONFIG_NLS_CODEPAGE_737 is not set
+# CONFIG_NLS_CODEPAGE_775 is not set
+# CONFIG_NLS_CODEPAGE_850 is not set
+# CONFIG_NLS_CODEPAGE_852 is not set
+# CONFIG_NLS_CODEPAGE_855 is not set
+# CONFIG_NLS_CODEPAGE_857 is not set
+# CONFIG_NLS_CODEPAGE_860 is not set
+# CONFIG_NLS_CODEPAGE_861 is not set
+# CONFIG_NLS_CODEPAGE_862 is not set
+# CONFIG_NLS_CODEPAGE_863 is not set
+# CONFIG_NLS_CODEPAGE_864 is not set
+# CONFIG_NLS_CODEPAGE_865 is not set
+# CONFIG_NLS_CODEPAGE_866 is not set
+# CONFIG_NLS_CODEPAGE_869 is not set
+# CONFIG_NLS_CODEPAGE_936 is not set
+# CONFIG_NLS_CODEPAGE_950 is not set
+# CONFIG_NLS_CODEPAGE_932 is not set
+# CONFIG_NLS_CODEPAGE_949 is not set
+# CONFIG_NLS_CODEPAGE_874 is not set
+# CONFIG_NLS_ISO8859_8 is not set
+# CONFIG_NLS_CODEPAGE_1250 is not set
+# CONFIG_NLS_CODEPAGE_1251 is not set
+# CONFIG_NLS_ASCII is not set
+CONFIG_NLS_ISO8859_1=m
+# CONFIG_NLS_ISO8859_2 is not set
+# CONFIG_NLS_ISO8859_3 is not set
+# CONFIG_NLS_ISO8859_4 is not set
+# CONFIG_NLS_ISO8859_5 is not set
+# CONFIG_NLS_ISO8859_6 is not set
+# CONFIG_NLS_ISO8859_7 is not set
+# CONFIG_NLS_ISO8859_9 is not set
+# CONFIG_NLS_ISO8859_13 is not set
+# CONFIG_NLS_ISO8859_14 is not set
+# CONFIG_NLS_ISO8859_15 is not set
+# CONFIG_NLS_KOI8_R is not set
+# CONFIG_NLS_KOI8_U is not set
+# CONFIG_NLS_UTF8 is not set
+#
+# Library routines
+#
+# CONFIG_CRC16 is not set
+# CONFIG_CRC32 is not set
+# CONFIG_LIBCRC32C is not set
+#
+# Profiling support
+#
+# CONFIG_PROFILING is not set
+#
+# Kernel hacking
+#
+CONFIG_DEBUG_KERNEL=y
+# CONFIG_DEBUG_SLAB is not set
+CONFIG_MAGIC_SYSRQ=y
+# CONFIG_DEBUG_SPINLOCK is not set
+CONFIG_DEBUG_SPINLOCK_SLEEP=y
+# CONFIG_KGDB is not set
+# CONFIG_XMON is not set
+# CONFIG_BDI_SWITCH is not set
+CONFIG_DEBUG_INFO=y
+CONFIG_SERIAL_TEXT_DEBUG=y
+CONFIG_PPC_OCP=y
+#
+# Security options
+#
+# CONFIG_SECURITY is not set
+#
+# Cryptographic options
+#
+# CONFIG_CRYPTO is not set
diff -urN linux-2.6.8-rc2/arch/ppc/configs/rpx8260_defconfig linux-2.6.8-rc3/arch/ppc/configs/rpx8260_defconfig
--- linux-2.6.8-rc2/arch/ppc/configs/rpx8260_defconfig	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc/configs/rpx8260_defconfig	2004-08-03 15:21:33.598598257 -0700
@@ -0,0 +1,556 @@
+#
+# Automatically generated make config: don't edit
+#
+CONFIG_MMU=y
+CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_HAVE_DEC_LOCK=y
+CONFIG_PPC=y
+CONFIG_PPC32=y
+CONFIG_GENERIC_NVRAM=y
+
+#
+# Code maturity level options
+#
+CONFIG_EXPERIMENTAL=y
+CONFIG_CLEAN_COMPILE=y
+CONFIG_STANDALONE=y
+CONFIG_BROKEN_ON_SMP=y
+
+#
+# General setup
+#
+# CONFIG_SWAP is not set
+CONFIG_SYSVIPC=y
+# CONFIG_POSIX_MQUEUE is not set
+# CONFIG_BSD_PROCESS_ACCT is not set
+CONFIG_SYSCTL=y
+# CONFIG_AUDIT is not set
+CONFIG_LOG_BUF_SHIFT=14
+# CONFIG_HOTPLUG is not set
+# CONFIG_IKCONFIG is not set
+CONFIG_EMBEDDED=y
+# CONFIG_KALLSYMS is not set
+CONFIG_FUTEX=y
+# CONFIG_EPOLL is not set
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_AS=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_CFQ=y
+# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+
+#
+# Loadable module support
+#
+# CONFIG_MODULES is not set
+
+#
+# Processor
+#
+CONFIG_6xx=y
+# CONFIG_40x is not set
+# CONFIG_44x is not set
+# CONFIG_POWER3 is not set
+# CONFIG_POWER4 is not set
+# CONFIG_8xx is not set
+# CONFIG_E500 is not set
+# CONFIG_CPU_FREQ is not set
+CONFIG_EMBEDDEDBOOT=y
+CONFIG_PPC_STD_MMU=y
+
+#
+# Platform options
+#
+# CONFIG_PPC_MULTIPLATFORM is not set
+# CONFIG_APUS is not set
+# CONFIG_WILLOW is not set
+# CONFIG_PCORE is not set
+# CONFIG_POWERPMC250 is not set
+# CONFIG_EV64260 is not set
+# CONFIG_SPRUCE is not set
+# CONFIG_LOPEC is not set
+# CONFIG_MCPN765 is not set
+# CONFIG_MVME5100 is not set
+# CONFIG_PPLUS is not set
+# CONFIG_PRPMC750 is not set
+# CONFIG_PRPMC800 is not set
+# CONFIG_SANDPOINT is not set
+# CONFIG_ADIR is not set
+# CONFIG_K2 is not set
+# CONFIG_PAL4 is not set
+# CONFIG_GEMINI is not set
+# CONFIG_EST8260 is not set
+# CONFIG_SBC82xx is not set
+# CONFIG_SBS8260 is not set
+CONFIG_RPX8260=y
+# CONFIG_TQM8260 is not set
+# CONFIG_ADS8272 is not set
+CONFIG_8260=y
+CONFIG_CPM2=y
+# CONFIG_PC_KEYBOARD is not set
+# CONFIG_SMP is not set
+# CONFIG_PREEMPT is not set
+# CONFIG_HIGHMEM is not set
+CONFIG_KERNEL_ELF=y
+CONFIG_BINFMT_ELF=y
+# CONFIG_BINFMT_MISC is not set
+# CONFIG_CMDLINE_BOOL is not set
+
+#
+# Bus options
+#
+# CONFIG_PCI is not set
+# CONFIG_PCI_DOMAINS is not set
+
+#
+# Advanced setup
+#
+# CONFIG_ADVANCED_OPTIONS is not set
+
+#
+# Default settings for advanced configuration options are used
+#
+CONFIG_HIGHMEM_START=0xfe000000
+CONFIG_LOWMEM_SIZE=0x30000000
+CONFIG_KERNEL_START=0xc0000000
+CONFIG_TASK_SIZE=0x80000000
+CONFIG_BOOT_LOAD=0x00400000
+
+#
+# Device Drivers
+#
+
+#
+# Generic Driver Options
+#
+CONFIG_PREVENT_FIRMWARE_BUILD=y
+
+#
+# Memory Technology Devices (MTD)
+#
+# CONFIG_MTD is not set
+
+#
+# Parallel port support
+#
+# CONFIG_PARPORT is not set
+
+#
+# Plug and Play support
+#
+
+#
+# Block devices
+#
+# CONFIG_BLK_DEV_FD is not set
+CONFIG_BLK_DEV_LOOP=y
+# CONFIG_BLK_DEV_CRYPTOLOOP is not set
+# CONFIG_BLK_DEV_NBD is not set
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_INITRD=y
+# CONFIG_LBD is not set
+
+#
+# ATA/ATAPI/MFM/RLL support
+#
+# CONFIG_IDE is not set
+
+#
+# SCSI device support
+#
+# CONFIG_SCSI is not set
+
+#
+# Multi-device support (RAID and LVM)
+#
+# CONFIG_MD is not set
+
+#
+# Fusion MPT device support
+#
+
+#
+# IEEE 1394 (FireWire) support
+#
+# CONFIG_IEEE1394 is not set
+
+#
+# I2O device support
+#
+
+#
+# Macintosh device drivers
+#
+
+#
+# Networking support
+#
+CONFIG_NET=y
+
+#
+# Networking options
+#
+CONFIG_PACKET=y
+# CONFIG_PACKET_MMAP is not set
+# CONFIG_NETLINK_DEV is not set
+CONFIG_UNIX=y
+# CONFIG_NET_KEY is not set
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+# CONFIG_IP_ADVANCED_ROUTER is not set
+CONFIG_IP_PNP=y
+# CONFIG_IP_PNP_DHCP is not set
+CONFIG_IP_PNP_BOOTP=y
+# CONFIG_IP_PNP_RARP is not set
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPGRE is not set
+# CONFIG_IP_MROUTE is not set
+# CONFIG_ARPD is not set
+CONFIG_SYN_COOKIES=y
+# CONFIG_INET_AH is not set
+# CONFIG_INET_ESP is not set
+# CONFIG_INET_IPCOMP is not set
+# CONFIG_IPV6 is not set
+# CONFIG_NETFILTER is not set
+
+#
+# SCTP Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_SCTP is not set
+# CONFIG_ATM is not set
+# CONFIG_BRIDGE is not set
+# CONFIG_VLAN_8021Q is not set
+# CONFIG_DECNET is not set
+# CONFIG_LLC2 is not set
+# CONFIG_IPX is not set
+# CONFIG_ATALK is not set
+# CONFIG_X25 is not set
+# CONFIG_LAPB is not set
+# CONFIG_NET_DIVERT is not set
+# CONFIG_ECONET is not set
+# CONFIG_WAN_ROUTER is not set
+# CONFIG_NET_FASTROUTE is not set
+# CONFIG_NET_HW_FLOWCONTROL is not set
+
+#
+# QoS and/or fair queueing
+#
+# CONFIG_NET_SCHED is not set
+# CONFIG_NET_CLS_ROUTE is not set
+
+#
+# Network testing
+#
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
+# CONFIG_HAMRADIO is not set
+# CONFIG_IRDA is not set
+# CONFIG_BT is not set
+CONFIG_NETDEVICES=y
+# CONFIG_DUMMY is not set
+# CONFIG_BONDING is not set
+# CONFIG_EQUALIZER is not set
+# CONFIG_TUN is not set
+
+#
+# Ethernet (10 or 100Mbit)
+#
+CONFIG_NET_ETHERNET=y
+# CONFIG_MII is not set
+# CONFIG_OAKNET is not set
+
+#
+# Ethernet (1000 Mbit)
+#
+
+#
+# Ethernet (10000 Mbit)
+#
+
+#
+# Token Ring devices
+#
+
+#
+# Wireless LAN (non-hamradio)
+#
+# CONFIG_NET_RADIO is not set
+
+#
+# Wan interfaces
+#
+# CONFIG_WAN is not set
+# CONFIG_PPP is not set
+# CONFIG_SLIP is not set
+# CONFIG_SHAPER is not set
+# CONFIG_NETCONSOLE is not set
+
+#
+# ISDN subsystem
+#
+# CONFIG_ISDN is not set
+
+#
+# Telephony Support
+#
+# CONFIG_PHONE is not set
+
+#
+# Input device support
+#
+# CONFIG_INPUT is not set
+
+#
+# Userland interfaces
+#
+
+#
+# Input I/O drivers
+#
+# CONFIG_GAMEPORT is not set
+CONFIG_SOUND_GAMEPORT=y
+# CONFIG_SERIO is not set
+# CONFIG_SERIO_I8042 is not set
+
+#
+# Input Device Drivers
+#
+
+#
+# Character devices
+#
+# CONFIG_VT is not set
+# CONFIG_SERIAL_NONSTANDARD is not set
+
+#
+# Serial drivers
+#
+# CONFIG_SERIAL_8250 is not set
+
+#
+# Non-8250 serial port support
+#
+CONFIG_SERIAL_CORE=y
+CONFIG_SERIAL_CORE_CONSOLE=y
+CONFIG_SERIAL_CPM=y
+CONFIG_SERIAL_CPM_CONSOLE=y
+# CONFIG_SERIAL_CPM_SCC1 is not set
+# CONFIG_SERIAL_CPM_SCC2 is not set
+# CONFIG_SERIAL_CPM_SCC3 is not set
+# CONFIG_SERIAL_CPM_SCC4 is not set
+CONFIG_SERIAL_CPM_SMC1=y
+# CONFIG_SERIAL_CPM_SMC2 is not set
+CONFIG_UNIX98_PTYS=y
+CONFIG_LEGACY_PTYS=y
+CONFIG_LEGACY_PTY_COUNT=256
+# CONFIG_QIC02_TAPE is not set
+
+#
+# IPMI
+#
+# CONFIG_IPMI_HANDLER is not set
+
+#
+# Watchdog Cards
+#
+# CONFIG_WATCHDOG is not set
+# CONFIG_NVRAM is not set
+# CONFIG_GEN_RTC is not set
+# CONFIG_DTLK is not set
+# CONFIG_R3964 is not set
+# CONFIG_APPLICOM is not set
+
+#
+# Ftape, the floppy tape device driver
+#
+# CONFIG_FTAPE is not set
+# CONFIG_AGP is not set
+# CONFIG_DRM is not set
+# CONFIG_RAW_DRIVER is not set
+
+#
+# I2C support
+#
+# CONFIG_I2C is not set
+
+#
+# Dallas's 1-wire bus
+#
+# CONFIG_W1 is not set
+
+#
+# Misc devices
+#
+
+#
+# Multimedia devices
+#
+# CONFIG_VIDEO_DEV is not set
+
+#
+# Digital Video Broadcasting Devices
+#
+# CONFIG_DVB is not set
+
+#
+# Graphics support
+#
+# CONFIG_FB is not set
+
+#
+# Sound
+#
+# CONFIG_SOUND is not set
+
+#
+# USB support
+#
+
+#
+# USB Gadget Support
+#
+# CONFIG_USB_GADGET is not set
+
+#
+# File systems
+#
+CONFIG_EXT2_FS=y
+# CONFIG_EXT2_FS_XATTR is not set
+CONFIG_EXT3_FS=y
+CONFIG_EXT3_FS_XATTR=y
+# CONFIG_EXT3_FS_POSIX_ACL is not set
+# CONFIG_EXT3_FS_SECURITY is not set
+CONFIG_JBD=y
+# CONFIG_JBD_DEBUG is not set
+CONFIG_FS_MBCACHE=y
+# CONFIG_REISERFS_FS is not set
+# CONFIG_JFS_FS is not set
+# CONFIG_XFS_FS is not set
+# CONFIG_MINIX_FS is not set
+# CONFIG_ROMFS_FS is not set
+# CONFIG_QUOTA is not set
+# CONFIG_AUTOFS_FS is not set
+# CONFIG_AUTOFS4_FS is not set
+
+#
+# CD-ROM/DVD Filesystems
+#
+# CONFIG_ISO9660_FS is not set
+# CONFIG_UDF_FS is not set
+
+#
+# DOS/FAT/NT Filesystems
+#
+# CONFIG_MSDOS_FS is not set
+# CONFIG_VFAT_FS is not set
+# CONFIG_NTFS_FS is not set
+
+#
+# Pseudo filesystems
+#
+CONFIG_PROC_FS=y
+CONFIG_PROC_KCORE=y
+CONFIG_SYSFS=y
+# CONFIG_DEVFS_FS is not set
+# CONFIG_DEVPTS_FS_XATTR is not set
+CONFIG_TMPFS=y
+# CONFIG_HUGETLB_PAGE is not set
+CONFIG_RAMFS=y
+
+#
+# Miscellaneous filesystems
+#
+# CONFIG_ADFS_FS is not set
+# CONFIG_AFFS_FS is not set
+# CONFIG_HFS_FS is not set
+# CONFIG_HFSPLUS_FS is not set
+# CONFIG_BEFS_FS is not set
+# CONFIG_BFS_FS is not set
+# CONFIG_EFS_FS is not set
+# CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
+# CONFIG_CRAMFS is not set
+# CONFIG_VXFS_FS is not set
+# CONFIG_HPFS_FS is not set
+# CONFIG_QNX4FS_FS is not set
+# CONFIG_SYSV_FS is not set
+# CONFIG_UFS_FS is not set
+
+#
+# Network File Systems
+#
+CONFIG_NFS_FS=y
+CONFIG_NFS_V3=y
+# CONFIG_NFS_V4 is not set
+# CONFIG_NFS_DIRECTIO is not set
+# CONFIG_NFSD is not set
+CONFIG_ROOT_NFS=y
+CONFIG_LOCKD=y
+CONFIG_LOCKD_V4=y
+# CONFIG_EXPORTFS is not set
+CONFIG_SUNRPC=y
+# CONFIG_RPCSEC_GSS_KRB5 is not set
+# CONFIG_SMB_FS is not set
+# CONFIG_CIFS is not set
+# CONFIG_NCP_FS is not set
+# CONFIG_CODA_FS is not set
+# CONFIG_AFS_FS is not set
+
+#
+# Partition Types
+#
+CONFIG_PARTITION_ADVANCED=y
+# CONFIG_ACORN_PARTITION is not set
+# CONFIG_OSF_PARTITION is not set
+# CONFIG_AMIGA_PARTITION is not set
+# CONFIG_ATARI_PARTITION is not set
+# CONFIG_MAC_PARTITION is not set
+# CONFIG_MSDOS_PARTITION is not set
+# CONFIG_LDM_PARTITION is not set
+# CONFIG_SGI_PARTITION is not set
+# CONFIG_ULTRIX_PARTITION is not set
+# CONFIG_SUN_PARTITION is not set
+# CONFIG_EFI_PARTITION is not set
+
+#
+# Native Language Support
+#
+# CONFIG_NLS is not set
+# CONFIG_SCC_ENET is not set
+CONFIG_FEC_ENET=y
+# CONFIG_USE_MDIO is not set
+
+#
+# CPM2 Options
+#
+# CONFIG_FCC1_ENET is not set
+# CONFIG_FCC2_ENET is not set
+CONFIG_FCC3_ENET=y
+
+#
+# Library routines
+#
+# CONFIG_CRC_CCITT is not set
+# CONFIG_CRC32 is not set
+# CONFIG_LIBCRC32C is not set
+
+#
+# Profiling support
+#
+# CONFIG_PROFILING is not set
+
+#
+# Kernel hacking
+#
+# CONFIG_DEBUG_KERNEL is not set
+# CONFIG_KGDB_CONSOLE is not set
+
+#
+# Security options
+#
+# CONFIG_SECURITY is not set
+
+#
+# Cryptographic options
+#
+# CONFIG_CRYPTO is not set
diff -urN linux-2.6.8-rc2/arch/ppc/defconfig linux-2.6.8-rc3/arch/ppc/defconfig
--- linux-2.6.8-rc2/arch/ppc/defconfig	2004-08-03 15:21:05.670452797 -0700
+++ linux-2.6.8-rc3/arch/ppc/defconfig	2004-08-03 15:21:33.599598298 -0700
@@ -689,7 +689,7 @@
 # Input Device Drivers
 #
 CONFIG_INPUT_KEYBOARD=y
-# CONFIG_KEYBOARD_ATKBD is not set
+CONFIG_KEYBOARD_ATKBD=y
 # CONFIG_KEYBOARD_SUNKBD is not set
 # CONFIG_KEYBOARD_LKKBD is not set
 # CONFIG_KEYBOARD_XTKBD is not set
@@ -724,8 +724,8 @@
 #
 # Non-8250 serial port support
 #
-# CONFIG_SERIAL_CORE is not set
-# CONFIG_SERIAL_PMACZILOG is not set
+CONFIG_SERIAL_CORE=y
+CONFIG_SERIAL_PMACZILOG=y
 # CONFIG_SERIAL_PMACZILOG_CONSOLE is not set
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
diff -urN linux-2.6.8-rc2/arch/ppc/kernel/cpu_setup_6xx.S linux-2.6.8-rc3/arch/ppc/kernel/cpu_setup_6xx.S
--- linux-2.6.8-rc2/arch/ppc/kernel/cpu_setup_6xx.S	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/kernel/cpu_setup_6xx.S	2004-08-03 15:21:33.659600759 -0700
@@ -218,7 +218,10 @@
 
 	/* All of the bits we have to set.....
 	 */
-	ori	r11,r11,HID0_SGE | HID0_FOLD | HID0_BHTE | HID0_BTIC | HID0_LRSTK
+	ori	r11,r11,HID0_SGE | HID0_FOLD | HID0_BHTE | HID0_LRSTK
+BEGIN_FTR_SECTION
+	ori	r11,r11,HID0_BTIC
+END_FTR_SECTION_IFCLR(CPU_FTR_NO_BTIC)
 BEGIN_FTR_SECTION
 	oris	r11,r11,HID0_DPM@h	/* enable dynamic power mgmt */
 END_FTR_SECTION_IFCLR(CPU_FTR_NO_DPM)
diff -urN linux-2.6.8-rc2/arch/ppc/kernel/cputable.c linux-2.6.8-rc3/arch/ppc/kernel/cputable.c
--- linux-2.6.8-rc2/arch/ppc/kernel/cputable.c	2004-08-03 15:21:05.672452879 -0700
+++ linux-2.6.8-rc3/arch/ppc/kernel/cputable.c	2004-08-03 15:21:33.680601621 -0700
@@ -55,7 +55,8 @@
 #endif
 
 /* We need to mark all pages as being coherent if we're SMP or we
- * have a 754x and an MPC107 host bridge. */
+ * have a 754x and an MPC107 host bridge.
+ */
 #if defined(CONFIG_SMP) || defined(CONFIG_MPC10X_BRIDGE)
 #define CPU_FTR_COMMON                  CPU_FTR_NEED_COHERENT
 #else
@@ -263,7 +264,7 @@
 	CPU_FTR_COMMON |
     	CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_USE_TB |
 	CPU_FTR_L2CR | CPU_FTR_ALTIVEC_COMP | CPU_FTR_L3CR |
-	CPU_FTR_HPTE_TABLE | CPU_FTR_SPEC7450,
+	CPU_FTR_HPTE_TABLE | CPU_FTR_SPEC7450 | CPU_FTR_NEED_COHERENT,
 	COMMON_PPC | PPC_FEATURE_ALTIVEC_COMP,
 	32, 32,
 	__setup_cpu_745x
@@ -274,7 +275,7 @@
     	CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_USE_TB | CPU_FTR_CAN_NAP |
 	CPU_FTR_L2CR | CPU_FTR_ALTIVEC_COMP | CPU_FTR_L3CR |
 	CPU_FTR_HPTE_TABLE | CPU_FTR_SPEC7450 | CPU_FTR_NAP_DISABLE_L2_PR |
-	CPU_FTR_L3_DISABLE_NAP,
+	CPU_FTR_L3_DISABLE_NAP | CPU_FTR_NEED_COHERENT,
 	COMMON_PPC | PPC_FEATURE_ALTIVEC_COMP,
 	32, 32,
 	__setup_cpu_745x
@@ -284,7 +285,8 @@
 	CPU_FTR_COMMON |
     	CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_USE_TB | CPU_FTR_CAN_NAP |
 	CPU_FTR_L2CR | CPU_FTR_ALTIVEC_COMP | CPU_FTR_L3CR |
-	CPU_FTR_HPTE_TABLE | CPU_FTR_SPEC7450 | CPU_FTR_NAP_DISABLE_L2_PR,
+	CPU_FTR_HPTE_TABLE | CPU_FTR_SPEC7450 | CPU_FTR_NAP_DISABLE_L2_PR |
+	CPU_FTR_NEED_COHERENT,
 	COMMON_PPC | PPC_FEATURE_ALTIVEC_COMP,
 	32, 32,
 	__setup_cpu_745x
@@ -294,7 +296,8 @@
 	CPU_FTR_COMMON |
     	CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_USE_TB |
 	CPU_FTR_L2CR | CPU_FTR_ALTIVEC_COMP | CPU_FTR_L3CR |
-	CPU_FTR_HPTE_TABLE | CPU_FTR_SPEC7450 | CPU_FTR_HAS_HIGH_BATS,
+	CPU_FTR_HPTE_TABLE | CPU_FTR_SPEC7450 | CPU_FTR_HAS_HIGH_BATS |
+	CPU_FTR_NEED_COHERENT,
 	COMMON_PPC | PPC_FEATURE_ALTIVEC_COMP,
 	32, 32,
 	__setup_cpu_745x
@@ -305,7 +308,7 @@
     	CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_USE_TB | CPU_FTR_CAN_NAP |
 	CPU_FTR_L2CR | CPU_FTR_ALTIVEC_COMP | CPU_FTR_L3CR |
 	CPU_FTR_HPTE_TABLE | CPU_FTR_SPEC7450 | CPU_FTR_NAP_DISABLE_L2_PR |
-	CPU_FTR_L3_DISABLE_NAP | CPU_FTR_HAS_HIGH_BATS,
+	CPU_FTR_L3_DISABLE_NAP | CPU_FTR_NEED_COHERENT | CPU_FTR_HAS_HIGH_BATS,
 	COMMON_PPC | PPC_FEATURE_ALTIVEC_COMP,
 	32, 32,
 	__setup_cpu_745x
@@ -316,18 +319,40 @@
     	CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_USE_TB | CPU_FTR_CAN_NAP |
 	CPU_FTR_L2CR | CPU_FTR_ALTIVEC_COMP | CPU_FTR_L3CR |
 	CPU_FTR_HPTE_TABLE | CPU_FTR_SPEC7450 | CPU_FTR_NAP_DISABLE_L2_PR |
-	CPU_FTR_HAS_HIGH_BATS,
+	CPU_FTR_HAS_HIGH_BATS | CPU_FTR_NEED_COHERENT,
+	COMMON_PPC | PPC_FEATURE_ALTIVEC_COMP,
+	32, 32,
+	__setup_cpu_745x
+    },
+    {	/* 7447/7457 Rev 1.0 */
+    	0xffffffff, 0x80020100, "7447/7457",
+	CPU_FTR_COMMON |
+    	CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_USE_TB | CPU_FTR_CAN_NAP |
+	CPU_FTR_L2CR | CPU_FTR_ALTIVEC_COMP | CPU_FTR_L3CR |
+	CPU_FTR_HPTE_TABLE | CPU_FTR_SPEC7450 | CPU_FTR_NAP_DISABLE_L2_PR |
+	CPU_FTR_HAS_HIGH_BATS | CPU_FTR_NEED_COHERENT | CPU_FTR_NO_BTIC,
+	COMMON_PPC | PPC_FEATURE_ALTIVEC_COMP,
+	32, 32,
+	__setup_cpu_745x
+    },
+    {	/* 7447/7457 Rev 1.1 */
+    	0xffffffff, 0x80020101, "7447/7457",
+	CPU_FTR_COMMON |
+    	CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_USE_TB | CPU_FTR_CAN_NAP |
+	CPU_FTR_L2CR | CPU_FTR_ALTIVEC_COMP | CPU_FTR_L3CR |
+	CPU_FTR_HPTE_TABLE | CPU_FTR_SPEC7450 | CPU_FTR_NAP_DISABLE_L2_PR |
+	CPU_FTR_HAS_HIGH_BATS | CPU_FTR_NEED_COHERENT | CPU_FTR_NO_BTIC,
 	COMMON_PPC | PPC_FEATURE_ALTIVEC_COMP,
 	32, 32,
 	__setup_cpu_745x
     },
-    {	/* 7457 */
-    	0xffff0000, 0x80020000, "7457",
+    {	/* 7447/7457 Rev 1.2 and later */
+    	0xffff0000, 0x80020000, "7447/7457",
 	CPU_FTR_COMMON |
     	CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_USE_TB | CPU_FTR_CAN_NAP |
 	CPU_FTR_L2CR | CPU_FTR_ALTIVEC_COMP | CPU_FTR_L3CR |
 	CPU_FTR_HPTE_TABLE | CPU_FTR_SPEC7450 | CPU_FTR_NAP_DISABLE_L2_PR |
-	CPU_FTR_HAS_HIGH_BATS,
+	CPU_FTR_HAS_HIGH_BATS | CPU_FTR_NEED_COHERENT,
 	COMMON_PPC | PPC_FEATURE_ALTIVEC_COMP,
 	32, 32,
 	__setup_cpu_745x
@@ -338,7 +363,7 @@
     	CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_USE_TB | CPU_FTR_CAN_NAP |
 	CPU_FTR_L2CR | CPU_FTR_ALTIVEC_COMP |
 	CPU_FTR_HPTE_TABLE | CPU_FTR_SPEC7450 | CPU_FTR_NAP_DISABLE_L2_PR |
-	CPU_FTR_HAS_HIGH_BATS,
+	CPU_FTR_HAS_HIGH_BATS | CPU_FTR_NEED_COHERENT,
 	COMMON_PPC | PPC_FEATURE_ALTIVEC_COMP,
 	32, 32,
 	__setup_cpu_745x
@@ -351,8 +376,8 @@
 	32, 32,
 	__setup_cpu_603
     },
-    {	/* 8280 is a G2_LE (603e core, plus some) */
-	0x7fff0000, 0x00820000, "8280",
+    {	/* All G2_LE (603e core, plus some) have the same pvr */
+	0x7fff0000, 0x00820000, "G2_LE",
 	CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_CAN_DOZE | CPU_FTR_USE_TB |
 	CPU_FTR_CAN_NAP | CPU_FTR_HAS_HIGH_BATS,
 	COMMON_PPC,
diff -urN linux-2.6.8-rc2/arch/ppc/kernel/dma-mapping.c linux-2.6.8-rc3/arch/ppc/kernel/dma-mapping.c
--- linux-2.6.8-rc2/arch/ppc/kernel/dma-mapping.c	2004-06-15 22:18:37.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/kernel/dma-mapping.c	2004-08-03 15:21:33.703602565 -0700
@@ -254,6 +254,7 @@
  no_page:
 	return NULL;
 }
+EXPORT_SYMBOL(__dma_alloc_coherent);
 
 /*
  * free a page as defined by the above mapping.
@@ -317,7 +318,7 @@
 	       __func__, vaddr);
 	dump_stack();
 }
-EXPORT_SYMBOL(dma_free_coherent);
+EXPORT_SYMBOL(__dma_free_coherent);
 
 /*
  * Initialise the consistent memory allocation.
diff -urN linux-2.6.8-rc2/arch/ppc/kernel/head.S linux-2.6.8-rc3/arch/ppc/kernel/head.S
--- linux-2.6.8-rc2/arch/ppc/kernel/head.S	2004-06-15 22:19:35.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/kernel/head.S	2004-08-03 15:21:33.706602688 -0700
@@ -552,7 +552,7 @@
 	rlwimi	r3,r3,32-1,31,31	/* _PAGE_USER -> PP lsb */
 	ori	r1,r1,0xe14		/* clear out reserved bits and M */
 	andc	r1,r3,r1		/* PP = user? (rw&dirty? 2: 3): 0 */
-	mtspr	RPA,r1
+	mtspr	SPRN_RPA,r1
 	mfspr	r3,IMISS
 	tlbli	r3
 	mfspr	r3,SRR1		/* Need to restore CR0 */
@@ -626,7 +626,7 @@
 	rlwimi	r3,r3,32-1,31,31	/* _PAGE_USER -> PP lsb */
 	ori	r1,r1,0xe14		/* clear out reserved bits and M */
 	andc	r1,r3,r1		/* PP = user? (rw&dirty? 2: 3): 0 */
-	mtspr	RPA,r1
+	mtspr	SPRN_RPA,r1
 	mfspr	r3,DMISS
 	tlbld	r3
 	mfspr	r3,SRR1		/* Need to restore CR0 */
@@ -694,7 +694,7 @@
 	rlwimi	r3,r3,32-1,30,30	/* _PAGE_USER -> PP msb */
 	li	r1,0xe15		/* clear out reserved bits and M */
 	andc	r1,r3,r1		/* PP = user? 2: 0 */
-	mtspr	RPA,r1
+	mtspr	SPRN_RPA,r1
 	mfspr	r3,DMISS
 	tlbld	r3
 	mfspr	r3,SRR1		/* Need to restore CR0 */
diff -urN linux-2.6.8-rc2/arch/ppc/kernel/head_44x.S linux-2.6.8-rc3/arch/ppc/kernel/head_44x.S
--- linux-2.6.8-rc2/arch/ppc/kernel/head_44x.S	2004-08-03 15:21:05.674452961 -0700
+++ linux-2.6.8-rc3/arch/ppc/kernel/head_44x.S	2004-08-03 15:21:33.774605477 -0700
@@ -209,14 +209,6 @@
 	tlbwe	r4,r0,PPC44x_TLB_XLAT	/* Load the translation fields */
 	tlbwe	r5,r0,PPC44x_TLB_ATTRIB	/* Load the attrib/access fields */
 
-	ori	r3,r3,PPC44x_TLB_TS	/* Translation state 1 */
-
-        li      r0,1			/* TLB slot 1 */
-
-	tlbwe	r3,r0,PPC44x_TLB_PAGEID	/* Load the pageid fields */
-	tlbwe	r4,r0,PPC44x_TLB_XLAT	/* Load the translation fields */
-	tlbwe	r5,r0,PPC44x_TLB_ATTRIB	/* Load the attrib/access fields */
-
 	/* Force context change */
 	isync
 #endif /* CONFIG_SERIAL_TEXT_DEBUG */
diff -urN linux-2.6.8-rc2/arch/ppc/kernel/head_e500.S linux-2.6.8-rc3/arch/ppc/kernel/head_e500.S
--- linux-2.6.8-rc2/arch/ppc/kernel/head_e500.S	2004-08-03 15:21:05.678453125 -0700
+++ linux-2.6.8-rc3/arch/ppc/kernel/head_e500.S	2004-08-03 15:21:33.777605600 -0700
@@ -1177,6 +1177,8 @@
 	evmwumiaa evr6, evr6, evr6	/* evr6 <- ACC = 0 * 0 + ACC */
 	li	r4,THREAD_ACC
    	evstddx	evr6, r4, r3		/* save off accumulator */
+	mfspr	r6,SPRN_SPEFSCR
+	stw	r6,THREAD_SPEFSCR(r3)	/* save spefscr register value */
 	beq	1f
 	lwz	r4,_MSR-STACK_FRAME_OVERHEAD(r5)
 	lis	r3,MSR_SPE@h
diff -urN linux-2.6.8-rc2/arch/ppc/kernel/irq.c linux-2.6.8-rc3/arch/ppc/kernel/irq.c
--- linux-2.6.8-rc2/arch/ppc/kernel/irq.c	2004-08-03 15:21:05.679453166 -0700
+++ linux-2.6.8-rc3/arch/ppc/kernel/irq.c	2004-08-03 15:21:33.778605641 -0700
@@ -106,7 +106,7 @@
 			cache_bitmask |= (1<<i);
 			return (void *)(&malloc_cache[i]);
 		}
-	return 0;
+	return NULL;
 }
 
 void irq_kfree(void *ptr)
@@ -171,7 +171,12 @@
 	if (!shared) {
 		desc->depth = 0;
 		desc->status &= ~(IRQ_DISABLED | IRQ_AUTODETECT | IRQ_WAITING);
-		unmask_irq(irq);
+		if (desc->handler) {
+			if (desc->handler->startup)
+				desc->handler->startup(irq);
+			else if (desc->handler->enable)
+				desc->handler->enable(irq);
+		}
 	}
 	spin_unlock_irqrestore(&desc->lock,flags);
 
@@ -676,7 +681,7 @@
 	int i;
 
 	/* create /proc/irq */
-	root_irq_dir = proc_mkdir("irq", 0);
+	root_irq_dir = proc_mkdir("irq", NULL);
 
 	/* create /proc/irq/prof_cpu_mask */
 	entry = create_proc_entry("prof_cpu_mask", 0600, root_irq_dir);
diff -urN linux-2.6.8-rc2/arch/ppc/kernel/pci.c linux-2.6.8-rc3/arch/ppc/kernel/pci.c
--- linux-2.6.8-rc2/arch/ppc/kernel/pci.c	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/kernel/pci.c	2004-08-03 15:21:33.831607816 -0700
@@ -671,11 +671,11 @@
 		struct pci_dev* dev;
 		unsigned int *class_code, *reg;
 	
-		class_code = (unsigned int *) get_property(node, "class-code", 0);
+		class_code = (unsigned int *) get_property(node, "class-code", NULL);
 		if (!class_code || ((*class_code >> 8) != PCI_CLASS_BRIDGE_PCI &&
 			(*class_code >> 8) != PCI_CLASS_BRIDGE_CARDBUS))
 			continue;
-		reg = (unsigned int *)get_property(node, "reg", 0);
+		reg = (unsigned int *)get_property(node, "reg", NULL);
 		if (!reg)
 			continue;
 		dev = pci_find_slot(pci_bus, ((reg[0] >> 8) & 0xff));
@@ -712,7 +712,7 @@
 			continue;
 		make_one_node_map(node, hose->first_busno);
 	}
-	of_prop_map = get_property(find_path_device("/"), "pci-OF-bus-map", 0);
+	of_prop_map = get_property(find_path_device("/"), "pci-OF-bus-map", NULL);
 	if (of_prop_map)
 		memcpy(of_prop_map, pci_to_OF_bus_map, pci_bus_count);
 #ifdef DEBUG
@@ -743,7 +743,7 @@
 		 * a fake root for all functions of a multi-function device,
 		 * we go down them as well.
 		 */
-		class_code = (unsigned int *) get_property(node, "class-code", 0);
+		class_code = (unsigned int *) get_property(node, "class-code", NULL);
 		if ((!class_code || ((*class_code >> 8) != PCI_CLASS_BRIDGE_PCI &&
 			(*class_code >> 8) != PCI_CLASS_BRIDGE_CARDBUS)) &&
 			strcmp(node->name, "multifunc-device"))
@@ -761,7 +761,7 @@
 	unsigned int *reg;
 	u8* fdata = (u8*)data;
 	
-	reg = (unsigned int *) get_property(node, "reg", 0);
+	reg = (unsigned int *) get_property(node, "reg", NULL);
 	if (reg && ((reg[0] >> 8) & 0xff) == fdata[1]
 		&& ((reg[0] >> 16) & 0xff) == fdata[0])
 		return 1;
@@ -874,7 +874,7 @@
 	if (!scan_OF_pci_childs(((struct device_node*)hose->arch_data)->child,
 			find_OF_pci_device_filter, (void *)node))
 		return -ENODEV;
-	reg = (unsigned int *) get_property(node, "reg", 0);
+	reg = (unsigned int *) get_property(node, "reg", NULL);
 	if (!reg)
 		return -ENODEV;
 	*bus = (reg[0] >> 16) & 0xff;
diff -urN linux-2.6.8-rc2/arch/ppc/kernel/ppc-stub.c linux-2.6.8-rc3/arch/ppc/kernel/ppc-stub.c
--- linux-2.6.8-rc2/arch/ppc/kernel/ppc-stub.c	2004-08-03 15:21:05.681453248 -0700
+++ linux-2.6.8-rc3/arch/ppc/kernel/ppc-stub.c	2004-08-03 15:21:33.832607857 -0700
@@ -234,7 +234,7 @@
 	} else {
 		/* error condition */
 	}
-	debugger_fault_handler = 0;
+	debugger_fault_handler = NULL;
 	*buf = 0;
 	return buf;
 }
@@ -300,7 +300,7 @@
 	} else {
 		/* error condition */
 	}
-	debugger_fault_handler = 0;
+	debugger_fault_handler = NULL;
 	return mem;
 }
 
@@ -331,7 +331,7 @@
 	} else {
 		/* error condition */
 	}
-	debugger_fault_handler = 0;
+	debugger_fault_handler = NULL;
 
 	return (numChars);
 }
diff -urN linux-2.6.8-rc2/arch/ppc/kernel/ppc_htab.c linux-2.6.8-rc3/arch/ppc/kernel/ppc_htab.c
--- linux-2.6.8-rc2/arch/ppc/kernel/ppc_htab.c	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/kernel/ppc_htab.c	2004-08-03 15:21:33.833607898 -0700
@@ -448,15 +448,15 @@
 	}
 
 	if (!write && !first && left) {
-		if(put_user('\n', (char *) buffer))
+		if(put_user('\n', (char __user *) buffer))
 			return -EFAULT;
 		left--, buffer++;
 	}
 	if (write) {
-		p = (char *) buffer;
+		char __user *s = (char __user *) buffer;
 		while (left) {
 			char c;
-			if(get_user(c, p++))
+			if(get_user(c, s++))
 				return -EFAULT;
 			if (!isspace(c))
 				break;
diff -urN linux-2.6.8-rc2/arch/ppc/kernel/process.c linux-2.6.8-rc3/arch/ppc/kernel/process.c
--- linux-2.6.8-rc2/arch/ppc/kernel/process.c	2004-08-03 15:21:05.683453330 -0700
+++ linux-2.6.8-rc3/arch/ppc/kernel/process.c	2004-08-03 15:21:33.834607939 -0700
@@ -479,9 +479,9 @@
 	regs->gpr[1] = sp;
 	regs->msr = MSR_USER;
 	if (last_task_used_math == current)
-		last_task_used_math = 0;
+		last_task_used_math = NULL;
 	if (last_task_used_altivec == current)
-		last_task_used_altivec = 0;
+		last_task_used_altivec = NULL;
 	memset(current->thread.fpr, 0, sizeof(current->thread.fpr));
 	current->thread.fpscr = 0;
 #ifdef CONFIG_ALTIVEC
@@ -544,7 +544,7 @@
 #endif
 	else
 		val = __unpack_fe01(tsk->thread.fpexc_mode);
-	return put_user(val, (unsigned int *) adr);
+	return put_user(val, (unsigned int __user *) adr);
 }
 
 int sys_clone(unsigned long clone_flags, unsigned long usp,
diff -urN linux-2.6.8-rc2/arch/ppc/kernel/ptrace.c linux-2.6.8-rc3/arch/ppc/kernel/ptrace.c
--- linux-2.6.8-rc2/arch/ppc/kernel/ptrace.c	2004-08-03 15:21:05.683453330 -0700
+++ linux-2.6.8-rc3/arch/ppc/kernel/ptrace.c	2004-08-03 15:21:33.835607980 -0700
@@ -77,7 +77,7 @@
 /*
  * Get contents of AltiVec register state in task TASK
  */
-static inline int get_vrregs(unsigned long *data, struct task_struct *task)
+static inline int get_vrregs(unsigned long __user *data, struct task_struct *task)
 {
 	int i, j;
 
@@ -105,7 +105,7 @@
 /*
  * Write contents of AltiVec register state into task TASK.
  */
-static inline int set_vrregs(struct task_struct *task, unsigned long *data)
+static inline int set_vrregs(struct task_struct *task, unsigned long __user *data)
 {
 	int i, j;
 
@@ -286,7 +286,7 @@
 		ret = -EIO;
 		if (copied != sizeof(tmp))
 			break;
-		ret = put_user(tmp,(unsigned long *) data);
+		ret = put_user(tmp,(unsigned long __user *) data);
 		break;
 	}
 
@@ -312,7 +312,7 @@
 			preempt_enable();
 			tmp = ((unsigned long *)child->thread.fpr)[index - PT_FPR0];
 		}
-		ret = put_user(tmp,(unsigned long *) data);
+		ret = put_user(tmp,(unsigned long __user *) data);
 		break;
 	}
 
@@ -410,7 +410,7 @@
 		if (child->thread.regs->msr & MSR_VEC)
 			giveup_altivec(child);
 		preempt_enable();
-		ret = get_vrregs((unsigned long *)data, child);
+		ret = get_vrregs((unsigned long __user *)data, child);
 		break;
 
 	case PTRACE_SETVRREGS:
@@ -421,7 +421,7 @@
 		if (child->thread.regs->msr & MSR_VEC)
 			giveup_altivec(child);
 		preempt_enable();
-		ret = set_vrregs(child, (unsigned long *)data);
+		ret = set_vrregs(child, (unsigned long __user *)data);
 		break;
 #endif
 #ifdef CONFIG_SPE
@@ -429,7 +429,7 @@
 		/* Get the child spe register state. */
 		if (child->thread.regs->msr & MSR_SPE)
 			giveup_spe(child);
-		ret = get_evrregs((unsigned long *)data, child);
+		ret = get_evrregs((unsigned long __user *)data, child);
 		break;
 
 	case PTRACE_SETEVRREGS:
@@ -438,7 +438,7 @@
 		 * of register state from memory */
 		if (child->thread.regs->msr & MSR_SPE)
 			giveup_spe(child);
-		ret = set_evrregs(child, (unsigned long *)data);
+		ret = set_evrregs(child, (unsigned long __user *)data);
 		break;
 #endif
 
diff -urN linux-2.6.8-rc2/arch/ppc/kernel/setup.c linux-2.6.8-rc3/arch/ppc/kernel/setup.c
--- linux-2.6.8-rc2/arch/ppc/kernel/setup.c	2004-08-03 15:21:05.684453371 -0700
+++ linux-2.6.8-rc3/arch/ppc/kernel/setup.c	2004-08-03 15:21:33.836608021 -0700
@@ -622,7 +622,7 @@
 }
 __setup("l2cr=", ppc_setup_l2cr);
 
-#ifdef CONFIG_NVRAM
+#ifdef CONFIG_GENERIC_NVRAM
 
 /* Generic nvram hooks used by drivers/char/gen_nvram.c */
 unsigned char nvram_read_byte(int addr)
@@ -693,7 +693,7 @@
 #ifdef CONFIG_XMON
 	xmon_map_scc();
 	if (strstr(cmd_line, "xmon"))
-		xmon(0);
+		xmon(NULL);
 #endif /* CONFIG_XMON */
 	if ( ppc_md.progress ) ppc_md.progress("setup_arch: enter", 0x3eab);
 
diff -urN linux-2.6.8-rc2/arch/ppc/kernel/signal.c linux-2.6.8-rc3/arch/ppc/kernel/signal.c
--- linux-2.6.8-rc2/arch/ppc/kernel/signal.c	2004-08-03 15:21:05.685453412 -0700
+++ linux-2.6.8-rc3/arch/ppc/kernel/signal.c	2004-08-03 15:21:33.837608062 -0700
@@ -187,7 +187,7 @@
  * altivec/spe instructions at some point.
  */
 static int
-save_user_regs(struct pt_regs *regs, struct mcontext *frame, int sigret)
+save_user_regs(struct pt_regs *regs, struct mcontext __user *frame, int sigret)
 {
 	/* save general and floating-point registers */
 	CHECK_FULL_REGS(regs);
@@ -229,7 +229,7 @@
 	 * significant bits of a vector, we "cheat" and stuff VRSAVE in the
 	 * most significant bits of that same vector. --BenH
 	 */
-	if (__put_user(current->thread.vrsave, (u32 *)&frame->mc_vregs[32]))
+	if (__put_user(current->thread.vrsave, (u32 __user *)&frame->mc_vregs[32]))
 		return 1;
 #endif /* CONFIG_ALTIVEC */
 
@@ -308,7 +308,7 @@
 		memset(&current->thread.vr, 0, ELF_NVRREG * sizeof(vector128));
 
 	/* Always get VRSAVE back */
-	if (__get_user(current->thread.vrsave, (u32 *)&sr->mc_vregs[32]))
+	if (__get_user(current->thread.vrsave, (u32 __user *)&sr->mc_vregs[32]))
 		return 1;
 #endif /* CONFIG_ALTIVEC */
 
@@ -412,7 +412,7 @@
 static int do_setcontext(struct ucontext __user *ucp, struct pt_regs *regs, int sig)
 {
 	sigset_t set;
-	struct mcontext *mcp;
+	struct mcontext __user *mcp;
 
 	if (__copy_from_user(&set, &ucp->uc_sigmask, sizeof(set))
 	    || __get_user(mcp, &ucp->uc_regs))
@@ -447,8 +447,8 @@
 	if (new_ctx == NULL)
 		return 0;
 	if (verify_area(VERIFY_READ, new_ctx, sizeof(*new_ctx))
-	    || __get_user(tmp, (u8 *) new_ctx)
-	    || __get_user(tmp, (u8 *) (new_ctx + 1) - 1))
+	    || __get_user(tmp, (u8 __user *) new_ctx)
+	    || __get_user(tmp, (u8 __user *) (new_ctx + 1) - 1))
 		return -EFAULT;
 
 	/*
@@ -524,7 +524,7 @@
 	/* create a stack frame for the caller of the handler */
 	newsp -= __SIGNAL_FRAMESIZE;
 
-	if (verify_area(VERIFY_WRITE, (void *) newsp, origsp - newsp))
+	if (verify_area(VERIFY_WRITE, (void __user *) newsp, origsp - newsp))
 		goto badframe;
 
 #if _NSIG != 64
@@ -583,7 +583,7 @@
 	set.sig[1] = sigctx._unused[3];
 	restore_sigmask(&set);
 
-	sr = (struct mcontext *) sigctx.regs;
+	sr = (struct mcontext __user *) sigctx.regs;
 	if (verify_area(VERIFY_READ, sr, sizeof(*sr))
 	    || restore_user_regs(regs, sr, 1))
 		goto badframe;
diff -urN linux-2.6.8-rc2/arch/ppc/kernel/syscalls.c linux-2.6.8-rc3/arch/ppc/kernel/syscalls.c
--- linux-2.6.8-rc2/arch/ppc/kernel/syscalls.c	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/kernel/syscalls.c	2004-08-03 15:21:33.838608103 -0700
@@ -67,7 +67,7 @@
 		break;
 	case SEMTIMEDOP:
 		ret = sys_semtimedop (first, (struct sembuf __user *)ptr,
-				      second, (const struct timespec *) fifth);
+				      second, (const struct timespec __user *) fifth);
 		break;
 	case SEMGET:
 		ret = sys_semget (first, second, third);
@@ -78,7 +78,7 @@
 		if (!ptr)
 			break;
 		if ((ret = verify_area (VERIFY_READ, ptr, sizeof(long)))
-		    || (ret = get_user(fourth.__pad, (void *__user *)ptr)))
+		    || (ret = get_user(fourth.__pad, (void __user *__user *)ptr)))
 			break;
 		ret = sys_semctl (first, second, third, fourth);
 		break;
@@ -208,17 +208,17 @@
  * sys_select() with the appropriate args. -- Cort
  */
 int
-ppc_select(int n, fd_set *inp, fd_set *outp, fd_set *exp, struct timeval *tvp)
+ppc_select(int n, fd_set __user *inp, fd_set __user *outp, fd_set __user *exp, struct timeval __user *tvp)
 {
 	if ( (unsigned long)n >= 4096 )
 	{
 		unsigned long __user *buffer = (unsigned long __user *)n;
 		if (verify_area(VERIFY_READ, buffer, 5*sizeof(unsigned long))
 		    || __get_user(n, buffer)
-		    || __get_user(inp, ((fd_set **)(buffer+1)))
-		    || __get_user(outp, ((fd_set **)(buffer+2)))
-		    || __get_user(exp, ((fd_set **)(buffer+3)))
-		    || __get_user(tvp, ((struct timeval **)(buffer+4))))
+		    || __get_user(inp, ((fd_set __user * __user *)(buffer+1)))
+		    || __get_user(outp, ((fd_set  __user * __user *)(buffer+2)))
+		    || __get_user(exp, ((fd_set  __user * __user *)(buffer+3)))
+		    || __get_user(tvp, ((struct timeval  __user * __user *)(buffer+4))))
 			return -EFAULT;
 	}
 	return sys_select(n, inp, outp, exp, tvp);
diff -urN linux-2.6.8-rc2/arch/ppc/kernel/traps.c linux-2.6.8-rc3/arch/ppc/kernel/traps.c
--- linux-2.6.8-rc2/arch/ppc/kernel/traps.c	2004-08-03 15:21:05.687453494 -0700
+++ linux-2.6.8-rc3/arch/ppc/kernel/traps.c	2004-08-03 15:21:33.840608185 -0700
@@ -114,7 +114,7 @@
 	info.si_signo = signr;
 	info.si_errno = 0;
 	info.si_code = code;
-	info.si_addr = (void *) addr;
+	info.si_addr = (void __user *) addr;
 	force_sig_info(signr, &info, current);
 }
 
diff -urN linux-2.6.8-rc2/arch/ppc/kernel/vecemu.c linux-2.6.8-rc3/arch/ppc/kernel/vecemu.c
--- linux-2.6.8-rc2/arch/ppc/kernel/vecemu.c	2004-08-03 15:21:05.688453535 -0700
+++ linux-2.6.8-rc3/arch/ppc/kernel/vecemu.c	2004-08-03 15:21:33.840608185 -0700
@@ -262,7 +262,7 @@
 	unsigned int va, vb, vc, vd;
 	vector128 *vrs;
 
-	if (get_user(instr, (unsigned int *) regs->nip))
+	if (get_user(instr, (unsigned int __user *) regs->nip))
 		return -EFAULT;
 	if ((instr >> 26) != 4)
 		return -EINVAL;		/* not an altivec instruction */
diff -urN linux-2.6.8-rc2/arch/ppc/lib/rheap.c linux-2.6.8-rc3/arch/ppc/lib/rheap.c
--- linux-2.6.8-rc2/arch/ppc/lib/rheap.c	2004-08-03 15:21:05.690453617 -0700
+++ linux-2.6.8-rc3/arch/ppc/lib/rheap.c	2004-08-03 15:21:33.842608267 -0700
@@ -254,11 +254,11 @@
 
 	/* Alignment must be a power of two */
 	if ((alignment & (alignment - 1)) != 0)
-		return NULL;
+		return ERR_PTR(-EINVAL);
 
 	info = kmalloc(sizeof(*info), GFP_KERNEL);
 	if (info == NULL)
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 
 	info->alignment = alignment;
 
@@ -366,7 +366,7 @@
 
 	/* Validate size */
 	if (size <= 0)
-		return NULL;
+		return ERR_PTR(-EINVAL);
 
 	/* The region must be aligned */
 	s = (unsigned long)start;
@@ -380,7 +380,7 @@
 	e = e & ~m;
 
 	if (assure_empty(info, 1) < 0)
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 
 	blk = NULL;
 	list_for_each(l, &info->free_list) {
@@ -394,7 +394,7 @@
 	}
 
 	if (blk == NULL)
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 
 	/* Perfect fit */
 	if (bs == s && be == e) {
@@ -434,13 +434,13 @@
 
 	/* Validate size */
 	if (size <= 0)
-		return NULL;
+		return ERR_PTR(-EINVAL);
 
 	/* Align to configured alignment */
 	size = (size + (info->alignment - 1)) & ~(info->alignment - 1);
 
 	if (assure_empty(info, 1) < 0)
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 
 	blk = NULL;
 	list_for_each(l, &info->free_list) {
@@ -451,7 +451,7 @@
 	}
 
 	if (blk == NULL)
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 
 	/* Just fits */
 	if (blk->size == size) {
@@ -490,7 +490,7 @@
 
 	/* Validate size */
 	if (size <= 0)
-		return NULL;
+		return ERR_PTR(-EINVAL);
 
 	/* The region must be aligned */
 	s = (unsigned long)start;
@@ -504,7 +504,7 @@
 	e = e & ~m;
 
 	if (assure_empty(info, 2) < 0)
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 
 	blk = NULL;
 	list_for_each(l, &info->free_list) {
@@ -517,7 +517,7 @@
 	}
 
 	if (blk == NULL)
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 
 	/* Perfect fit */
 	if (bs == s && be == e) {
diff -urN linux-2.6.8-rc2/arch/ppc/mm/fault.c linux-2.6.8-rc3/arch/ppc/mm/fault.c
--- linux-2.6.8-rc2/arch/ppc/mm/fault.c	2004-08-03 15:21:05.691453658 -0700
+++ linux-2.6.8-rc3/arch/ppc/mm/fault.c	2004-08-03 15:21:33.843608308 -0700
@@ -59,7 +59,7 @@
 {
 	unsigned int inst;
 
-	if (get_user(inst, (unsigned int *)regs->nip))
+	if (get_user(inst, (unsigned int __user *)regs->nip))
 		return 0;
 	/* check for 1 in the rA field */
 	if (((inst >> 16) & 0x1f) != 1)
@@ -281,7 +281,7 @@
 		info.si_signo = SIGSEGV;
 		info.si_errno = 0;
 		info.si_code = code;
-		info.si_addr = (void *) address;
+		info.si_addr = (void __user *) address;
 		force_sig_info(SIGSEGV, &info, current);
 		return 0;
 	}
@@ -309,7 +309,7 @@
 	info.si_signo = SIGBUS;
 	info.si_errno = 0;
 	info.si_code = BUS_ADRERR;
-	info.si_addr = (void *)address;
+	info.si_addr = (void __user *)address;
 	force_sig_info (SIGBUS, &info, current);
 	if (!user_mode(regs))
 		return SIGBUS;
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/85xx/Kconfig linux-2.6.8-rc3/arch/ppc/platforms/85xx/Kconfig
--- linux-2.6.8-rc2/arch/ppc/platforms/85xx/Kconfig	2004-08-03 15:21:05.698453944 -0700
+++ linux-2.6.8-rc3/arch/ppc/platforms/85xx/Kconfig	2004-08-03 15:21:33.851608636 -0700
@@ -17,10 +17,20 @@
 	default MPC8540_ADS
 
 config MPC8540_ADS
-	bool "MPC8540ADS"
+	bool "Freescale MPC8540 ADS"
 	help
 	  This option enables support for the MPC 8540 ADS evaluation board.
 
+config MPC8555_CDS
+	bool "Freescale MPC8555 CDS"
+	help
+	  This option enablese support for the MPC8555 CDS evaluation board.
+
+config MPC8560_ADS
+	bool "Freescale MPC8560 ADS"
+	help
+	  This option enables support for the MPC 8560 ADS evaluation board.
+
 config SBC8560
 	bool "WindRiver PowerQUICC III SBC8560"
 	help
@@ -37,9 +47,19 @@
 	depends on MPC8540_ADS
 	default y
 
+config MPC8555
+	bool
+	depends on MPC8555_CDS
+	default y
+
 config MPC8560
 	bool
-	depends on SBC8560
+	depends on SBC8560 || MPC8560_ADS
+	default y
+
+config 85xx_PCI2
+	bool "Supprt for 2nd PCI host controller"
+	depends on MPC8555_CDS
 	default y
 
 config FSL_OCP
@@ -49,7 +69,7 @@
 
 config PPC_GEN550
 	bool
-	depends on MPC8540 || SBC8560
+	depends on MPC8540 || SBC8560 || MPC8555
 	default y
 
 endmenu
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/85xx/Makefile linux-2.6.8-rc3/arch/ppc/platforms/85xx/Makefile
--- linux-2.6.8-rc2/arch/ppc/platforms/85xx/Makefile	2004-08-03 15:21:05.699453985 -0700
+++ linux-2.6.8-rc3/arch/ppc/platforms/85xx/Makefile	2004-08-03 15:21:33.852608677 -0700
@@ -3,7 +3,10 @@
 #
 
 obj-$(CONFIG_MPC8540_ADS)	+= mpc85xx_ads_common.o mpc8540_ads.o
+obj-$(CONFIG_MPC8555_CDS)	+= mpc85xx_cds_common.o
+obj-$(CONFIG_MPC8560_ADS)	+= mpc85xx_ads_common.o mpc8560_ads.o
 obj-$(CONFIG_SBC8560)		+= sbc85xx.o sbc8560.o
 
 obj-$(CONFIG_MPC8540)		+= mpc8540.o
+obj-$(CONFIG_MPC8555)		+= mpc8555.o
 obj-$(CONFIG_MPC8560)		+= mpc8560.o
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/85xx/mpc8540_ads.c linux-2.6.8-rc3/arch/ppc/platforms/85xx/mpc8540_ads.c
--- linux-2.6.8-rc2/arch/ppc/platforms/85xx/mpc8540_ads.c	2004-08-03 15:21:05.701454067 -0700
+++ linux-2.6.8-rc3/arch/ppc/platforms/85xx/mpc8540_ads.c	2004-08-03 15:21:33.854608759 -0700
@@ -30,6 +30,7 @@
 #include <linux/serial.h>
 #include <linux/tty.h>	/* for linux/serial_core.h */
 #include <linux/serial_core.h>
+#include <linux/initrd.h>
 #include <linux/module.h>
 
 #include <asm/system.h>
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/85xx/mpc8540_ads.h linux-2.6.8-rc3/arch/ppc/platforms/85xx/mpc8540_ads.h
--- linux-2.6.8-rc2/arch/ppc/platforms/85xx/mpc8540_ads.h	2004-08-03 15:21:05.701454067 -0700
+++ linux-2.6.8-rc3/arch/ppc/platforms/85xx/mpc8540_ads.h	2004-08-03 15:21:33.854608759 -0700
@@ -18,7 +18,6 @@
 #define __MACH_MPC8540ADS_H__
 
 #include <linux/config.h>
-#include <linux/serial.h>
 #include <linux/initrd.h>
 #include <syslib/ppc85xx_setup.h>
 #include <platforms/85xx/mpc85xx_ads_common.h>
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/85xx/mpc8555.c linux-2.6.8-rc3/arch/ppc/platforms/85xx/mpc8555.c
--- linux-2.6.8-rc2/arch/ppc/platforms/85xx/mpc8555.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc/platforms/85xx/mpc8555.c	2004-08-03 15:21:33.855608800 -0700
@@ -0,0 +1,88 @@
+/*
+ * arch/ppc/platform/85xx/mpc8555.c
+ *
+ * MPC8555 I/O descriptions
+ *
+ * Maintainer: Kumar Gala <kumar.gala@freescale.com>
+ *
+ * Copyright 2004 Freescale Semiconductor Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <asm/mpc85xx.h>
+#include <asm/ocp.h>
+
+/* These should be defined in platform code */
+extern struct ocp_gfar_data mpc85xx_tsec1_def;
+extern struct ocp_gfar_data mpc85xx_tsec2_def;
+extern struct ocp_mpc_i2c_data mpc85xx_i2c1_def;
+
+/* We use offsets for paddr since we do not know at compile time
+ * what CCSRBAR is, platform code should fix this up in
+ * setup_arch
+ *
+ * Only the first IRQ is given even if a device has
+ * multiple lines associated with ita
+ */
+struct ocp_def core_ocp[] = {
+        { .vendor       = OCP_VENDOR_FREESCALE,
+          .function     = OCP_FUNC_IIC,
+          .index        = 0,
+          .paddr        = MPC85xx_IIC1_OFFSET,
+          .irq          = MPC85xx_IRQ_IIC1,
+          .pm           = OCP_CPM_NA,
+	  .additions	= &mpc85xx_i2c1_def,
+        },
+        { .vendor       = OCP_VENDOR_FREESCALE,
+          .function     = OCP_FUNC_16550,
+          .index        = 0,
+          .paddr        = MPC85xx_UART0_OFFSET,
+          .irq          = MPC85xx_IRQ_DUART,
+          .pm           = OCP_CPM_NA,
+        },
+        { .vendor       = OCP_VENDOR_FREESCALE,
+          .function     = OCP_FUNC_16550,
+          .index        = 1,
+          .paddr        = MPC85xx_UART1_OFFSET,
+          .irq          = MPC85xx_IRQ_DUART,
+          .pm           = OCP_CPM_NA,
+        },
+        { .vendor       = OCP_VENDOR_FREESCALE,
+          .function     = OCP_FUNC_GFAR,
+          .index        = 0,
+          .paddr        = MPC85xx_ENET1_OFFSET,
+          .irq          = MPC85xx_IRQ_TSEC1_TX,
+          .pm           = OCP_CPM_NA,
+          .additions    = &mpc85xx_tsec1_def,
+        },
+        { .vendor       = OCP_VENDOR_FREESCALE,
+          .function     = OCP_FUNC_GFAR,
+          .index        = 1,
+          .paddr        = MPC85xx_ENET2_OFFSET,
+          .irq          = MPC85xx_IRQ_TSEC2_TX,
+          .pm           = OCP_CPM_NA,
+          .additions    = &mpc85xx_tsec2_def,
+        },
+        { .vendor       = OCP_VENDOR_FREESCALE,
+          .function     = OCP_FUNC_DMA,
+          .index        = 0,
+          .paddr        = MPC85xx_DMA_OFFSET,
+          .irq          = MPC85xx_IRQ_DMA0,
+          .pm           = OCP_CPM_NA,
+        },
+        { .vendor       = OCP_VENDOR_FREESCALE,
+          .function     = OCP_FUNC_PERFMON,
+          .index        = 0,
+          .paddr        = MPC85xx_PERFMON_OFFSET,
+          .irq          = MPC85xx_IRQ_PERFMON,
+          .pm           = OCP_CPM_NA,
+        },
+        { .vendor       = OCP_VENDOR_INVALID
+        }
+};
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/85xx/mpc8555_cds.h linux-2.6.8-rc3/arch/ppc/platforms/85xx/mpc8555_cds.h
--- linux-2.6.8-rc2/arch/ppc/platforms/85xx/mpc8555_cds.h	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc/platforms/85xx/mpc8555_cds.h	2004-08-03 15:21:33.856608841 -0700
@@ -0,0 +1,26 @@
+/*
+ * arch/ppc/platforms/mpc8555_cds.h
+ *
+ * MPC8555CDS board definitions
+ *
+ * Maintainer: Kumar Gala <kumar.gala@freescale.com>
+ *
+ * Copyright 2004 Freescale Semiconductor Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ */
+
+#ifndef __MACH_MPC8555CDS_H__
+#define __MACH_MPC8555CDS_H__
+
+#include <linux/config.h>
+#include <linux/serial.h>
+#include <platforms/85xx/mpc85xx_cds_common.h>
+
+#define CPM_MAP_ADDR	(CCSRBAR + MPC85xx_CPM_OFFSET)
+
+#endif /* __MACH_MPC8555CDS_H__ */
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/85xx/mpc8560_ads.c linux-2.6.8-rc3/arch/ppc/platforms/85xx/mpc8560_ads.c
--- linux-2.6.8-rc2/arch/ppc/platforms/85xx/mpc8560_ads.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc/platforms/85xx/mpc8560_ads.c	2004-08-03 15:21:33.857608882 -0700
@@ -0,0 +1,241 @@
+/*
+ * arch/ppc/platforms/85xx/mpc8560_ads.c
+ *
+ * MPC8560ADS board specific routines
+ *
+ * Maintainer: Kumar Gala <kumar.gala@freescale.com>
+ *
+ * Copyright 2004 Freescale Semiconductor Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/config.h>
+#include <linux/stddef.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/errno.h>
+#include <linux/reboot.h>
+#include <linux/pci.h>
+#include <linux/kdev_t.h>
+#include <linux/major.h>
+#include <linux/console.h>
+#include <linux/delay.h>
+#include <linux/irq.h>
+#include <linux/seq_file.h>
+#include <linux/root_dev.h>
+#include <linux/serial.h>
+#include <linux/tty.h>	/* for linux/serial_core.h */
+#include <linux/serial_core.h>
+#include <linux/initrd.h>
+#include <linux/module.h>
+
+#include <asm/system.h>
+#include <asm/pgtable.h>
+#include <asm/page.h>
+#include <asm/atomic.h>
+#include <asm/time.h>
+#include <asm/io.h>
+#include <asm/machdep.h>
+#include <asm/prom.h>
+#include <asm/open_pic.h>
+#include <asm/bootinfo.h>
+#include <asm/pci-bridge.h>
+#include <asm/mpc85xx.h>
+#include <asm/irq.h>
+#include <asm/immap_85xx.h>
+#include <asm/kgdb.h>
+#include <asm/ocp.h>
+#include <asm/cpm2.h>
+#include <mm/mmu_decl.h>
+
+#include <syslib/cpm2_pic.h>
+#include <syslib/ppc85xx_common.h>
+#include <syslib/ppc85xx_setup.h>
+
+extern void cpm2_reset(void);
+
+struct ocp_gfar_data mpc85xx_tsec1_def = {
+        .interruptTransmit = MPC85xx_IRQ_TSEC1_TX,
+        .interruptError = MPC85xx_IRQ_TSEC1_ERROR,
+        .interruptReceive = MPC85xx_IRQ_TSEC1_RX,
+        .interruptPHY = MPC85xx_IRQ_EXT5,
+        .flags = (GFAR_HAS_GIGABIT | GFAR_HAS_MULTI_INTR
+			| GFAR_HAS_RMON | GFAR_HAS_COALESCE
+                        | GFAR_HAS_PHY_INTR),
+        .phyid = 0,
+        .phyregidx = 0,
+};
+
+struct ocp_gfar_data mpc85xx_tsec2_def = {
+        .interruptTransmit = MPC85xx_IRQ_TSEC2_TX,
+        .interruptError = MPC85xx_IRQ_TSEC2_ERROR,
+        .interruptReceive = MPC85xx_IRQ_TSEC2_RX,
+        .interruptPHY = MPC85xx_IRQ_EXT5,
+        .flags = (GFAR_HAS_GIGABIT | GFAR_HAS_MULTI_INTR
+			| GFAR_HAS_RMON | GFAR_HAS_COALESCE
+                        | GFAR_HAS_PHY_INTR),
+        .phyid = 1,
+        .phyregidx = 0,
+};
+
+struct ocp_fs_i2c_data mpc85xx_i2c1_def = {
+	.flags = FS_I2C_SEPARATE_DFSRR,
+};
+
+/* ************************************************************************
+ *
+ * Setup the architecture
+ *
+ */
+
+static void __init
+mpc8560ads_setup_arch(void)
+{
+	struct ocp_def *def;
+	struct ocp_gfar_data *einfo;
+	bd_t *binfo = (bd_t *) __res;
+	unsigned int freq;
+
+	cpm2_reset();
+
+	/* get the core frequency */
+	freq = binfo->bi_intfreq;
+
+	if (ppc_md.progress)
+		ppc_md.progress("mpc8560ads_setup_arch()", 0);
+
+	/* Set loops_per_jiffy to a half-way reasonable value,
+	   for use until calibrate_delay gets called. */
+	loops_per_jiffy = freq / HZ;
+
+#ifdef CONFIG_PCI
+	/* setup PCI host bridges */
+	mpc85xx_setup_hose();
+#endif
+
+	def = ocp_get_one_device(OCP_VENDOR_FREESCALE, OCP_FUNC_GFAR, 0);
+	if (def) {
+		einfo = (struct ocp_gfar_data *) def->additions;
+		memcpy(einfo->mac_addr, binfo->bi_enetaddr, 6);
+	}
+
+	def = ocp_get_one_device(OCP_VENDOR_FREESCALE, OCP_FUNC_GFAR, 1);
+	if (def) {
+		einfo = (struct ocp_gfar_data *) def->additions;
+		memcpy(einfo->mac_addr, binfo->bi_enet1addr, 6);
+	}
+
+#ifdef CONFIG_BLK_DEV_INITRD
+	if (initrd_start)
+		ROOT_DEV = Root_RAM0;
+	else
+#endif
+#ifdef  CONFIG_ROOT_NFS
+		ROOT_DEV = Root_NFS;
+#else
+		ROOT_DEV = Root_HDA1;
+#endif
+
+	ocp_for_each_device(mpc85xx_update_paddr_ocp, &(binfo->bi_immr_base));
+}
+
+static irqreturn_t cpm2_cascade(int irq, void *dev_id, struct pt_regs *regs)
+{
+	while ((irq = cpm2_get_irq(regs)) >= 0) {
+		ppc_irq_dispatch_handler(regs, irq);
+	}
+	return IRQ_HANDLED;
+}
+
+static void __init
+mpc8560_ads_init_IRQ(void)
+{
+	int i;
+	volatile cpm2_map_t *immap = cpm2_immr;
+
+	/* Setup OpenPIC */
+	mpc85xx_ads_init_IRQ();
+
+	/* disable all CPM interupts */
+	immap->im_intctl.ic_simrh = 0x0;
+	immap->im_intctl.ic_simrl = 0x0;
+
+	for (i = CPM_IRQ_OFFSET; i < (NR_CPM_INTS + CPM_IRQ_OFFSET); i++)
+		irq_desc[i].handler = &cpm2_pic;
+
+	/* Initialize the default interrupt mapping priorities,
+	 * in case the boot rom changed something on us.
+	 */
+	immap->im_intctl.ic_sicr = 0;
+	immap->im_intctl.ic_scprrh = 0x05309770;
+	immap->im_intctl.ic_scprrl = 0x05309770;
+
+	request_irq(MPC85xx_IRQ_CPM, cpm2_cascade, SA_INTERRUPT, "cpm2_cascade", NULL);
+
+	return;
+}
+
+
+
+/* ************************************************************************ */
+void __init
+platform_init(unsigned long r3, unsigned long r4, unsigned long r5,
+	      unsigned long r6, unsigned long r7)
+{
+	/* parse_bootinfo must always be called first */
+	parse_bootinfo(find_bootinfo());
+
+	/*
+	 * If we were passed in a board information, copy it into the
+	 * residual data area.
+	 */
+	if (r3) {
+		memcpy((void *) __res, (void *) (r3 + KERNELBASE),
+		       sizeof (bd_t));
+
+	}
+#if defined(CONFIG_BLK_DEV_INITRD)
+	/*
+	 * If the init RAM disk has been configured in, and there's a valid
+	 * starting address for it, set it up.
+	 */
+	if (r4) {
+		initrd_start = r4 + KERNELBASE;
+		initrd_end = r5 + KERNELBASE;
+	}
+#endif				/* CONFIG_BLK_DEV_INITRD */
+
+	/* Copy the kernel command line arguments to a safe place. */
+
+	if (r6) {
+		*(char *) (r7 + KERNELBASE) = 0;
+		strcpy(cmd_line, (char *) (r6 + KERNELBASE));
+	}
+
+	/* setup the PowerPC module struct */
+	ppc_md.setup_arch = mpc8560ads_setup_arch;
+	ppc_md.show_cpuinfo = mpc85xx_ads_show_cpuinfo;
+
+	ppc_md.init_IRQ = mpc8560_ads_init_IRQ;
+	ppc_md.get_irq = openpic_get_irq;
+
+	ppc_md.restart = mpc85xx_restart;
+	ppc_md.power_off = mpc85xx_power_off;
+	ppc_md.halt = mpc85xx_halt;
+
+	ppc_md.find_end_of_memory = mpc85xx_find_end_of_memory;
+
+	ppc_md.time_init = NULL;
+	ppc_md.set_rtc_time = NULL;
+	ppc_md.get_rtc_time = NULL;
+	ppc_md.calibrate_decr = mpc85xx_calibrate_decr;
+
+	if (ppc_md.progress)
+		ppc_md.progress("mpc8560ads_init(): exit", 0);
+
+	return;
+}
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/85xx/mpc8560_ads.h linux-2.6.8-rc3/arch/ppc/platforms/85xx/mpc8560_ads.h
--- linux-2.6.8-rc2/arch/ppc/platforms/85xx/mpc8560_ads.h	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc/platforms/85xx/mpc8560_ads.h	2004-08-03 15:21:33.858608923 -0700
@@ -0,0 +1,27 @@
+/*
+ * arch/ppc/platforms/mpc8560_ads.h
+ *
+ * MPC8540ADS board definitions
+ *
+ * Maintainer: Kumar Gala <kumar.gala@freescale.com>
+ *
+ * Copyright 2004 Freescale Semiconductor Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ */
+
+#ifndef __MACH_MPC8560ADS_H
+#define __MACH_MPC8560ADS_H
+
+#include <linux/config.h>
+#include <syslib/ppc85xx_setup.h>
+#include <platforms/85xx/mpc85xx_ads_common.h>
+
+#define CPM_MAP_ADDR	(CCSRBAR + MPC85xx_CPM_OFFSET)
+#define PHY_INTERRUPT	MPC85xx_IRQ_EXT7
+
+#endif				/* __MACH_MPC8560ADS_H */
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/85xx/mpc85xx_cds_common.c linux-2.6.8-rc3/arch/ppc/platforms/85xx/mpc85xx_cds_common.c
--- linux-2.6.8-rc2/arch/ppc/platforms/85xx/mpc85xx_cds_common.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc/platforms/85xx/mpc85xx_cds_common.c	2004-08-03 15:21:33.861609046 -0700
@@ -0,0 +1,473 @@
+/*
+ * arch/ppc/platform/85xx/mpc85xx_cds_common.c
+ *
+ * MPC85xx CDS board specific routines
+ *
+ * Maintainer: Kumar Gala <kumar.gala@freescale.com>
+ *
+ * Copyright 2004 Freescale Semiconductor, Inc
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/config.h>
+#include <linux/stddef.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/errno.h>
+#include <linux/reboot.h>
+#include <linux/pci.h>
+#include <linux/kdev_t.h>
+#include <linux/major.h>
+#include <linux/console.h>
+#include <linux/delay.h>
+#include <linux/irq.h>
+#include <linux/seq_file.h>
+#include <linux/serial.h>
+#include <linux/module.h>
+#include <linux/root_dev.h>
+#include <linux/initrd.h>
+#include <linux/tty.h>
+#include <linux/serial_core.h>
+
+#include <asm/system.h>
+#include <asm/pgtable.h>
+#include <asm/page.h>
+#include <asm/atomic.h>
+#include <asm/time.h>
+#include <asm/io.h>
+#include <asm/machdep.h>
+#include <asm/prom.h>
+#include <asm/open_pic.h>
+#include <asm/bootinfo.h>
+#include <asm/pci-bridge.h>
+#include <asm/mpc85xx.h>
+#include <asm/irq.h>
+#include <asm/immap_85xx.h>
+#include <asm/immap_cpm2.h>
+#include <asm/ocp.h>
+#include <asm/kgdb.h>
+
+#include <mm/mmu_decl.h>
+#include <syslib/cpm2_pic.h>
+#include <syslib/ppc85xx_common.h>
+#include <syslib/ppc85xx_setup.h>
+
+
+#ifndef CONFIG_PCI
+unsigned long isa_io_base = 0;
+unsigned long isa_mem_base = 0;
+#endif
+
+extern unsigned long total_memory;      /* in mm/init */
+
+unsigned char __res[sizeof (bd_t)];
+
+static int cds_pci_slot = 2;
+static volatile u8 * cadmus;
+
+/* Internal interrupts are all Level Sensitive, and Positive Polarity */
+
+static u_char mpc85xx_cds_openpic_initsenses[] __initdata = {
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal  0: L2 Cache */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal  1: ECM */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal  2: DDR DRAM */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal  3: LBIU */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal  4: DMA 0 */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal  5: DMA 1 */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal  6: DMA 2 */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal  7: DMA 3 */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal  8: PCI/PCI-X */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal  9: RIO Inbound Port Write Error */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 10: RIO Doorbell Inbound */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 11: RIO Outbound Message */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 12: RIO Inbound Message */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 13: TSEC 0 Transmit */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 14: TSEC 0 Receive */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 15: Unused */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 16: Unused */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 17: Unused */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 18: TSEC 0 Receive/Transmit Error */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 19: TSEC 1 Transmit */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 20: TSEC 1 Receive */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 21: Unused */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 22: Unused */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 23: Unused */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 24: TSEC 1 Receive/Transmit Error */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 25: Fast Ethernet */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 26: DUART */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 27: I2C */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 28: Performance Monitor */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 29: Unused */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 30: CPM */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_POSITIVE),        /* Internal 31: Unused */
+#if defined(CONFIG_PCI)
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_NEGATIVE),      /* External 0: PCI1 slot */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_NEGATIVE),      /* External 1: PCI1 slot */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_NEGATIVE),      /* External 2: PCI1 slot */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_NEGATIVE),      /* External 3: PCI1 slot */
+#else
+        0x0,                            /* External  0: */
+        0x0,                            /* External  1: */
+        0x0,                            /* External  2: */
+        0x0,                            /* External  3: */
+#endif
+        0x0,                            /* External  4: */
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_NEGATIVE),      /* External 5: PHY */
+        0x0,                            /* External  6: */
+        0x0,                            /* External  7: */
+        0x0,                            /* External  8: */
+        0x0,                            /* External  9: */
+        0x0,                            /* External 10: */
+#if defined(CONFIG_85xx_PCI2) && defined(CONFIG_PCI)
+        (IRQ_SENSE_LEVEL | IRQ_POLARITY_NEGATIVE),      /* External 11: PCI2 slot 0 */
+#else
+        0x0,                            /* External 11: */
+#endif
+};
+
+struct ocp_gfar_data mpc85xx_tsec1_def = {
+        .interruptTransmit = MPC85xx_IRQ_TSEC1_TX,
+        .interruptError = MPC85xx_IRQ_TSEC1_ERROR,
+        .interruptReceive = MPC85xx_IRQ_TSEC1_RX,
+        .interruptPHY = MPC85xx_IRQ_EXT5,
+        .flags = (GFAR_HAS_GIGABIT | GFAR_HAS_MULTI_INTR |
+                        GFAR_HAS_PHY_INTR),
+        .phyid = 0,
+        .phyregidx = 0,
+};
+
+struct ocp_gfar_data mpc85xx_tsec2_def = {
+        .interruptTransmit = MPC85xx_IRQ_TSEC2_TX,
+        .interruptError = MPC85xx_IRQ_TSEC2_ERROR,
+        .interruptReceive = MPC85xx_IRQ_TSEC2_RX,
+        .interruptPHY = MPC85xx_IRQ_EXT5,
+        .flags = (GFAR_HAS_GIGABIT | GFAR_HAS_MULTI_INTR |
+                        GFAR_HAS_PHY_INTR),
+        .phyid = 1,
+        .phyregidx = 0,
+};
+
+struct ocp_fs_i2c_data mpc85xx_i2c1_def = {
+	.flags = FS_I2C_SEPARATE_DFSRR,
+};
+
+/* ************************************************************************ */
+int
+mpc85xx_cds_show_cpuinfo(struct seq_file *m)
+{
+        uint pvid, svid, phid1;
+        uint memsize = total_memory;
+        bd_t *binfo = (bd_t *) __res;
+        unsigned int freq;
+
+        /* get the core frequency */
+        freq = binfo->bi_intfreq;
+
+        pvid = mfspr(PVR);
+        svid = mfspr(SVR);
+
+        seq_printf(m, "Vendor\t\t: Freescale Semiconductor\n");
+	seq_printf(m, "Machine\t\t: CDS (%x)\n", cadmus[CM_VER]);
+        seq_printf(m, "bus freq\t: %u.%.6u MHz\n", freq / 1000000,
+                   freq % 1000000);
+        seq_printf(m, "PVR\t\t: 0x%x\n", pvid);
+        seq_printf(m, "SVR\t\t: 0x%x\n", svid);
+
+        /* Display cpu Pll setting */
+        phid1 = mfspr(HID1);
+        seq_printf(m, "PLL setting\t: 0x%x\n", ((phid1 >> 24) & 0x3f));
+
+        /* Display the amount of memory */
+        seq_printf(m, "Memory\t\t: %d MB\n", memsize / (1024 * 1024));
+
+        return 0;
+}
+
+#ifdef CONFIG_CPM2
+static void cpm2_cascade(int irq, void *dev_id, struct pt_regs *regs)
+{
+	while((irq = cpm2_get_irq(regs)) >= 0)
+	{
+		ppc_irq_dispatch_handler(regs,irq);
+	}
+}
+#endif /* CONFIG_CPM2 */
+
+void __init
+mpc85xx_cds_init_IRQ(void)
+{
+	bd_t *binfo = (bd_t *) __res;
+#ifdef CONFIG_CPM2
+	volatile cpm2_map_t *immap = cpm2_immr;
+	int i;
+#endif
+
+        /* Determine the Physical Address of the OpenPIC regs */
+        phys_addr_t OpenPIC_PAddr = binfo->bi_immr_base + MPC85xx_OPENPIC_OFFSET;
+        OpenPIC_Addr = ioremap(OpenPIC_PAddr, MPC85xx_OPENPIC_SIZE);
+        OpenPIC_InitSenses = mpc85xx_cds_openpic_initsenses;
+        OpenPIC_NumInitSenses = sizeof (mpc85xx_cds_openpic_initsenses);
+
+        /* Skip reserved space and internal sources */
+        openpic_set_sources(0, 32, OpenPIC_Addr + 0x10200);
+        /* Map PIC IRQs 0-11 */
+        openpic_set_sources(32, 12, OpenPIC_Addr + 0x10000);
+
+        /* we let openpic interrupts starting from an offset, to
+         * leave space for cascading interrupts underneath.
+         */
+        openpic_init(MPC85xx_OPENPIC_IRQ_OFFSET);
+
+#ifdef CONFIG_CPM2
+	/* disable all CPM interupts */
+	immap->im_intctl.ic_simrh = 0x0;
+	immap->im_intctl.ic_simrl = 0x0;
+
+	for (i = CPM_IRQ_OFFSET; i < (NR_CPM_INTS + CPM_IRQ_OFFSET); i++)
+		irq_desc[i].handler = &cpm2_pic;
+
+	/* Initialize the default interrupt mapping priorities,
+	 * in case the boot rom changed something on us.
+	 */
+	immap->im_intctl.ic_sicr = 0;
+	immap->im_intctl.ic_scprrh = 0x05309770;
+	immap->im_intctl.ic_scprrl = 0x05309770;
+
+	request_irq(MPC85xx_IRQ_CPM, cpm2_cascade, SA_INTERRUPT, "cpm2_cascade", NULL);
+#endif
+
+        return;
+}
+
+#ifdef CONFIG_PCI
+/*
+ * interrupt routing
+ */
+int
+mpc85xx_map_irq(struct pci_dev *dev, unsigned char idsel, unsigned char pin)
+{
+	struct pci_controller *hose = pci_bus_to_hose(dev->bus->number);
+
+	if (!hose->index)
+	{
+		/* Handle PCI1 interrupts */
+		char pci_irq_table[][4] =
+			/*
+			 *      PCI IDSEL/INTPIN->INTLINE
+			 *        A      B      C      D
+			 */
+
+			/* Note IRQ assignment for slots is based on which slot the elysium is
+			 * in -- in this setup elysium is in slot #2 (this PIRQA as first
+			 * interrupt on slot */
+		{
+			{ 0, 1, 2, 3 }, /* 16 - PMC */
+			{ 3, 0, 0, 0 }, /* 17 P2P (Tsi320) */
+			{ 0, 1, 2, 3 }, /* 18 - Slot 1 */
+			{ 1, 2, 3, 0 }, /* 19 - Slot 2 */
+			{ 2, 3, 0, 1 }, /* 20 - Slot 3 */
+			{ 3, 0, 1, 2 }, /* 21 - Slot 4 */
+		};
+
+		const long min_idsel = 16, max_idsel = 21, irqs_per_slot = 4;
+		int i, j;
+
+		for (i = 0; i < 6; i++)
+			for (j = 0; j < 4; j++)
+				pci_irq_table[i][j] =
+					((pci_irq_table[i][j] + 5 -
+					  cds_pci_slot) & 0x3) + PIRQ0A;
+
+		return PCI_IRQ_TABLE_LOOKUP;
+	} else {
+		/* Handle PCI2 interrupts (if we have one) */
+		char pci_irq_table[][4] =
+		{
+			/*
+			 * We only have one slot and one interrupt
+			 * going to PIRQA - PIRQD */
+			{ PIRQ1A, PIRQ1A, PIRQ1A, PIRQ1A }, /* 21 - slot 0 */
+		};
+
+		const long min_idsel = 21, max_idsel = 21, irqs_per_slot = 4;
+
+		return PCI_IRQ_TABLE_LOOKUP;
+	}
+}
+
+#define ARCADIA_HOST_BRIDGE_IDSEL     17
+#define ARCADIA_2ND_BRIDGE_IDSEL     3
+
+int
+mpc85xx_exclude_device(u_char bus, u_char devfn)
+{
+	if (bus == 0 && PCI_SLOT(devfn) == 0)
+		return PCIBIOS_DEVICE_NOT_FOUND;
+#if CONFIG_85xx_PCI2
+	/* With the current code we know PCI2 will be bus 2, however this may
+	 * not be guarnteed */
+	if (bus == 2 && PCI_SLOT(devfn) == 0)
+		return PCIBIOS_DEVICE_NOT_FOUND;
+#endif
+	/* We explicitly do not go past the Tundra 320 Bridge */
+	if (bus == 1)
+		return PCIBIOS_DEVICE_NOT_FOUND;
+	if ((bus == 0) && (PCI_SLOT(devfn) == ARCADIA_2ND_BRIDGE_IDSEL))
+		return PCIBIOS_DEVICE_NOT_FOUND;
+	else
+		return PCIBIOS_SUCCESSFUL;
+}
+#endif /* CONFIG_PCI */
+
+/* ************************************************************************
+ *
+ * Setup the architecture
+ *
+ */
+static void __init
+mpc85xx_cds_setup_arch(void)
+{
+        struct ocp_def *def;
+        struct ocp_gfar_data *einfo;
+        bd_t *binfo = (bd_t *) __res;
+        unsigned int freq;
+
+        /* get the core frequency */
+        freq = binfo->bi_intfreq;
+
+        printk("mpc85xx_cds_setup_arch\n");
+
+#ifdef CONFIG_CPM2
+	cpm2_reset();
+#endif
+
+	cadmus = ioremap(CADMUS_BASE, CADMUS_SIZE);
+	cds_pci_slot = ((cadmus[CM_CSR] >> 6) & 0x3) + 1;
+	printk("CDS Version = %x in PCI slot %d\n", cadmus[CM_VER], cds_pci_slot);
+
+        /* Set loops_per_jiffy to a half-way reasonable value,
+           for use until calibrate_delay gets called. */
+        loops_per_jiffy = freq / HZ;
+
+#ifdef CONFIG_PCI
+        /* setup PCI host bridges */
+        mpc85xx_setup_hose();
+#endif
+
+#ifdef CONFIG_DUMMY_CONSOLE
+        conswitchp = &dummy_con;
+#endif
+
+#ifdef CONFIG_SERIAL_8250
+        mpc85xx_early_serial_map();
+#endif
+
+#ifdef CONFIG_SERIAL_TEXT_DEBUG
+	/* Invalidate the entry we stole earlier the serial ports
+	 * should be properly mapped */
+	invalidate_tlbcam_entry(NUM_TLBCAMS - 1);
+#endif
+
+        def = ocp_get_one_device(OCP_VENDOR_FREESCALE, OCP_FUNC_GFAR, 0);
+        if (def) {
+                einfo = (struct ocp_gfar_data *) def->additions;
+                memcpy(einfo->mac_addr, binfo->bi_enetaddr, 6);
+        }
+
+        def = ocp_get_one_device(OCP_VENDOR_FREESCALE, OCP_FUNC_GFAR, 1);
+        if (def) {
+                einfo = (struct ocp_gfar_data *) def->additions;
+                memcpy(einfo->mac_addr, binfo->bi_enet1addr, 6);
+        }
+
+#ifdef CONFIG_BLK_DEV_INITRD
+        if (initrd_start)
+                ROOT_DEV = Root_RAM0;
+        else
+#endif
+#ifdef  CONFIG_ROOT_NFS
+                ROOT_DEV = Root_NFS;
+#else
+                ROOT_DEV = Root_HDA1;
+#endif
+
+	ocp_for_each_device(mpc85xx_update_paddr_ocp, &(binfo->bi_immr_base));
+}
+
+/* ************************************************************************ */
+void __init
+platform_init(unsigned long r3, unsigned long r4, unsigned long r5,
+              unsigned long r6, unsigned long r7)
+{
+        /* parse_bootinfo must always be called first */
+        parse_bootinfo(find_bootinfo());
+
+        /*
+         * If we were passed in a board information, copy it into the
+         * residual data area.
+         */
+        if (r3) {
+                memcpy((void *) __res, (void *) (r3 + KERNELBASE),
+                       sizeof (bd_t));
+
+        }
+#ifdef CONFIG_SERIAL_TEXT_DEBUG
+	{
+		bd_t *binfo = (bd_t *) __res;
+
+		/* Use the last TLB entry to map CCSRBAR to allow access to DUART regs */
+		settlbcam(NUM_TLBCAMS - 1, binfo->bi_immr_base,
+			binfo->bi_immr_base, MPC85xx_CCSRBAR_SIZE, _PAGE_IO, 0);
+
+	}
+#endif
+
+#if defined(CONFIG_BLK_DEV_INITRD)
+        /*
+         * If the init RAM disk has been configured in, and there's a valid
+         * starting address for it, set it up.
+         */
+        if (r4) {
+                initrd_start = r4 + KERNELBASE;
+                initrd_end = r5 + KERNELBASE;
+        }
+#endif                          /* CONFIG_BLK_DEV_INITRD */
+
+        /* Copy the kernel command line arguments to a safe place. */
+
+        if (r6) {
+                *(char *) (r7 + KERNELBASE) = 0;
+                strcpy(cmd_line, (char *) (r6 + KERNELBASE));
+        }
+
+        /* setup the PowerPC module struct */
+        ppc_md.setup_arch = mpc85xx_cds_setup_arch;
+        ppc_md.show_cpuinfo = mpc85xx_cds_show_cpuinfo;
+
+        ppc_md.init_IRQ = mpc85xx_cds_init_IRQ;
+        ppc_md.get_irq = openpic_get_irq;
+
+        ppc_md.restart = mpc85xx_restart;
+        ppc_md.power_off = mpc85xx_power_off;
+        ppc_md.halt = mpc85xx_halt;
+
+        ppc_md.find_end_of_memory = mpc85xx_find_end_of_memory;
+
+        ppc_md.time_init = NULL;
+        ppc_md.set_rtc_time = NULL;
+        ppc_md.get_rtc_time = NULL;
+        ppc_md.calibrate_decr = mpc85xx_calibrate_decr;
+
+#if defined(CONFIG_SERIAL_8250) && defined(CONFIG_SERIAL_TEXT_DEBUG)
+        ppc_md.progress = gen550_progress;
+#endif /* CONFIG_SERIAL_8250 && CONFIG_SERIAL_TEXT_DEBUG */
+
+        if (ppc_md.progress)
+                ppc_md.progress("mpc85xx_cds_init(): exit", 0);
+
+        return;
+}
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/85xx/mpc85xx_cds_common.h linux-2.6.8-rc3/arch/ppc/platforms/85xx/mpc85xx_cds_common.h
--- linux-2.6.8-rc2/arch/ppc/platforms/85xx/mpc85xx_cds_common.h	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc/platforms/85xx/mpc85xx_cds_common.h	2004-08-03 15:21:33.861609046 -0700
@@ -0,0 +1,78 @@
+/*
+ * arch/ppc/platforms/85xx/mpc85xx_cds_common.h
+ *
+ * MPC85xx CDS board definitions
+ *
+ * Maintainer: Kumar Gala <kumar.gala@freescale.com>
+ *
+ * Copyright 2004 Freescale Semiconductor, Inc
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ */
+
+#ifndef __MACH_MPC85XX_CDS_H__
+#define __MACH_MPC85XX_CDS_H__
+
+#include <linux/config.h>
+#include <linux/serial.h>
+#include <asm/ppcboot.h>
+#include <linux/initrd.h>
+#include <syslib/ppc85xx_setup.h>
+
+#define BOARD_CCSRBAR           ((uint)0xe0000000)
+#define CCSRBAR_SIZE            ((uint)1024*1024)
+
+/* CADMUS info */
+#define CADMUS_BASE (0xf8004000)
+#define CADMUS_SIZE (256)
+#define CM_VER	(0)
+#define CM_CSR	(1)
+#define CM_RST	(2)
+
+/* PCI config */
+#define PCI1_CFG_ADDR_OFFSET	(0x8000)
+#define PCI1_CFG_DATA_OFFSET	(0x8004)
+
+#define PCI2_CFG_ADDR_OFFSET	(0x9000)
+#define PCI2_CFG_DATA_OFFSET	(0x9004)
+
+/* PCI interrupt controller */
+#define PIRQ0A                   MPC85xx_IRQ_EXT0
+#define PIRQ0B                   MPC85xx_IRQ_EXT1
+#define PIRQ0C                   MPC85xx_IRQ_EXT2
+#define PIRQ0D                   MPC85xx_IRQ_EXT3
+#define PIRQ1A                   MPC85xx_IRQ_EXT11
+
+/* PCI 1 memory map */
+#define MPC85XX_PCI1_LOWER_IO        0x00000000
+#define MPC85XX_PCI1_UPPER_IO        0x00ffffff
+
+#define MPC85XX_PCI1_LOWER_MEM       0x80000000
+#define MPC85XX_PCI1_UPPER_MEM       0x9fffffff
+
+#define MPC85XX_PCI1_IO_BASE         0xe2000000
+#define MPC85XX_PCI1_MEM_OFFSET      0x00000000
+
+#define MPC85XX_PCI1_IO_SIZE         0x01000000
+
+/* PCI 2 memory map */
+#define MPC85XX_PCI2_LOWER_IO        0x01000000
+#define MPC85XX_PCI2_UPPER_IO        0x01ffffff
+
+#define MPC85XX_PCI2_LOWER_MEM       0xa0000000
+#define MPC85XX_PCI2_UPPER_MEM       0xbfffffff
+
+#define MPC85XX_PCI2_IO_BASE         0xe3000000
+#define MPC85XX_PCI2_MEM_OFFSET      0x00000000
+
+#define MPC85XX_PCI2_IO_SIZE         0x01000000
+
+#define SERIAL_PORT_DFNS		\
+	       STD_UART_OP(0)		\
+	       STD_UART_OP(1)
+
+#endif /* __MACH_MPC85XX_CDS_H__ */
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/85xx/sbc8560.c linux-2.6.8-rc3/arch/ppc/platforms/85xx/sbc8560.c
--- linux-2.6.8-rc2/arch/ppc/platforms/85xx/sbc8560.c	2004-08-03 15:21:05.704454190 -0700
+++ linux-2.6.8-rc3/arch/ppc/platforms/85xx/sbc8560.c	2004-08-03 15:21:33.862609087 -0700
@@ -30,6 +30,7 @@
 #include <linux/serial.h>
 #include <linux/tty.h>	/* for linux/serial_core.h */
 #include <linux/serial_core.h>
+#include <linux/initrd.h>
 #include <linux/module.h>
 
 #include <asm/system.h>
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/85xx/sbc8560.h linux-2.6.8-rc3/arch/ppc/platforms/85xx/sbc8560.h
--- linux-2.6.8-rc2/arch/ppc/platforms/85xx/sbc8560.h	2004-08-03 15:21:05.705454231 -0700
+++ linux-2.6.8-rc3/arch/ppc/platforms/85xx/sbc8560.h	2004-08-03 15:21:33.863609128 -0700
@@ -16,8 +16,9 @@
 #define __MACH_SBC8560_H__
  
 #include <linux/config.h>
-#include <linux/serial.h>
 #include <platforms/85xx/sbc85xx.h>
+
+#define CPM_MAP_ADDR    (CCSRBAR + MPC85xx_CPM_OFFSET)
  
 #ifdef CONFIG_SERIAL_MANY_PORTS
 #define RS_TABLE_SIZE  64
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/Makefile linux-2.6.8-rc3/arch/ppc/platforms/Makefile
--- linux-2.6.8-rc2/arch/ppc/platforms/Makefile	2004-08-03 15:21:05.707454313 -0700
+++ linux-2.6.8-rc3/arch/ppc/platforms/Makefile	2004-08-03 15:21:33.865609210 -0700
@@ -45,9 +45,11 @@
 obj-$(CONFIG_PPLUS)		+= pplus.o
 obj-$(CONFIG_PRPMC750)		+= prpmc750.o
 obj-$(CONFIG_PRPMC800)		+= prpmc800.o
+obj-$(CONFIG_RPX8260)		+= rpx8260.o
 obj-$(CONFIG_SANDPOINT)		+= sandpoint.o
 obj-$(CONFIG_SBC82xx)		+= sbc82xx.o
 obj-$(CONFIG_SPRUCE)		+= spruce.o
+obj-$(CONFIG_LITE5200)		+= lite5200.o mpc5200.o
 
 ifeq ($(CONFIG_SMP),y)
 obj-$(CONFIG_PPC_PMAC)		+= pmac_smp.o
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/lite5200.c linux-2.6.8-rc3/arch/ppc/platforms/lite5200.c
--- linux-2.6.8-rc2/arch/ppc/platforms/lite5200.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc/platforms/lite5200.c	2004-08-03 15:21:33.866609252 -0700
@@ -0,0 +1,152 @@
+/*
+ * arch/ppc/platforms/lite5200.c
+ *
+ * Platform support file for the Freescale LITE5200 based on MPC52xx.
+ * A maximum of this file should be moved to syslib/mpc52xx_?????
+ * so that new platform based on MPC52xx need a minimal platform file
+ * ( avoid code duplication )
+ *
+ * 
+ * Maintainer : Sylvain Munaut <tnt@246tNt.com>
+ *
+ * Based on the 2.4 code written by Kent Borg,
+ * Dale Farnsworth <dale.farnsworth@mvista.com> and
+ * Wolfgang Denk <wd@denx.de>
+ * 
+ * Copyright 2004 Sylvain Munaut <tnt@246tNt.com>
+ * Copyright 2003 Motorola Inc.
+ * Copyright 2003 MontaVista Software Inc.
+ * Copyright 2003 DENX Software Engineering (wd@denx.de)
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2. This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+
+#include <linux/config.h>
+#include <linux/initrd.h>
+#include <linux/seq_file.h>
+#include <linux/kdev_t.h>
+#include <linux/root_dev.h>
+#include <linux/console.h>
+
+#include <asm/bootinfo.h>
+#include <asm/io.h>
+#include <asm/ocp.h>
+#include <asm/mpc52xx.h>
+
+
+/* Board data given by U-Boot */
+bd_t __res;
+EXPORT_SYMBOL(__res);	/* For modules */
+
+
+/* ======================================================================== */
+/* OCP device definition                                                    */
+/* For board/shared resources like PSCs                                     */
+/* ======================================================================== */
+/* Be sure not to load conficting devices : e.g. loading the UART drivers for
+ * PSC1 and then also loading a AC97 for this same PSC.
+ * For details about how to create an entry, look in the doc of the concerned
+ * driver ( eg drivers/serial/mpc52xx_uart.c for the PSC in uart mode )
+ */
+
+struct ocp_def board_ocp[] = {
+	{
+		.vendor		= OCP_VENDOR_FREESCALE,
+		.function	= OCP_FUNC_PSC_UART,
+		.index		= 0,
+		.paddr		= MPC52xx_PSC1,
+		.irq		= MPC52xx_PSC1_IRQ,
+		.pm		= OCP_CPM_NA,
+	},
+	{	/* Terminating entry */
+		.vendor		= OCP_VENDOR_INVALID
+	}
+};
+	
+
+/* ======================================================================== */
+/* Platform specific code                                                   */
+/* ======================================================================== */
+
+static int
+icecube_show_cpuinfo(struct seq_file *m)
+{
+	seq_printf(m, "machine\t\t: Freescale LITE5200\n");
+	return 0;
+}
+
+static void __init
+icecube_setup_arch(void)
+{
+
+	/* Add board OCP definitions */
+	mpc52xx_add_board_devices(board_ocp);
+}
+
+void __init
+platform_init(unsigned long r3, unsigned long r4, unsigned long r5,
+              unsigned long r6, unsigned long r7)
+{
+	/* Generic MPC52xx platform initialization */
+	/* TODO Create one and move a max of stuff in it.
+	   Put this init in the syslib */
+
+	struct bi_record *bootinfo = find_bootinfo();
+
+	if (bootinfo)
+		parse_bootinfo(bootinfo);
+	else {
+		/* Load the bd_t board info structure */
+		if (r3)
+			memcpy((void*)&__res,(void*)(r3+KERNELBASE),
+					sizeof(bd_t));
+
+#ifdef CONFIG_BLK_DEV_INITRD
+		/* Load the initrd */
+		if (r4) {
+			initrd_start = r4 + KERNELBASE;
+			initrd_end = r5 + KERNELBASE;
+		}
+#endif
+	
+		/* Load the command line */
+		if (r6) {
+			*(char *)(r7+KERNELBASE) = 0;
+			strcpy(cmd_line, (char *)(r6+KERNELBASE));
+		}
+	}
+
+	/* BAT setup */
+	mpc52xx_set_bat();
+	
+	/* No ISA bus AFAIK */
+	isa_io_base		= 0;
+	isa_mem_base		= 0;
+
+	/* Setup the ppc_md struct */
+	ppc_md.setup_arch	= icecube_setup_arch;
+	ppc_md.show_cpuinfo	= icecube_show_cpuinfo;
+	ppc_md.show_percpuinfo	= NULL;
+	ppc_md.init_IRQ		= mpc52xx_init_irq;
+	ppc_md.get_irq		= mpc52xx_get_irq;
+
+	ppc_md.find_end_of_memory = mpc52xx_find_end_of_memory;
+	ppc_md.setup_io_mappings  = mpc52xx_map_io;
+
+	ppc_md.restart		= mpc52xx_restart;
+	ppc_md.power_off	= mpc52xx_power_off;
+	ppc_md.halt		= mpc52xx_halt;
+	
+		/* No time keeper on the IceCube */
+	ppc_md.time_init	= NULL;
+	ppc_md.get_rtc_time	= NULL;
+	ppc_md.set_rtc_time	= NULL;
+	
+	ppc_md.calibrate_decr	= mpc52xx_calibrate_decr;
+#ifdef CONFIG_SERIAL_TEXT_DEBUG
+	ppc_md.progress		= mpc52xx_progress;
+#endif
+}
+
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/lite5200.h linux-2.6.8-rc3/arch/ppc/platforms/lite5200.h
--- linux-2.6.8-rc2/arch/ppc/platforms/lite5200.h	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc/platforms/lite5200.h	2004-08-03 15:21:33.867609293 -0700
@@ -0,0 +1,23 @@
+/*
+ * arch/ppc/platforms/lite5200.h
+ * 
+ * Definitions for Freescale LITE5200 : MPC52xx Standard Development
+ * Platform board support
+ * 
+ * Maintainer : Sylvain Munaut <tnt@246tNt.com>
+ * 
+ * Copyright (C) 2004 Sylvain Munaut <tnt@246tNt.com>
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2. This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+
+#ifndef __PLATFORMS_LITE5200_H__
+#define __PLATFORMS_LITE5200_H__
+
+/* Serial port used for low-level debug */
+#define MPC52xx_PF_CONSOLE_PORT 0	/* PSC1 */
+
+
+#endif /* __PLATFORMS_LITE5200_H__ */
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/mpc5200.c linux-2.6.8-rc3/arch/ppc/platforms/mpc5200.c
--- linux-2.6.8-rc2/arch/ppc/platforms/mpc5200.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc/platforms/mpc5200.c	2004-08-03 15:21:33.868609334 -0700
@@ -0,0 +1,29 @@
+/*
+ * arch/ppc/platforms/mpc5200.c
+ *
+ * OCP Definitions for the boards based on MPC5200 processor. Contains
+ * definitions for every common peripherals. (Mostly all but PSCs)
+ * 
+ * Maintainer : Sylvain Munaut <tnt@246tNt.com>
+ *
+ * Copyright 2004 Sylvain Munaut <tnt@246tNt.com>
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2. This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+
+#include <asm/ocp.h>
+#include <asm/mpc52xx.h>
+
+/* Here is the core_ocp struct.
+ * With all the devices common to all board. Even if port multiplexing is
+ * not setup for them (if the user don't want them, just don't select the
+ * config option). The potentially conflicting devices (like PSCs) goes in
+ * board specific file.
+ */
+struct ocp_def core_ocp[] = {
+	{	/* Terminating entry */
+		.vendor		= OCP_VENDOR_INVALID
+	}
+};
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/pmac_cpufreq.c linux-2.6.8-rc3/arch/ppc/platforms/pmac_cpufreq.c
--- linux-2.6.8-rc2/arch/ppc/platforms/pmac_cpufreq.c	2004-08-03 15:21:05.710454436 -0700
+++ linux-2.6.8-rc3/arch/ppc/platforms/pmac_cpufreq.c	2004-08-03 15:21:33.869609375 -0700
@@ -469,6 +469,7 @@
 static int __pmac pmac_cpufreq_init_7447A(struct device_node *cpunode)
 {
 	struct device_node *volt_gpio_np;
+	u32 *reg;
 
 	/* OF only reports the high frequency */
 	hi_freq = cur_freq;
@@ -484,7 +485,7 @@
 		return 1;
 	}
 
-	u32 *reg = (u32 *)get_property(volt_gpio_np, "reg", NULL);
+	reg = (u32 *)get_property(volt_gpio_np, "reg", NULL);
 	voltage_gpio = *reg;
 	set_speed_proc = dfs_set_cpu_speed;
 
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/pmac_pci.c linux-2.6.8-rc3/arch/ppc/platforms/pmac_pci.c
--- linux-2.6.8-rc2/arch/ppc/platforms/pmac_pci.c	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/platforms/pmac_pci.c	2004-08-03 15:21:33.885610031 -0700
@@ -72,7 +72,7 @@
 		int len;
 
 		/* For PCI<->PCI bridges or CardBus bridges, we go down */
-		class_code = (unsigned int *) get_property(node, "class-code", 0);
+		class_code = (unsigned int *) get_property(node, "class-code", NULL);
 		if (!class_code || ((*class_code >> 8) != PCI_CLASS_BRIDGE_PCI &&
 			(*class_code >> 8) != PCI_CLASS_BRIDGE_CARDBUS))
 			continue;
@@ -124,9 +124,9 @@
  * (iBook, G4, new IMacs, and all the recent Apple machines).
  * It contains 3 controllers in one ASIC.
  *
- * The U3 is the bridge used on G5 machines. It contains on
+ * The U3 is the bridge used on G5 machines. It contains an
  * AGP bus which is dealt with the old UniNorth access routines
- * and an HyperTransport bus which uses its own set of access
+ * and a HyperTransport bus which uses its own set of access
  * functions.
  */
 
@@ -509,7 +509,7 @@
 			continue;
 		if (0x0035 != *prop)
 			continue;
-		prop = (u32 *)get_property(nec, "reg", 0);
+		prop = (u32 *)get_property(nec, "reg", NULL);
 		if (prop == NULL)
 			continue;
 		devfn = (prop[0] >> 8) & 0xff;
@@ -705,7 +705,7 @@
 	 * any of the 0xfxxxxxxx "fine" memory regions to /ht.
 	 * We need to fix that sooner or later by either parsing all child "ranges"
 	 * properties or figuring out the U3 address space decoding logic and
-	 * then read it's configuration register (if any).
+	 * then read its configuration register (if any).
 	 */
 	hose->io_base_phys = 0xf4000000 + 0x00400000;
 	hose->io_base_virt = ioremap(hose->io_base_phys, 0x00400000);
@@ -939,8 +939,8 @@
 		 * default, gmac is not powered up, and so will be absent
 		 * from the kernel initial PCI lookup.
 		 *
-		 * Should be replaced by 2.4 new PCI mecanisms and really
-		 * regiser the device.
+		 * Should be replaced by 2.4 new PCI mechanisms and really
+		 * register the device.
 		 */
 		pci_read_config_word(dev, PCI_COMMAND, &cmd);
 		cmd |= PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER | PCI_COMMAND_INVALIDATE;
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/pmac_pic.c linux-2.6.8-rc3/arch/ppc/platforms/pmac_pic.c
--- linux-2.6.8-rc2/arch/ppc/platforms/pmac_pic.c	2004-06-15 22:19:53.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/platforms/pmac_pic.c	2004-08-03 15:21:33.886610072 -0700
@@ -144,6 +144,22 @@
 	spin_unlock_irqrestore(&pmac_pic_lock, flags);
 }
 
+/* When an irq gets requested for the first client, if it's an
+ * edge interrupt, we clear any previous one on the controller
+ */
+static unsigned int __pmac pmac_startup_irq(unsigned int irq_nr)
+{
+        unsigned long bit = 1UL << (irq_nr & 0x1f);
+        int i = irq_nr >> 5;
+
+	if ((irq_desc[irq_nr].status & IRQ_LEVEL) == 0)
+		out_le32(&pmac_irq_hw[i]->ack, bit);
+        set_bit(irq_nr, ppc_cached_irq_mask);
+        pmac_set_irq_mask(irq_nr, 0);
+
+	return 0;
+}
+
 static void __pmac pmac_mask_irq(unsigned int irq_nr)
 {
         clear_bit(irq_nr, ppc_cached_irq_mask);
@@ -168,25 +184,21 @@
 
 
 struct hw_interrupt_type pmac_pic = {
-        " PMAC-PIC ",
-        NULL,
-        NULL,
-        pmac_unmask_irq,
-        pmac_mask_irq,
-        pmac_mask_and_ack_irq,
-        pmac_end_irq,
-        NULL
+	.typename	= " PMAC-PIC ",
+	.startup	= pmac_startup_irq,
+	.enable		= pmac_unmask_irq,
+	.disable	= pmac_mask_irq,
+	.ack		= pmac_mask_and_ack_irq,
+	.end		= pmac_end_irq,
 };
 
 struct hw_interrupt_type gatwick_pic = {
-	" GATWICK  ",
-	NULL,
-	NULL,
-	pmac_unmask_irq,
-	pmac_mask_irq,
-	pmac_mask_and_ack_irq,
-	pmac_end_irq,
-	NULL
+	.typename	= " GATWICK  ",
+	.startup	= pmac_startup_irq,
+	.enable		= pmac_unmask_irq,
+	.disable	= pmac_mask_irq,
+	.ack		= pmac_mask_and_ack_irq,
+	.end		= pmac_end_irq,
 };
 
 static irqreturn_t gatwick_action(int cpl, void *dev_id, struct pt_regs *regs)
@@ -444,7 +456,7 @@
 					nmi_irq = pswitch->intrs[0].line;
 					openpic_init_nmi_irq(nmi_irq);
 					request_irq(nmi_irq, xmon_irq, 0,
-						    "NMI - XMON", 0);
+						    "NMI - XMON", NULL);
 				}
 			}
 #endif	/* CONFIG_XMON */
@@ -542,7 +554,7 @@
 		for ( i = max_real_irqs ; i < max_irqs ; i++ )
 			irq_desc[i].handler = &gatwick_pic;
 		request_irq( irq_cascade, gatwick_action, SA_INTERRUPT,
-			     "cascade", 0 );
+			     "cascade", NULL );
 	}
 	printk("System has %d possible interrupts\n", max_irqs);
 	if (max_irqs != max_real_irqs)
@@ -550,7 +562,7 @@
 			max_real_irqs);
 
 #ifdef CONFIG_XMON
-	request_irq(20, xmon_irq, 0, "NMI - XMON", 0);
+	request_irq(20, xmon_irq, 0, "NMI - XMON", NULL);
 #endif	/* CONFIG_XMON */
 }
 
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/pmac_smp.c linux-2.6.8-rc3/arch/ppc/platforms/pmac_smp.c
--- linux-2.6.8-rc2/arch/ppc/platforms/pmac_smp.c	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/platforms/pmac_smp.c	2004-08-03 15:21:33.887610113 -0700
@@ -421,7 +421,7 @@
 		/* reset the entry point so if we get another intr we won't
 		 * try to startup again */
 		out_be32(psurge_start, 0x100);
-		if (request_irq(30, psurge_primary_intr, SA_INTERRUPT, "primary IPI", 0))
+		if (request_irq(30, psurge_primary_intr, SA_INTERRUPT, "primary IPI", NULL))
 			printk(KERN_ERR "Couldn't get primary IPI interrupt");
 	}
 
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/prep_pci.c linux-2.6.8-rc3/arch/ppc/platforms/prep_pci.c
--- linux-2.6.8-rc2/arch/ppc/platforms/prep_pci.c	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/platforms/prep_pci.c	2004-08-03 15:21:33.892610318 -0700
@@ -741,7 +741,7 @@
 	}
 
 	/* Check the first PCI device to see if it is a Raven. */
-	early_read_config_dword(0, 0, 0, PCI_VENDOR_ID, &devid);
+	early_read_config_dword(NULL, 0, 0, PCI_VENDOR_ID, &devid);
 
 	switch (devid & 0xffff0000) {
 	case MPIC_RAVEN_ID:
@@ -757,7 +757,7 @@
 
 
 	/* Read the memory base register. */
-	early_read_config_dword(0, 0, 0, PCI_BASE_ADDRESS_1, &pci_membase);
+	early_read_config_dword(NULL, 0, 0, PCI_BASE_ADDRESS_1, &pci_membase);
 
 	if (pci_membase == 0) {
 		OpenPIC_Addr = NULL;
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/prep_setup.c linux-2.6.8-rc3/arch/ppc/platforms/prep_setup.c
--- linux-2.6.8-rc2/arch/ppc/platforms/prep_setup.c	2004-08-03 15:21:05.733455378 -0700
+++ linux-2.6.8-rc3/arch/ppc/platforms/prep_setup.c	2004-08-03 15:21:33.893610359 -0700
@@ -865,7 +865,7 @@
 		irq_desc[i].handler = &i8259_pic;
 	/* If we have a Raven PCI bridge or a Hawk PCI bridge / Memory
 	 * controller, we poll (as they have a different int-ack address). */
-	early_read_config_dword(0, 0, 0, PCI_VENDOR_ID, &pci_viddid);
+	early_read_config_dword(NULL, 0, 0, PCI_VENDOR_ID, &pci_viddid);
 	pci_did = (pci_viddid & 0xffff0000) >> 16;
 	if (((pci_viddid & 0xffff) == PCI_VENDOR_ID_MOTOROLA)
 			&& ((pci_did == PCI_DEVICE_ID_MOTOROLA_RAVEN)
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/residual.c linux-2.6.8-rc3/arch/ppc/platforms/residual.c
--- linux-2.6.8-rc2/arch/ppc/platforms/residual.c	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/platforms/residual.c	2004-08-03 15:21:33.895610441 -0700
@@ -802,7 +802,7 @@
 		     !(n--) ) return res->Devices+i;
 #undef Dev
 	}
-	return 0;
+	return NULL;
 }
 
 PPC_DEVICE __init *residual_find_device_id(unsigned long BusMask,
@@ -824,7 +824,7 @@
 		     !(n--) ) return res->Devices+i;
 #undef Dev
 	}
-	return 0;
+	return NULL;
 }
 
 PnP_TAG_PACKET *PnP_find_packet(unsigned char *p,
@@ -832,7 +832,7 @@
 				int n)
 {
 	unsigned mask, masked_tag, size;
-	if(!p) return 0;
+	if(!p) return NULL;
 	if (tag_type(packet_tag)) mask=0xff; else mask=0xF8;
 	masked_tag = packet_tag&mask;
 	for(; *p != END_TAG; p+=size) {
@@ -843,7 +843,7 @@
 		else
 			size=tag_small_count(*p)+1;
 	}
-	return 0; /* not found */
+	return NULL; /* not found */
 }
 
 PnP_TAG_PACKET __init *PnP_find_small_vendor_packet(unsigned char *p,
@@ -857,7 +857,7 @@
 			return (PnP_TAG_PACKET *) p;
 		next = 1;
 	};
-	return 0; /* not found */
+	return NULL; /* not found */
 }
 
 PnP_TAG_PACKET __init *PnP_find_large_vendor_packet(unsigned char *p,
@@ -871,7 +871,7 @@
 			return (PnP_TAG_PACKET *) p;
 		next = 1;
 	};
-	return 0; /* not found */
+	return NULL; /* not found */
 }
 
 #ifdef CONFIG_PROC_PREPRESIDUAL
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/rpx8260.c linux-2.6.8-rc3/arch/ppc/platforms/rpx8260.c
--- linux-2.6.8-rc2/arch/ppc/platforms/rpx8260.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc/platforms/rpx8260.c	2004-08-03 15:21:33.896610482 -0700
@@ -0,0 +1,65 @@
+/*
+ * arch/ppc/platforms/rpx8260.c
+ *
+ * RPC EP8260 platform support
+ *
+ * Author: Dan Malek <dan@embeddededge.com>
+ * Derived from: pq2ads_setup.c by Kumar
+ *
+ * Copyright 2004 Embedded Edge, LLC
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include <linux/config.h>
+#include <linux/seq_file.h>
+
+#include <asm/mpc8260.h>
+#include <asm/machdep.h>
+
+static void (*callback_setup_arch)(void);
+
+extern unsigned char __res[sizeof(bd_t)];
+
+extern void m8260_init(unsigned long r3, unsigned long r4,
+	unsigned long r5, unsigned long r6, unsigned long r7);
+
+static int
+ep8260_show_cpuinfo(struct seq_file *m)
+{
+	bd_t	*binfo = (bd_t *)__res;
+
+	seq_printf(m, "vendor\t\t: RPC\n"
+		      "machine\t\t: EP8260 PPC\n"
+		      "\n"
+		      "mem size\t\t: 0x%08x\n"
+		      "console baud\t\t: %d\n"
+		      "\n",
+		      binfo->bi_memsize,
+		      binfo->bi_baudrate);
+	return 0;
+}
+
+static void __init
+ep8260_setup_arch(void)
+{
+	printk("RPC EP8260 Port\n");
+	callback_setup_arch();
+}
+
+void __init
+platform_init(unsigned long r3, unsigned long r4, unsigned long r5,
+	      unsigned long r6, unsigned long r7)
+{
+	/* Generic 8260 platform initialization */
+	m8260_init(r3, r4, r5, r6, r7);
+
+	/* Anything special for this platform */
+	ppc_md.show_cpuinfo	= ep8260_show_cpuinfo;
+
+	callback_setup_arch	= ppc_md.setup_arch;
+	ppc_md.setup_arch	= ep8260_setup_arch;
+}
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/rpx8260.h linux-2.6.8-rc3/arch/ppc/platforms/rpx8260.h
--- linux-2.6.8-rc2/arch/ppc/platforms/rpx8260.h	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc/platforms/rpx8260.h	2004-08-03 15:21:33.897610523 -0700
@@ -0,0 +1,74 @@
+/*
+ * A collection of structures, addresses, and values associated with
+ * the Embedded Planet RPX6 (or RPX Super) MPC8260 board.
+ * Copied from the RPX-Classic and SBS8260 stuff.
+ *
+ * Copyright (c) 2001 Dan Malek <dan@embeddededge.com>
+ */
+#ifdef __KERNEL__
+#ifndef __ASM_PLATFORMS_RPX8260_H__
+#define __ASM_PLATFORMS_RPX8260_H__
+
+/* A Board Information structure that is given to a program when
+ * prom starts it up.
+ */
+typedef struct bd_info {
+	unsigned int	bi_memstart;	/* Memory start address */
+	unsigned int	bi_memsize;	/* Memory (end) size in bytes */
+	unsigned int	bi_nvsize;	/* NVRAM size in bytes (can be 0) */
+	unsigned int	bi_intfreq;	/* Internal Freq, in Hz */
+	unsigned int	bi_busfreq;	/* Bus Freq, in MHz */
+	unsigned int	bi_cpmfreq;	/* CPM Freq, in MHz */
+	unsigned int	bi_brgfreq;	/* BRG Freq, in MHz */
+	unsigned int	bi_vco;		/* VCO Out from PLL */
+	unsigned int	bi_baudrate;	/* Default console baud rate */
+	unsigned int	bi_immr;	/* IMMR when called from boot rom */
+	unsigned char	bi_enetaddr[6];
+} bd_t;
+
+extern bd_t m8xx_board_info;
+
+/* Memory map is configured by the PROM startup.
+ * We just map a few things we need.  The CSR is actually 4 byte-wide
+ * registers that can be accessed as 8-, 16-, or 32-bit values.
+ */
+#define CPM_MAP_ADDR		((uint)0xf0000000)
+#define RPX_CSR_ADDR		((uint)0xfa000000)
+#define RPX_CSR_SIZE		((uint)(512 * 1024))
+#define RPX_NVRTC_ADDR		((uint)0xfa080000)
+#define RPX_NVRTC_SIZE		((uint)(512 * 1024))
+
+/* The RPX6 has 16, byte wide control/status registers.
+ * Not all are used (yet).
+ */
+extern volatile u_char *rpx6_csr_addr;
+
+/* Things of interest in the CSR.
+*/
+#define BCSR0_ID_MASK		((u_char)0xf0)		/* Read only */
+#define BCSR0_SWITCH_MASK	((u_char)0x0f)		/* Read only */
+#define BCSR1_XCVR_SMC1		((u_char)0x80)
+#define BCSR1_XCVR_SMC2		((u_char)0x40)
+#define BCSR2_FLASH_WENABLE	((u_char)0x20)
+#define BCSR2_NVRAM_ENABLE	((u_char)0x10)
+#define BCSR2_ALT_IRQ2		((u_char)0x08)
+#define BCSR2_ALT_IRQ3		((u_char)0x04)
+#define BCSR2_PRST		((u_char)0x02)		/* Force reset */
+#define BCSR2_ENPRST		((u_char)0x01)		/* Enable POR */
+#define BCSR3_MODCLK_MASK	((u_char)0xe0)
+#define BCSR3_ENCLKHDR		((u_char)0x10)
+#define BCSR3_LED5		((u_char)0x04)		/* 0 == on */
+#define BCSR3_LED6		((u_char)0x02)		/* 0 == on */
+#define BCSR3_LED7		((u_char)0x01)		/* 0 == on */
+#define BCSR4_EN_PHY		((u_char)0x80)		/* Enable PHY */
+#define BCSR4_EN_MII		((u_char)0x40)		/* Enable PHY */
+#define BCSR4_MII_READ		((u_char)0x04)
+#define BCSR4_MII_MDC		((u_char)0x02)
+#define BCSR4_MII_MDIO		((u_char)0x01)
+#define BCSR13_FETH_IRQMASK	((u_char)0xf0)
+#define BCSR15_FETH_IRQ		((u_char)0x20)
+
+#define PHY_INTERRUPT	SIU_INT_IRQ7
+
+#endif /* __ASM_PLATFORMS_RPX8260_H__ */
+#endif /* __KERNEL__ */
diff -urN linux-2.6.8-rc2/arch/ppc/platforms/rpxsuper.h linux-2.6.8-rc3/arch/ppc/platforms/rpxsuper.h
--- linux-2.6.8-rc2/arch/ppc/platforms/rpxsuper.h	2004-08-03 15:21:05.734455419 -0700
+++ linux-2.6.8-rc3/arch/ppc/platforms/rpxsuper.h	1969-12-31 16:00:00.000000000 -0800
@@ -1,72 +0,0 @@
-/*
- * A collection of structures, addresses, and values associated with
- * the Embedded Planet RPX6 (or RPX Super) MPC8260 board.
- * Copied from the RPX-Classic and SBS8260 stuff.
- *
- * Copyright (c) 2001 Dan Malek <dan@embeddededge.com>
- */
-#ifdef __KERNEL__
-#ifndef __ASM_PLATFORMS_RPXSUPER_H__
-#define __ASM_PLATFORMS_RPXSUPER_H__
-
-/* A Board Information structure that is given to a program when
- * prom starts it up.
- */
-typedef struct bd_info {
-	unsigned int	bi_memstart;	/* Memory start address */
-	unsigned int	bi_memsize;	/* Memory (end) size in bytes */
-	unsigned int	bi_nvsize;	/* NVRAM size in bytes (can be 0) */
-	unsigned int	bi_intfreq;	/* Internal Freq, in Hz */
-	unsigned int	bi_busfreq;	/* Bus Freq, in MHz */
-	unsigned int	bi_cpmfreq;	/* CPM Freq, in MHz */
-	unsigned int	bi_brgfreq;	/* BRG Freq, in MHz */
-	unsigned int	bi_vco;		/* VCO Out from PLL */
-	unsigned int	bi_baudrate;	/* Default console baud rate */
-	unsigned int	bi_immr;	/* IMMR when called from boot rom */
-	unsigned char	bi_enetaddr[6];
-} bd_t;
-
-extern bd_t m8xx_board_info;
-
-/* Memory map is configured by the PROM startup.
- * We just map a few things we need.  The CSR is actually 4 byte-wide
- * registers that can be accessed as 8-, 16-, or 32-bit values.
- */
-#define CPM_MAP_ADDR		((uint)0xf0000000)
-#define RPX_CSR_ADDR		((uint)0xfa000000)
-#define RPX_CSR_SIZE		((uint)(512 * 1024))
-#define RPX_NVRTC_ADDR		((uint)0xfa080000)
-#define RPX_NVRTC_SIZE		((uint)(512 * 1024))
-
-/* The RPX6 has 16, byte wide control/status registers.
- * Not all are used (yet).
- */
-extern volatile u_char *rpx6_csr_addr;
-
-/* Things of interest in the CSR.
-*/
-#define BCSR0_ID_MASK		((u_char)0xf0)		/* Read only */
-#define BCSR0_SWITCH_MASK	((u_char)0x0f)		/* Read only */
-#define BCSR1_XCVR_SMC1		((u_char)0x80)
-#define BCSR1_XCVR_SMC2		((u_char)0x40)
-#define BCSR2_FLASH_WENABLE	((u_char)0x20)
-#define BCSR2_NVRAM_ENABLE	((u_char)0x10)
-#define BCSR2_ALT_IRQ2		((u_char)0x08)
-#define BCSR2_ALT_IRQ3		((u_char)0x04)
-#define BCSR2_PRST		((u_char)0x02)		/* Force reset */
-#define BCSR2_ENPRST		((u_char)0x01)		/* Enable POR */
-#define BCSR3_MODCLK_MASK	((u_char)0xe0)
-#define BCSR3_ENCLKHDR		((u_char)0x10)
-#define BCSR3_LED5		((u_char)0x04)		/* 0 == on */
-#define BCSR3_LED6		((u_char)0x02)		/* 0 == on */
-#define BCSR3_LED7		((u_char)0x01)		/* 0 == on */
-#define BCSR4_EN_PHY		((u_char)0x80)		/* Enable PHY */
-#define BCSR4_EN_MII		((u_char)0x40)		/* Enable PHY */
-#define BCSR4_MII_READ		((u_char)0x04)
-#define BCSR4_MII_MDC		((u_char)0x02)
-#define BCSR4_MII_MDIO		((u_char)0x02)
-#define BCSR13_FETH_IRQMASK	((u_char)0xf0)
-#define BCSR15_FETH_IRQ		((u_char)0x20)
-
-#endif /* __ASM_PLATFORMS_RPXSUPER_H__ */
-#endif /* __KERNEL__ */
diff -urN linux-2.6.8-rc2/arch/ppc/syslib/Makefile linux-2.6.8-rc3/arch/ppc/syslib/Makefile
--- linux-2.6.8-rc2/arch/ppc/syslib/Makefile	2004-08-03 15:21:05.738455583 -0700
+++ linux-2.6.8-rc3/arch/ppc/syslib/Makefile	2004-08-03 15:21:33.904610810 -0700
@@ -69,10 +69,10 @@
 obj-$(CONFIG_SBC82xx)		+= todc_time.o
 obj-$(CONFIG_SPRUCE)		+= cpc700_pic.o indirect_pci.o pci_auto.o \
 				   todc_time.o
-obj-$(CONFIG_8260)		+= m8260_setup.o cpm2_pic.o
+obj-$(CONFIG_8260)		+= m8260_setup.o
 obj-$(CONFIG_PCI_8260)		+= m8260_pci.o indirect_pci.o
 obj-$(CONFIG_8260_PCI9)		+= m8260_pci_erratum9.o
-obj-$(CONFIG_CPM2)		+= cpm2_common.o
+obj-$(CONFIG_CPM2)		+= cpm2_common.o cpm2_pic.o
 ifeq ($(CONFIG_PPC_GEN550),y)
 obj-$(CONFIG_KGDB)		+= gen550_kgdb.o gen550_dbg.o
 obj-$(CONFIG_SERIAL_TEXT_DEBUG)	+= gen550_dbg.o
@@ -86,3 +86,4 @@
 ifeq ($(CONFIG_85xx),y)
 obj-$(CONFIG_PCI)		+= indirect_pci.o pci_auto.o
 endif
+obj-$(CONFIG_PPC_MPC52xx)	+= mpc52xx_setup.o mpc52xx_pic.o
diff -urN linux-2.6.8-rc2/arch/ppc/syslib/cpm2_common.c linux-2.6.8-rc3/arch/ppc/syslib/cpm2_common.c
--- linux-2.6.8-rc2/arch/ppc/syslib/cpm2_common.c	2004-08-03 15:21:05.739455624 -0700
+++ linux-2.6.8-rc3/arch/ppc/syslib/cpm2_common.c	2004-08-03 15:21:33.905610851 -0700
@@ -39,10 +39,14 @@
  */
 cpm2_map_t *cpm2_immr;
 
+#define CPM_MAP_SIZE	(0x40000)	/* 256k - the PQ3 reserve this amount
+					   of space for CPM as it is larger
+					   than on PQ2 */
+
 void
 cpm2_reset(void)
 {
-	cpm2_immr = (cpm2_map_t *)CPM_MAP_ADDR;
+	cpm2_immr = (cpm2_map_t *)ioremap(CPM_MAP_ADDR, CPM_MAP_SIZE);
 
 	/* Reclaim the DP memory for our use.
 	 */
@@ -70,7 +74,7 @@
  * oversampled clock.
  */
 void
-cpm2_setbrg(uint brg, uint rate)
+cpm_setbrg(uint brg, uint rate)
 {
 	volatile uint	*bp;
 
@@ -119,8 +123,6 @@
 
 static void cpm2_dpinit(void)
 {
-	void *dprambase = &((cpm2_map_t *)CPM_MAP_ADDR)->im_dprambase;
-
 	spin_lock_init(&cpm_dpmem_lock);
 
 	/* initialize the info header */
@@ -135,15 +137,13 @@
 	 * varies with the processor and the microcode patches activated.
 	 * But the following should be at least safe.
 	 */
-	rh_attach_region(&cpm_dpmem_info, dprambase + CPM_DATAONLY_BASE,
+	rh_attach_region(&cpm_dpmem_info, (void *)CPM_DATAONLY_BASE,
 			CPM_DATAONLY_SIZE);
 }
 
-/* This function used to return an index into the DPRAM area.
- * Now it returns the actuall physical address of that area.
- * use cpm2_dpram_offset() to get the index
+/* This function returns an index into the DPRAM area.
  */
-void *cpm2_dpalloc(uint size, uint align)
+uint cpm_dpalloc(uint size, uint align)
 {
 	void *start;
 	unsigned long flags;
@@ -153,53 +153,46 @@
 	start = rh_alloc(&cpm_dpmem_info, size, "commproc");
 	spin_unlock_irqrestore(&cpm_dpmem_lock, flags);
 
-	return start;
+	return (uint)start;
 }
-EXPORT_SYMBOL(cpm2_dpalloc);
+EXPORT_SYMBOL(cpm_dpalloc);
 
-int cpm2_dpfree(void *addr)
+int cpm_dpfree(uint offset)
 {
 	int ret;
 	unsigned long flags;
 
 	spin_lock_irqsave(&cpm_dpmem_lock, flags);
-	ret = rh_free(&cpm_dpmem_info, addr);
+	ret = rh_free(&cpm_dpmem_info, (void *)offset);
 	spin_unlock_irqrestore(&cpm_dpmem_lock, flags);
 
 	return ret;
 }
-EXPORT_SYMBOL(cpm2_dpfree);
+EXPORT_SYMBOL(cpm_dpfree);
 
 /* not sure if this is ever needed */
-void *cpm2_dpalloc_fixed(void *addr, uint size, uint align)
+uint cpm_dpalloc_fixed(uint offset, uint size, uint align)
 {
 	void *start;
 	unsigned long flags;
 
 	spin_lock_irqsave(&cpm_dpmem_lock, flags);
 	cpm_dpmem_info.alignment = align;
-	start = rh_alloc_fixed(&cpm_dpmem_info, addr, size, "commproc");
+	start = rh_alloc_fixed(&cpm_dpmem_info, (void *)offset, size, "commproc");
 	spin_unlock_irqrestore(&cpm_dpmem_lock, flags);
 
-	return start;
+	return (uint)start;
 }
-EXPORT_SYMBOL(cpm2_dpalloc_fixed);
+EXPORT_SYMBOL(cpm_dpalloc_fixed);
 
-void cpm2_dpdump(void)
+void cpm_dpdump(void)
 {
 	rh_dump(&cpm_dpmem_info);
 }
-EXPORT_SYMBOL(cpm2_dpdump);
-
-uint cpm2_dpram_offset(void *addr)
-{
-	return (uint)((u_char *)addr -
-			((uint)((cpm2_map_t *)CPM_MAP_ADDR)->im_dprambase));
-}
-EXPORT_SYMBOL(cpm2_dpram_offset);
+EXPORT_SYMBOL(cpm_dpdump);
 
-void *cpm2_dpram_addr(int offset)
+void *cpm_dpram_addr(uint offset)
 {
-	return (void *)&((cpm2_map_t *)CPM_MAP_ADDR)->im_dprambase[offset];
+	return (void *)&cpm2_immr->im_dprambase[offset];
 }
-EXPORT_SYMBOL(cpm2_dpram_addr);
+EXPORT_SYMBOL(cpm_dpram_addr);
diff -urN linux-2.6.8-rc2/arch/ppc/syslib/m8260_pci_erratum9.c linux-2.6.8-rc3/arch/ppc/syslib/m8260_pci_erratum9.c
--- linux-2.6.8-rc2/arch/ppc/syslib/m8260_pci_erratum9.c	2004-08-03 15:21:05.743455788 -0700
+++ linux-2.6.8-rc3/arch/ppc/syslib/m8260_pci_erratum9.c	2004-08-03 15:21:33.909611016 -0700
@@ -89,9 +89,8 @@
 	volatile cpm2_map_t *immap = cpm2_immr;
 
 	/* allocate IDMA dpram */
-	dpram_offset = cpm2_dpalloc(sizeof(idma_dpram_t), 64);
-	idma_dpram = 
-		(volatile idma_dpram_t *)&immap->im_dprambase[dpram_offset];
+	dpram_offset = cpm_dpalloc(sizeof(idma_dpram_t), 64);
+	idma_dpram = cpm_dpram_addr(dpram_offset); 
 
 	/* initialize the IDMA parameter RAM */
 	memset((void *)idma_dpram, 0, sizeof(idma_dpram_t));
diff -urN linux-2.6.8-rc2/arch/ppc/syslib/mpc52xx_pic.c linux-2.6.8-rc3/arch/ppc/syslib/mpc52xx_pic.c
--- linux-2.6.8-rc2/arch/ppc/syslib/mpc52xx_pic.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc/syslib/mpc52xx_pic.c	2004-08-03 15:21:33.911611098 -0700
@@ -0,0 +1,252 @@
+/*
+ * arch/ppc/syslib/mpc52xx_pic.c
+ *
+ * Programmable Interrupt Controller functions for the Freescale MPC52xx 
+ * embedded CPU.
+ *
+ * 
+ * Maintainer : Sylvain Munaut <tnt@246tNt.com>
+ *
+ * Based on (well, mostly copied from) the code from the 2.4 kernel by
+ * Dale Farnsworth <dfarnsworth@mvista.com> and Kent Borg.
+ * 
+ * Copyright (C) 2004 Sylvain Munaut <tnt@246tNt.com>
+ * Copyright (C) 2003 Montavista Software, Inc
+ * 
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2. This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+
+#include <linux/stddef.h>
+#include <linux/init.h>
+#include <linux/sched.h>
+#include <linux/signal.h>
+#include <linux/stddef.h>
+#include <linux/delay.h>
+#include <linux/irq.h>
+
+#include <asm/io.h>
+#include <asm/processor.h>
+#include <asm/system.h>
+#include <asm/irq.h>
+#include <asm/mpc52xx.h>
+
+
+static struct mpc52xx_intr *intr;
+static struct mpc52xx_sdma *sdma;
+
+static void
+mpc52xx_ic_disable(unsigned int irq)
+{
+	u32 val;
+
+	if (irq == MPC52xx_IRQ0) {
+		val = in_be32(&intr->ctrl);
+		val &= ~(1 << 11);
+		out_be32(&intr->ctrl, val);
+	}
+	else if (irq < MPC52xx_IRQ1) {
+		BUG();
+	}
+	else if (irq <= MPC52xx_IRQ3) {
+		val = in_be32(&intr->ctrl);
+		val &= ~(1 << (10 - (irq - MPC52xx_IRQ1)));
+		out_be32(&intr->ctrl, val);
+	}
+	else if (irq < MPC52xx_SDMA_IRQ_BASE) {
+		val = in_be32(&intr->main_mask);
+		val |= 1 << (16 - (irq - MPC52xx_MAIN_IRQ_BASE));
+		out_be32(&intr->main_mask, val);
+	}
+	else if (irq < MPC52xx_PERP_IRQ_BASE) {
+		val = in_be32(&sdma->IntMask);
+		val |= 1 << (irq - MPC52xx_SDMA_IRQ_BASE);
+		out_be32(&sdma->IntMask, val);
+	}
+	else {
+		val = in_be32(&intr->per_mask);
+		val |= 1 << (31 - (irq - MPC52xx_PERP_IRQ_BASE));
+		out_be32(&intr->per_mask, val);
+	}
+}
+
+static void
+mpc52xx_ic_enable(unsigned int irq)
+{
+	u32 val;
+
+	if (irq == MPC52xx_IRQ0) {
+		val = in_be32(&intr->ctrl);
+		val |= 1 << 11;
+		out_be32(&intr->ctrl, val);
+	}
+	else if (irq < MPC52xx_IRQ1) {
+		BUG();
+	}
+	else if (irq <= MPC52xx_IRQ3) {
+		val = in_be32(&intr->ctrl);
+		val |= 1 << (10 - (irq - MPC52xx_IRQ1));
+		out_be32(&intr->ctrl, val);
+	}
+	else if (irq < MPC52xx_SDMA_IRQ_BASE) {
+		val = in_be32(&intr->main_mask);
+		val &= ~(1 << (16 - (irq - MPC52xx_MAIN_IRQ_BASE)));
+		out_be32(&intr->main_mask, val);
+	}
+	else if (irq < MPC52xx_PERP_IRQ_BASE) {
+		val = in_be32(&sdma->IntMask);
+		val &= ~(1 << (irq - MPC52xx_SDMA_IRQ_BASE));
+		out_be32(&sdma->IntMask, val);
+	}
+	else {
+		val = in_be32(&intr->per_mask);
+		val &= ~(1 << (31 - (irq - MPC52xx_PERP_IRQ_BASE)));
+		out_be32(&intr->per_mask, val);
+	}
+}
+
+static void
+mpc52xx_ic_ack(unsigned int irq)
+{
+	u32 val;
+
+	/*
+	 * Only some irqs are reset here, others in interrupting hardware.
+	 */
+			
+	switch (irq) {
+	case MPC52xx_IRQ0:
+		val = in_be32(&intr->ctrl);
+		val |= 0x08000000;
+		out_be32(&intr->ctrl, val);
+		break;
+	case MPC52xx_CCS_IRQ:
+		val = in_be32(&intr->enc_status);
+		val |= 0x00000400;
+		out_be32(&intr->enc_status, val);
+		break;
+	case MPC52xx_IRQ1:
+		val = in_be32(&intr->ctrl);
+		val |= 0x04000000;
+		out_be32(&intr->ctrl, val);
+		break;
+	case MPC52xx_IRQ2:
+		val = in_be32(&intr->ctrl);
+		val |= 0x02000000;
+		out_be32(&intr->ctrl, val);
+		break;
+	case MPC52xx_IRQ3:
+		val = in_be32(&intr->ctrl);
+		val |= 0x01000000;
+		out_be32(&intr->ctrl, val);
+		break;
+	default:
+		if (irq >= MPC52xx_SDMA_IRQ_BASE
+		    && irq < (MPC52xx_SDMA_IRQ_BASE + MPC52xx_SDMA_IRQ_NUM)) {
+			out_be32(&sdma->IntPend,
+				 1 << (irq - MPC52xx_SDMA_IRQ_BASE));
+		}
+		break;
+	}
+}
+
+static void
+mpc52xx_ic_disable_and_ack(unsigned int irq)
+{
+	mpc52xx_ic_disable(irq);
+	mpc52xx_ic_ack(irq);
+}
+
+static void
+mpc52xx_ic_end(unsigned int irq)
+{
+	if (!(irq_desc[irq].status & (IRQ_DISABLED | IRQ_INPROGRESS)))
+		mpc52xx_ic_enable(irq);
+}
+
+static struct hw_interrupt_type mpc52xx_ic = {
+	"MPC52xx",
+	NULL,				/* startup(irq) */
+	NULL,				/* shutdown(irq) */
+	mpc52xx_ic_enable,		/* enable(irq) */
+	mpc52xx_ic_disable,		/* disable(irq) */
+	mpc52xx_ic_disable_and_ack,	/* disable_and_ack(irq) */
+	mpc52xx_ic_end,			/* end(irq) */
+	0				/* set_affinity(irq, cpumask) SMP. */
+};
+
+void __init
+mpc52xx_init_irq(void)
+{
+	int i;
+
+	/* Remap the necessary zones */
+	intr = (struct mpc52xx_intr *)
+		ioremap(MPC52xx_INTR, sizeof(struct mpc52xx_intr));
+	sdma = (struct mpc52xx_sdma *)
+		ioremap(MPC52xx_SDMA, sizeof(struct mpc52xx_sdma));
+	
+	if ((intr==NULL) || (sdma==NULL))
+		panic("Can't ioremap PIC/SDMA register for init_irq !");
+
+	/* Disable all interrupt sources. */
+	out_be32(&sdma->IntPend, 0xffffffff);	/* 1 means clear pending */
+	out_be32(&sdma->IntMask, 0xffffffff);	/* 1 means disabled */
+	out_be32(&intr->per_mask, 0x7ffffc00);	/* 1 means disabled */
+	out_be32(&intr->main_mask, 0x00010fff);	/* 1 means disabled */
+	out_be32(&intr->ctrl,
+			0x0f000000 |	/* clear IRQ 0-3 */
+			0x00c00000 |	/* IRQ0: level-sensitive, active low */
+			0x00001000 |	/* MEE master external enable */
+			0x00000000 |	/* 0 means disable IRQ 0-3 */
+			0x00000001);	/* CEb route critical normally */
+
+	/* Zero a bunch of the priority settings.  */
+	out_be32(&intr->per_pri1, 0);
+	out_be32(&intr->per_pri2, 0);
+	out_be32(&intr->per_pri3, 0);
+	out_be32(&intr->main_pri1, 0);
+	out_be32(&intr->main_pri2, 0);
+
+	/* Initialize irq_desc[i].handler's with mpc52xx_ic. */
+	for (i = 0; i < NR_IRQS; i++) {
+		irq_desc[i].handler = &mpc52xx_ic;
+		irq_desc[i].status = IRQ_LEVEL;
+	}
+}
+
+int
+mpc52xx_get_irq(struct pt_regs *regs)
+{
+	u32 status;
+	int irq = -1;
+
+	status = in_be32(&intr->enc_status);
+
+	if (status & 0x00000400) {		/* critical */
+		irq = (status >> 8) & 0x3;
+		if (irq == 2)			/* high priority peripheral */
+			goto peripheral;
+		irq += MPC52xx_CRIT_IRQ_BASE;
+	}
+	else if (status & 0x00200000) {		/* main */
+		irq = (status >> 16) & 0x1f;
+		if (irq == 4)			/* low priority peripheral */
+			goto peripheral;
+		irq += MPC52xx_MAIN_IRQ_BASE;
+	}
+	else if (status & 0x20000000) {		/* peripheral */
+peripheral:
+		irq = (status >> 24) & 0x1f;
+		if (irq == 0) {			/* bestcomm */
+			status = in_be32(&sdma->IntPend);
+			irq = ffs(status) + MPC52xx_SDMA_IRQ_BASE-1;
+		}
+		else
+			irq += MPC52xx_PERP_IRQ_BASE;
+	}
+
+	return irq;
+}
+
diff -urN linux-2.6.8-rc2/arch/ppc/syslib/mpc52xx_setup.c linux-2.6.8-rc3/arch/ppc/syslib/mpc52xx_setup.c
--- linux-2.6.8-rc2/arch/ppc/syslib/mpc52xx_setup.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc/syslib/mpc52xx_setup.c	2004-08-03 15:21:33.912611139 -0700
@@ -0,0 +1,228 @@
+/*
+ * arch/ppc/syslib/mpc52xx_common.c
+ *
+ * Common code for the boards based on Freescale MPC52xx embedded CPU.
+ *
+ * 
+ * Maintainer : Sylvain Munaut <tnt@246tNt.com>
+ *
+ * Support for other bootloaders than UBoot by Dale Farnsworth 
+ * <dfarnsworth@mvista.com>
+ * 
+ * Copyright (C) 2004 Sylvain Munaut <tnt@246tNt.com>
+ * Copyright (C) 2003 Montavista Software, Inc
+ * 
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2. This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+
+#include <linux/config.h>
+
+#include <asm/time.h>
+#include <asm/mpc52xx.h>
+#include <asm/mpc52xx_psc.h>
+#include <asm/ocp.h>
+#include <asm/ppcboot.h>
+
+extern bd_t __res;
+
+static int core_mult[] = {		/* CPU Frequency multiplier, taken    */
+	0,  0,  0,  10, 20, 20, 25, 45,	/* from the datasheet used to compute */
+	30, 55, 40, 50, 0,  60, 35, 0,	/* CPU frequency from XLB freq and    */
+	30, 25, 65, 10, 70, 20, 75, 45,	/* external jumper config             */
+	0,  55, 40, 50, 80, 60, 35, 0
+};
+
+void
+mpc52xx_restart(char *cmd)
+{
+	struct mpc52xx_gpt* gpt0 = (struct mpc52xx_gpt*) MPC52xx_GPTx(0);
+	
+	local_irq_disable();
+	
+	/* Turn on the watchdog and wait for it to expire. It effectively
+	  does a reset */
+	if (gpt0 != NULL) {
+		out_be32(&gpt0->count, 0x000000ff);
+		out_be32(&gpt0->mode, 0x00009004);
+	} else
+		printk(KERN_ERR "mpc52xx_restart: Unable to ioremap GPT0 registers, -> looping ...");
+
+	while (1);
+}
+
+void
+mpc52xx_halt(void)
+{
+	local_irq_disable();
+
+	while (1);
+}
+
+void
+mpc52xx_power_off(void)
+{
+	/* By default we don't have any way of shut down.
+	   If a specific board wants to, it can set the power down
+	   code to any hardware implementation dependent code */
+	mpc52xx_halt();
+}
+
+
+void __init
+mpc52xx_set_bat(void)
+{
+	/* Set BAT 2 to map the 0xf0000000 area */
+	/* This mapping is used during mpc52xx_progress,
+	 * mpc52xx_find_end_of_memory, and UARTs/GPIO access for debug
+	 */
+	mb();
+	mtspr(DBAT2U, 0xf0001ffe);
+	mtspr(DBAT2L, 0xf000002a);
+	mb();
+}
+
+void __init
+mpc52xx_map_io(void)
+{
+	/* Here we only map the MBAR */
+	io_block_mapping(
+		MPC52xx_MBAR_VIRT, MPC52xx_MBAR, MPC52xx_MBAR_SIZE, _PAGE_IO);
+}
+
+
+#ifdef CONFIG_SERIAL_TEXT_DEBUG
+#ifdef MPC52xx_PF_CONSOLE_PORT
+#define MPC52xx_CONSOLE MPC52xx_PSCx(MPC52xx_PF_CONSOLE_PORT)
+#else
+#error "mpc52xx PSC for console not selected"
+#endif
+
+void
+mpc52xx_progress(char *s, unsigned short hex)
+{
+	struct mpc52xx_psc *psc = (struct mpc52xx_psc *)MPC52xx_CONSOLE;
+	char c;
+
+		/* Don't we need to disable serial interrupts ? */
+	
+	while ((c = *s++) != 0) {
+		if (c == '\n') {
+			while (!(in_be16(&psc->mpc52xx_psc_status) &
+			         MPC52xx_PSC_SR_TXRDY)) ;
+			out_8(&psc->mpc52xx_psc_buffer_8, '\r');
+		}
+		while (!(in_be16(&psc->mpc52xx_psc_status) &
+		         MPC52xx_PSC_SR_TXRDY)) ;
+		out_8(&psc->mpc52xx_psc_buffer_8, c);
+	}
+}
+
+#endif  /* CONFIG_SERIAL_TEXT_DEBUG */
+
+
+unsigned long __init
+mpc52xx_find_end_of_memory(void)
+{
+	u32 ramsize = __res.bi_memsize;
+
+	/*
+	 * if bootloader passed a memsize, just use it
+	 * else get size from sdram config registers
+	 */
+	if (ramsize == 0) {
+		struct mpc52xx_mmap_ctl *mmap_ctl;
+		u32 sdram_config_0, sdram_config_1;
+
+		/* Temp BAT2 mapping active when this is called ! */
+		mmap_ctl = (struct mpc52xx_mmap_ctl*) MPC52xx_MMAP_CTL;
+			
+		sdram_config_0 = in_be32(&mmap_ctl->sdram0);
+		sdram_config_1 = in_be32(&mmap_ctl->sdram1);
+
+		if ((sdram_config_0 & 0x1f) >= 0x13)
+			ramsize = 1 << ((sdram_config_0 & 0xf) + 17);
+
+		if (((sdram_config_1 & 0x1f) >= 0x13) &&
+				((sdram_config_1 & 0xfff00000) == ramsize))
+			ramsize += 1 << ((sdram_config_1 & 0xf) + 17);
+
+		iounmap(mmap_ctl);
+	}
+	
+	return ramsize;
+}
+
+void __init
+mpc52xx_calibrate_decr(void)
+{
+	int current_time, previous_time;
+	int tbl_start, tbl_end;
+	unsigned int xlbfreq, cpufreq, ipbfreq, pcifreq, divisor;
+
+	xlbfreq = __res.bi_busfreq;
+	/* if bootloader didn't pass bus frequencies, calculate them */
+	if (xlbfreq == 0) {
+		/* Get RTC & Clock manager modules */
+		struct mpc52xx_rtc *rtc;
+		struct mpc52xx_cdm *cdm;
+		
+		rtc = (struct mpc52xx_rtc*)
+			ioremap(MPC52xx_RTC, sizeof(struct mpc52xx_rtc));
+		cdm = (struct mpc52xx_cdm*)
+			ioremap(MPC52xx_CDM, sizeof(struct mpc52xx_cdm));
+
+		if ((rtc==NULL) || (cdm==NULL))
+			panic("Can't ioremap RTC/CDM while computing bus freq");
+
+		/* Count bus clock during 1/64 sec */
+		out_be32(&rtc->dividers, 0x8f1f0000);	/* Set RTC 64x faster */
+		previous_time = in_be32(&rtc->time);
+		while ((current_time = in_be32(&rtc->time)) == previous_time) ;
+		tbl_start = get_tbl();
+		previous_time = current_time;
+		while ((current_time = in_be32(&rtc->time)) == previous_time) ;
+		tbl_end = get_tbl();
+		out_be32(&rtc->dividers, 0xffff0000);	/* Restore RTC */
+
+		/* Compute all frequency from that & CDM settings */
+		xlbfreq = (tbl_end - tbl_start) << 8;
+		cpufreq = (xlbfreq * core_mult[in_be32(&cdm->rstcfg)&0x1f])/10;
+		ipbfreq = (in_8(&cdm->ipb_clk_sel) & 1) ?
+					xlbfreq / 2 : xlbfreq;
+		switch (in_8(&cdm->pci_clk_sel) & 3) {
+		case 0:
+			pcifreq = ipbfreq;
+			break;
+		case 1:
+			pcifreq = ipbfreq / 2;
+			break;
+		default:
+			pcifreq = xlbfreq / 4;
+			break;
+		}
+		__res.bi_busfreq = xlbfreq;
+		__res.bi_intfreq = cpufreq;
+		__res.bi_ipbfreq = ipbfreq;
+		__res.bi_pcifreq = pcifreq;
+	
+		/* Release mapping */
+		iounmap((void*)rtc);
+		iounmap((void*)cdm);
+	}
+
+	divisor = 4;
+
+	tb_ticks_per_jiffy = xlbfreq / HZ / divisor;
+	tb_to_us = mulhwu_scale_factor(xlbfreq / divisor, 1000000);
+}
+
+
+void __init
+mpc52xx_add_board_devices(struct ocp_def board_ocp[]) {
+	while (board_ocp->vendor != OCP_VENDOR_INVALID)
+		if(ocp_add_one_device(board_ocp++))
+			printk("mpc5200-ocp: Failed to add board device !\n");
+}
+
diff -urN linux-2.6.8-rc2/arch/ppc/syslib/open_pic.c linux-2.6.8-rc3/arch/ppc/syslib/open_pic.c
--- linux-2.6.8-rc2/arch/ppc/syslib/open_pic.c	2004-08-03 15:21:05.746455911 -0700
+++ linux-2.6.8-rc3/arch/ppc/syslib/open_pic.c	2004-08-03 15:21:33.914611221 -0700
@@ -554,14 +554,16 @@
  *  Externally called, however, it takes an IPI number (0...OPENPIC_NUM_IPI)
  *  and not a system-wide interrupt number
  */
-void openpic_cause_IPI(u_int ipi, u_int cpumask)
+void openpic_cause_IPI(u_int ipi, cpumask_t cpumask)
 {
+	cpumask_t phys;
 	DECL_THIS_CPU;
 
 	CHECK_THIS_CPU;
 	check_arg_ipi(ipi);
+	phys = physmask(cpumask);
 	openpic_write(&OpenPIC->THIS_CPU.IPI_Dispatch(ipi),
-		      physmask(cpumask));
+		      cpus_addr(physmask(cpumask))[0]);
 }
 
 void openpic_request_IPIs(void)
@@ -579,16 +581,16 @@
 	/* IPIs are marked SA_INTERRUPT as they must run with irqs disabled */
 	request_irq(OPENPIC_VEC_IPI+open_pic_irq_offset,
 		    openpic_ipi_action, SA_INTERRUPT,
-		    "IPI0 (call function)", 0);
+		    "IPI0 (call function)", NULL);
 	request_irq(OPENPIC_VEC_IPI+open_pic_irq_offset+1,
 		    openpic_ipi_action, SA_INTERRUPT,
-		    "IPI1 (reschedule)", 0);
+		    "IPI1 (reschedule)", NULL);
 	request_irq(OPENPIC_VEC_IPI+open_pic_irq_offset+2,
 		    openpic_ipi_action, SA_INTERRUPT,
-		    "IPI2 (invalidate tlb)", 0);
+		    "IPI2 (invalidate tlb)", NULL);
 	request_irq(OPENPIC_VEC_IPI+open_pic_irq_offset+3,
 		    openpic_ipi_action, SA_INTERRUPT,
-		    "IPI3 (xmon break)", 0);
+		    "IPI3 (xmon break)", NULL);
 
 	for ( i = 0; i < OPENPIC_NUM_IPI ; i++ )
 		openpic_enable_ipi(OPENPIC_VEC_IPI+open_pic_irq_offset+i);
@@ -610,7 +612,7 @@
 	spin_lock(&openpic_setup_lock);
 
 #ifdef CONFIG_IRQ_ALL_CPUS
-	cpu_set(smp_hw_index[smp_processor_id()], mask);
+	cpu_set(smp_hw_index[smp_processor_id()], msk);
 
  	/* let the openpic know we want intrs. default affinity
  	 * is 0xffffffff until changed via /proc
@@ -872,6 +874,7 @@
 void
 smp_openpic_message_pass(int target, int msg, unsigned long data, int wait)
 {
+	cpumask_t mask = CPU_MASK_ALL;
 	/* make sure we're sending something that translates to an IPI */
 	if (msg > 0x3) {
 		printk("SMP %d: smp_message_pass: unknown msg %d\n",
@@ -880,14 +883,14 @@
 	}
 	switch (target) {
 	case MSG_ALL:
-		openpic_cause_IPI(msg, 0xffffffff);
+		openpic_cause_IPI(msg, mask);
 		break;
 	case MSG_ALL_BUT_SELF:
-		openpic_cause_IPI(msg,
-				  0xffffffff & ~(1 << smp_processor_id()));
+		cpu_clear(smp_processor_id(), mask);
+		openpic_cause_IPI(msg, mask);
 		break;
 	default:
-		openpic_cause_IPI(msg, 1<<target);
+		openpic_cause_IPI(msg, cpumask_of_cpu(target));
 		break;
 	}
 }
diff -urN linux-2.6.8-rc2/arch/ppc/syslib/ppc85xx_setup.c linux-2.6.8-rc3/arch/ppc/syslib/ppc85xx_setup.c
--- linux-2.6.8-rc2/arch/ppc/syslib/ppc85xx_setup.c	2004-08-03 15:21:05.752456157 -0700
+++ linux-2.6.8-rc3/arch/ppc/syslib/ppc85xx_setup.c	2004-08-03 15:21:33.921611508 -0700
@@ -169,17 +169,20 @@
 	pci->piwar2 = 0;
 	pci->piwar3 = 0;
 
-	/* Setup 512M Phys:PCI 1:1 outbound mem window @ 0x80000000 */
+	/* Setup Phys:PCI 1:1 outbound mem window @ MPC85XX_PCI1_LOWER_MEM */
 	pci->potar1 = (MPC85XX_PCI1_LOWER_MEM >> 12) & 0x000fffff;
 	pci->potear1 = 0x00000000;
 	pci->powbar1 = (MPC85XX_PCI1_LOWER_MEM >> 12) & 0x000fffff;
-	pci->powar1 = 0x8004401c;	/* Enable, Mem R/W, 512M */
+	/* Enable, Mem R/W */
+	pci->powar1 = 0x80044000 |
+	   (__ilog2(MPC85XX_PCI1_UPPER_MEM - MPC85XX_PCI1_LOWER_MEM + 1) - 1);
 
-	/* Setup 16M outboud IO windows @ 0xe2000000 */
+	/* Setup outboud IO windows @ MPC85XX_PCI1_IO_BASE */
 	pci->potar2 = 0x00000000;
 	pci->potear2 = 0x00000000;
 	pci->powbar2 = (MPC85XX_PCI1_IO_BASE >> 12) & 0x000fffff;
-	pci->powar2 = 0x80088017;	/* Enable, IO R/W, 16M */
+	/* Enable, IO R/W */
+	pci->powar2 = 0x80088000 | (__ilog2(MPC85XX_PCI1_IO_SIZE) - 1);
 
 	/* Setup 2G inbound Memory Window @ 0 */
 	pci->pitar1 = 0x00000000;
@@ -192,7 +195,7 @@
 extern int mpc85xx_map_irq(struct pci_dev *dev, unsigned char idsel, unsigned char pin);
 extern int mpc85xx_exclude_device(u_char bus, u_char devfn);
 
-#if CONFIG_85xx_PCI2
+#ifdef CONFIG_85xx_PCI2
 static void __init
 mpc85xx_setup_pci2(struct pci_controller *hose)
 {
@@ -203,10 +206,10 @@
 	pci = ioremap(binfo->bi_immr_base + MPC85xx_PCI2_OFFSET,
 		    MPC85xx_PCI2_SIZE);
 
-	early_read_config_word(hose, 0, 0, PCI_COMMAND, &temps);
+	early_read_config_word(hose, hose->bus_offset, 0, PCI_COMMAND, &temps);
 	temps |= PCI_COMMAND_SERR | PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY;
-	early_write_config_word(hose, 0, 0, PCI_COMMAND, temps);
-	early_write_config_byte(hose, 0, 0, PCI_LATENCY_TIMER, 0x80);
+	early_write_config_word(hose, hose->bus_offset, 0, PCI_COMMAND, temps);
+	early_write_config_byte(hose, hose->bus_offset, 0, PCI_LATENCY_TIMER, 0x80);
 
 	/* Disable all windows (except powar0 since its ignored) */
 	pci->powar1 = 0;
@@ -217,17 +220,20 @@
 	pci->piwar2 = 0;
 	pci->piwar3 = 0;
 
-	/* Setup 512M Phys:PCI 1:1 outbound mem window @ 0xa0000000 */
+	/* Setup Phys:PCI 1:1 outbound mem window @ MPC85XX_PCI2_LOWER_MEM */
 	pci->potar1 = (MPC85XX_PCI2_LOWER_MEM >> 12) & 0x000fffff;
 	pci->potear1 = 0x00000000;
 	pci->powbar1 = (MPC85XX_PCI2_LOWER_MEM >> 12) & 0x000fffff;
-	pci->powar1 = 0x8004401c;	/* Enable, Mem R/W, 512M */
+	/* Enable, Mem R/W */
+	pci->powar1 = 0x80044000 |
+	   (__ilog2(MPC85XX_PCI1_UPPER_MEM - MPC85XX_PCI1_LOWER_MEM + 1) - 1);
 
-	/* Setup 16M outboud IO windows @ 0xe3000000 */
+	/* Setup outboud IO windows @ MPC85XX_PCI2_IO_BASE */
 	pci->potar2 = 0x00000000;
 	pci->potear2 = 0x00000000;
 	pci->powbar2 = (MPC85XX_PCI2_IO_BASE >> 12) & 0x000fffff;
-	pci->powar2 = 0x80088017;	/* Enable, IO R/W, 16M */
+	/* Enable, IO R/W */
+	pci->powar2 = 0x80088000 | (__ilog2(MPC85XX_PCI1_IO_SIZE) - 1);
 
 	/* Setup 2G inbound Memory Window @ 0 */
 	pci->pitar1 = 0x00000000;
diff -urN linux-2.6.8-rc2/arch/ppc/syslib/ppc85xx_setup.h linux-2.6.8-rc3/arch/ppc/syslib/ppc85xx_setup.h
--- linux-2.6.8-rc2/arch/ppc/syslib/ppc85xx_setup.h	2004-08-03 15:21:05.753456198 -0700
+++ linux-2.6.8-rc3/arch/ppc/syslib/ppc85xx_setup.h	2004-08-03 15:21:33.921611508 -0700
@@ -18,7 +18,6 @@
 #define __PPC_SYSLIB_PPC85XX_SETUP_H
 
 #include <linux/config.h>
-#include <linux/serial.h>
 #include <linux/init.h>
 #include <asm/ppcboot.h>
 
diff -urN linux-2.6.8-rc2/arch/ppc/syslib/prom.c linux-2.6.8-rc3/arch/ppc/syslib/prom.c
--- linux-2.6.8-rc2/arch/ppc/syslib/prom.c	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/syslib/prom.c	2004-08-03 15:21:33.922611549 -0700
@@ -126,7 +126,7 @@
 
 	/* All newworld pmac machines and CHRPs now use the interrupt tree */
 	for (np = allnodes; np != NULL; np = np->allnext) {
-		if (get_property(np, "interrupt-parent", 0)) {
+		if (get_property(np, "interrupt-parent", NULL)) {
 			use_of_interrupt_tree = 1;
 			break;
 		}
@@ -181,8 +181,8 @@
 	struct device_node *child;
 	int *ip;
 
-	np->name = get_property(np, "name", 0);
-	np->type = get_property(np, "device_type", 0);
+	np->name = get_property(np, "name", NULL);
+	np->type = get_property(np, "device_type", NULL);
 
 	if (!np->name)
 		np->name = "<NULL>";
@@ -197,10 +197,10 @@
 		mem_start = finish_node_interrupts(np, mem_start);
 
 	/* Look for #address-cells and #size-cells properties. */
-	ip = (int *) get_property(np, "#address-cells", 0);
+	ip = (int *) get_property(np, "#address-cells", NULL);
 	if (ip != NULL)
 		naddrc = *ip;
-	ip = (int *) get_property(np, "#size-cells", 0);
+	ip = (int *) get_property(np, "#size-cells", NULL);
 	if (ip != NULL)
 		nsizec = *ip;
 
@@ -501,7 +501,7 @@
 	do {
 		if (np->parent)
 			np = np->parent;
-		ip = (int *) get_property(np, "#address-cells", 0);
+		ip = (int *) get_property(np, "#address-cells", NULL);
 		if (ip != NULL)
 			return *ip;
 	} while (np->parent);
@@ -516,7 +516,7 @@
 	do {
 		if (np->parent)
 			np = np->parent;
-		ip = (int *) get_property(np, "#size-cells", 0);
+		ip = (int *) get_property(np, "#size-cells", NULL);
 		if (ip != NULL)
 			return *ip;
 	} while (np->parent);
@@ -836,7 +836,7 @@
 			prevp = &np->next;
 		}
 	}
-	*prevp = 0;
+	*prevp = NULL;
 	return head;
 }
 
@@ -855,7 +855,7 @@
 			prevp = &np->next;
 		}
 	}
-	*prevp = 0;
+	*prevp = NULL;
 	return head;
 }
 
@@ -872,7 +872,7 @@
 		*prevp = np;
 		prevp = &np->next;
 	}
-	*prevp = 0;
+	*prevp = NULL;
 	return head;
 }
 
@@ -934,7 +934,7 @@
 			prevp = &np->next;
 		}
 	}
-	*prevp = 0;
+	*prevp = NULL;
 	return head;
 }
 
@@ -1159,7 +1159,7 @@
 				*lenp = pp->length;
 			return pp->value;
 		}
-	return 0;
+	return NULL;
 }
 
 /*
diff -urN linux-2.6.8-rc2/arch/ppc/syslib/prom_init.c linux-2.6.8-rc3/arch/ppc/syslib/prom_init.c
--- linux-2.6.8-rc2/arch/ppc/syslib/prom_init.c	2004-08-03 15:21:05.754456239 -0700
+++ linux-2.6.8-rc3/arch/ppc/syslib/prom_init.c	2004-08-03 15:21:33.923611590 -0700
@@ -111,15 +111,15 @@
 static void * early_get_property(unsigned long base, unsigned long node,
 				char *prop);
 
-prom_entry prom __initdata = 0;
-ihandle prom_chosen __initdata = 0;
-ihandle prom_stdout __initdata = 0;
+prom_entry prom __initdata;
+ihandle prom_chosen __initdata;
+ihandle prom_stdout __initdata;
 
-char *prom_display_paths[FB_MAX] __initdata = { 0, };
+char *prom_display_paths[FB_MAX] __initdata;
 phandle prom_display_nodes[FB_MAX] __initdata;
-unsigned int prom_num_displays __initdata = 0;
-char *of_stdout_device __initdata = 0;
-static ihandle prom_disp_node __initdata = 0;
+unsigned int prom_num_displays __initdata;
+char *of_stdout_device __initdata;
+static ihandle prom_disp_node __initdata;
 
 unsigned int rtas_data;   /* physical pointer */
 unsigned int rtas_entry;  /* physical pointer */
@@ -161,7 +161,7 @@
 		prom_args.args[i] = va_arg(list, void *);
 	va_end(list);
 	for (i = 0; i < nret; ++i)
-		prom_args.args[i + nargs] = 0;
+		prom_args.args[i + nargs] = NULL;
 	prom(&prom_args);
 	return prom_args.args[nargs];
 }
@@ -181,7 +181,7 @@
 		prom_args.args[i] = va_arg(list, void *);
 	va_end(list);
 	for (i = 0; i < nret; ++i)
-		prom_args.args[i + nargs] = 0;
+		prom_args.args[i + nargs] = NULL;
 	prom(&prom_args);
 	for (i = 1; i < nret; ++i)
 		rets[i-1] = prom_args.args[nargs + i];
@@ -363,9 +363,9 @@
 	};
 	const unsigned char *clut;
 
-	prom_disp_node = 0;
+	prom_disp_node = NULL;
 
-	for (node = 0; prom_next_node(&node); ) {
+	for (node = NULL; prom_next_node(&node); ) {
 		type[0] = 0;
 		call_prom("getprop", 4, 1, node, "device_type",
 			  type, sizeof(type));
@@ -546,8 +546,8 @@
 	}
 	allnextp = &allnodes;
 	mem_start = ALIGNUL(mem_start);
-	new_start = inspect_node(root, 0, mem_start, mem_end, &allnextp);
-	*allnextp = 0;
+	new_start = inspect_node(root, NULL, mem_start, mem_end, &allnextp);
+	*allnextp = NULL;
 	return new_start;
 }
 
@@ -695,7 +695,7 @@
 	/* look for cpus */
 	*(unsigned long *)(0x0) = 0;
 	asm volatile("dcbf 0,%0": : "r" (0) : "memory");
-	for (node = 0; prom_next_node(&node); ) {
+	for (node = NULL; prom_next_node(&node); ) {
 		type[0] = 0;
 		call_prom("getprop", 4, 1, node, "device_type",
 			  type, sizeof(type));
@@ -888,7 +888,7 @@
 	prom_print("returning 0x");
 	prom_print_hex(phys);
 	prom_print("from prom_init\n");
-	prom_stdout = 0;
+	prom_stdout = NULL;
 
 	return phys;
 }
@@ -910,7 +910,7 @@
 			return (void *)((unsigned long)pp->value + base);
 		}
 	}
-	return 0;
+	return NULL;
 }
 
 /* Is boot-info compatible ? */
@@ -928,7 +928,7 @@
 
 	boot_infos = PTRUNRELOC(bi);
 	if (!BOOT_INFO_IS_V2_COMPATIBLE(bi))
-		bi->logicalDisplayBase = 0;
+		bi->logicalDisplayBase = NULL;
 
 #ifdef CONFIG_BOOTX_TEXT
 	btext_init(bi);
diff -urN linux-2.6.8-rc2/arch/ppc/xmon/ppc-opc.c linux-2.6.8-rc3/arch/ppc/xmon/ppc-opc.c
--- linux-2.6.8-rc2/arch/ppc/xmon/ppc-opc.c	2004-06-15 22:18:52.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/xmon/ppc-opc.c	2004-08-03 15:21:33.926611713 -0700
@@ -82,12 +82,12 @@
   /* The zero index is used to indicate the end of the list of
      operands.  */
 #define UNUSED (0)
-  { 0, 0, 0, 0, 0 },
+  { 0, 0, NULL, NULL, 0 },
 
   /* The BA field in an XL form instruction.  */
 #define BA (1)
 #define BA_MASK (0x1f << 16)
-  { 5, 16, 0, 0, PPC_OPERAND_CR },
+  { 5, 16, NULL, NULL, PPC_OPERAND_CR },
 
   /* The BA field in an XL form instruction when it must be the same
      as the BT field in the same instruction.  */
@@ -97,7 +97,7 @@
   /* The BB field in an XL form instruction.  */
 #define BB (3)
 #define BB_MASK (0x1f << 11)
-  { 5, 11, 0, 0, PPC_OPERAND_CR },
+  { 5, 11, NULL, NULL, PPC_OPERAND_CR },
 
   /* The BB field in an XL form instruction when it must be the same
      as the BA field in the same instruction.  */
@@ -140,21 +140,21 @@
 
   /* The BF field in an X or XL form instruction.  */
 #define BF (11)
-  { 3, 23, 0, 0, PPC_OPERAND_CR },
+  { 3, 23, NULL, NULL, PPC_OPERAND_CR },
 
   /* An optional BF field.  This is used for comparison instructions,
      in which an omitted BF field is taken as zero.  */
 #define OBF (12)
-  { 3, 23, 0, 0, PPC_OPERAND_CR | PPC_OPERAND_OPTIONAL },
+  { 3, 23, NULL, NULL, PPC_OPERAND_CR | PPC_OPERAND_OPTIONAL },
 
   /* The BFA field in an X or XL form instruction.  */
 #define BFA (13)
-  { 3, 18, 0, 0, PPC_OPERAND_CR },
+  { 3, 18, NULL, NULL, PPC_OPERAND_CR },
 
   /* The BI field in a B form or XL form instruction.  */
 #define BI (14)
 #define BI_MASK (0x1f << 16)
-  { 5, 16, 0, 0, PPC_OPERAND_CR },
+  { 5, 16, NULL, NULL, PPC_OPERAND_CR },
 
   /* The BO field in a B form instruction.  Certain values are
      illegal.  */
@@ -169,20 +169,20 @@
 
   /* The BT field in an X or XL form instruction.  */
 #define BT (17)
-  { 5, 21, 0, 0, PPC_OPERAND_CR },
+  { 5, 21, NULL, NULL, PPC_OPERAND_CR },
 
   /* The condition register number portion of the BI field in a B form
      or XL form instruction.  This is used for the extended
      conditional branch mnemonics, which set the lower two bits of the
      BI field.  This field is optional.  */
 #define CR (18)
-  { 3, 18, 0, 0, PPC_OPERAND_CR | PPC_OPERAND_OPTIONAL },
+  { 3, 18, NULL, NULL, PPC_OPERAND_CR | PPC_OPERAND_OPTIONAL },
 
   /* The D field in a D form instruction.  This is a displacement off
      a register, and implies that the next operand is a register in
      parentheses.  */
 #define D (19)
-  { 16, 0, 0, 0, PPC_OPERAND_PARENS | PPC_OPERAND_SIGNED },
+  { 16, 0, NULL, NULL, PPC_OPERAND_PARENS | PPC_OPERAND_SIGNED },
 
   /* The DS field in a DS form instruction.  This is like D, but the
      lower two bits are forced to zero.  */
@@ -191,49 +191,49 @@
 
   /* The FL1 field in a POWER SC form instruction.  */
 #define FL1 (21)
-  { 4, 12, 0, 0, 0 },
+  { 4, 12, NULL, NULL, 0 },
 
   /* The FL2 field in a POWER SC form instruction.  */
 #define FL2 (22)
-  { 3, 2, 0, 0, 0 },
+  { 3, 2, NULL, NULL, 0 },
 
   /* The FLM field in an XFL form instruction.  */
 #define FLM (23)
-  { 8, 17, 0, 0, 0 },
+  { 8, 17, NULL, NULL, 0 },
 
   /* The FRA field in an X or A form instruction.  */
 #define FRA (24)
 #define FRA_MASK (0x1f << 16)
-  { 5, 16, 0, 0, PPC_OPERAND_FPR },
+  { 5, 16, NULL, NULL, PPC_OPERAND_FPR },
 
   /* The FRB field in an X or A form instruction.  */
 #define FRB (25)
 #define FRB_MASK (0x1f << 11)
-  { 5, 11, 0, 0, PPC_OPERAND_FPR },
+  { 5, 11, NULL, NULL, PPC_OPERAND_FPR },
 
   /* The FRC field in an A form instruction.  */
 #define FRC (26)
 #define FRC_MASK (0x1f << 6)
-  { 5, 6, 0, 0, PPC_OPERAND_FPR },
+  { 5, 6, NULL, NULL, PPC_OPERAND_FPR },
 
   /* The FRS field in an X form instruction or the FRT field in a D, X
      or A form instruction.  */
 #define FRS (27)
 #define FRT (FRS)
-  { 5, 21, 0, 0, PPC_OPERAND_FPR },
+  { 5, 21, NULL, NULL, PPC_OPERAND_FPR },
 
   /* The FXM field in an XFX instruction.  */
 #define FXM (28)
 #define FXM_MASK (0xff << 12)
-  { 8, 12, 0, 0, 0 },
+  { 8, 12, NULL, NULL, 0 },
 
   /* The L field in a D or X form instruction.  */
 #define L (29)
-  { 1, 21, 0, 0, PPC_OPERAND_OPTIONAL },
+  { 1, 21, NULL, NULL, PPC_OPERAND_OPTIONAL },
 
   /* The LEV field in a POWER SC form instruction.  */
 #define LEV (30)
-  { 7, 5, 0, 0, 0 },
+  { 7, 5, NULL, NULL, 0 },
 
   /* The LI field in an I form instruction.  The lower two bits are
      forced to zero.  */
@@ -248,19 +248,19 @@
   /* The MB field in an M form instruction.  */
 #define MB (33)
 #define MB_MASK (0x1f << 6)
-  { 5, 6, 0, 0, 0 },
+  { 5, 6, NULL, NULL, 0 },
 
   /* The ME field in an M form instruction.  */
 #define ME (34)
 #define ME_MASK (0x1f << 1)
-  { 5, 1, 0, 0, 0 },
+  { 5, 1, NULL, NULL, 0 },
 
   /* The MB and ME fields in an M form instruction expressed a single
      operand which is a bitmask indicating which bits to select.  This
      is a two operand form using PPC_OPERAND_NEXT.  See the
      description in opcode/ppc.h for what this means.  */
 #define MBE (35)
-  { 5, 6, 0, 0, PPC_OPERAND_OPTIONAL | PPC_OPERAND_NEXT },
+  { 5, 6, NULL, NULL, PPC_OPERAND_OPTIONAL | PPC_OPERAND_NEXT },
   { 32, 0, insert_mbe, extract_mbe, 0 },
 
   /* The MB or ME field in an MD or MDS form instruction.  The high
@@ -284,29 +284,29 @@
   /* The RA field in an D, DS, X, XO, M, or MDS form instruction.  */
 #define RA (40)
 #define RA_MASK (0x1f << 16)
-  { 5, 16, 0, 0, PPC_OPERAND_GPR },
+  { 5, 16, NULL, NULL, PPC_OPERAND_GPR },
 
   /* The RA field in a D or X form instruction which is an updating
      load, which means that the RA field may not be zero and may not
      equal the RT field.  */
 #define RAL (41)
-  { 5, 16, insert_ral, 0, PPC_OPERAND_GPR },
+  { 5, 16, insert_ral, NULL, PPC_OPERAND_GPR },
 
   /* The RA field in an lmw instruction, which has special value
      restrictions.  */
 #define RAM (42)
-  { 5, 16, insert_ram, 0, PPC_OPERAND_GPR },
+  { 5, 16, insert_ram, NULL, PPC_OPERAND_GPR },
 
   /* The RA field in a D or X form instruction which is an updating
      store or an updating floating point load, which means that the RA
      field may not be zero.  */
 #define RAS (43)
-  { 5, 16, insert_ras, 0, PPC_OPERAND_GPR },
+  { 5, 16, insert_ras, NULL, PPC_OPERAND_GPR },
 
   /* The RB field in an X, XO, M, or MDS form instruction.  */
 #define RB (44)
 #define RB_MASK (0x1f << 11)
-  { 5, 11, 0, 0, PPC_OPERAND_GPR },
+  { 5, 11, NULL, NULL, PPC_OPERAND_GPR },
 
   /* The RB field in an X form instruction when it must be the same as
      the RS field in the instruction.  This is used for extended
@@ -320,12 +320,12 @@
 #define RS (46)
 #define RT (RS)
 #define RT_MASK (0x1f << 21)
-  { 5, 21, 0, 0, PPC_OPERAND_GPR },
+  { 5, 21, NULL, NULL, PPC_OPERAND_GPR },
 
   /* The SH field in an X or M form instruction.  */
 #define SH (47)
 #define SH_MASK (0x1f << 11)
-  { 5, 11, 0, 0, 0 },
+  { 5, 11, NULL, NULL, 0 },
 
   /* The SH field in an MD form instruction.  This is split.  */
 #define SH6 (48)
@@ -334,12 +334,12 @@
 
   /* The SI field in a D form instruction.  */
 #define SI (49)
-  { 16, 0, 0, 0, PPC_OPERAND_SIGNED },
+  { 16, 0, NULL, NULL, PPC_OPERAND_SIGNED },
 
   /* The SI field in a D form instruction when we accept a wide range
      of positive values.  */
 #define SISIGNOPT (50)
-  { 16, 0, 0, 0, PPC_OPERAND_SIGNED | PPC_OPERAND_SIGNOPT },
+  { 16, 0, NULL, NULL, PPC_OPERAND_SIGNED | PPC_OPERAND_SIGNOPT },
 
   /* The SPR field in an XFX form instruction.  This is flipped--the
      lower 5 bits are stored in the upper 5 and vice- versa.  */
@@ -350,20 +350,20 @@
   /* The BAT index number in an XFX form m[ft]ibat[lu] instruction.  */
 #define SPRBAT (52)
 #define SPRBAT_MASK (0x3 << 17)
-  { 2, 17, 0, 0, 0 },
+  { 2, 17, NULL, NULL, 0 },
 
   /* The SPRG register number in an XFX form m[ft]sprg instruction.  */
 #define SPRG (53)
 #define SPRG_MASK (0x3 << 16)
-  { 2, 16, 0, 0, 0 },
+  { 2, 16, NULL, NULL, 0 },
 
   /* The SR field in an X form instruction.  */
 #define SR (54)
-  { 4, 16, 0, 0, 0 },
+  { 4, 16, NULL, NULL, 0 },
 
   /* The SV field in a POWER SC form instruction.  */
 #define SV (55)
-  { 14, 2, 0, 0, 0 },
+  { 14, 2, NULL, NULL, 0 },
 
   /* The TBR field in an XFX form instruction.  This is like the SPR
      field, but it is optional.  */
@@ -373,15 +373,15 @@
   /* The TO field in a D or X form instruction.  */
 #define TO (57)
 #define TO_MASK (0x1f << 21)
-  { 5, 21, 0, 0, 0 },
+  { 5, 21, NULL, NULL, 0 },
 
   /* The U field in an X form instruction.  */
 #define U (58)
-  { 4, 12, 0, 0, 0 },
+  { 4, 12, NULL, NULL, 0 },
 
   /* The UI field in a D form instruction.  */
 #define UI (59)
-  { 16, 0, 0, 0, 0 },
+  { 16, 0, NULL, NULL, 0 },
 };
 
 /* The functions used to insert and extract complicated operands.  */
diff -urN linux-2.6.8-rc2/arch/ppc/xmon/start.c linux-2.6.8-rc3/arch/ppc/xmon/start.c
--- linux-2.6.8-rc2/arch/ppc/xmon/start.c	2004-06-15 22:18:52.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/xmon/start.c	2004-08-03 15:21:33.928611795 -0700
@@ -448,13 +448,13 @@
 	scc_initialized = 1;
 	if (via_modem) {
 		for (;;) {
-			xmon_write(0, "ATE1V1\r", 7);
+			xmon_write(NULL, "ATE1V1\r", 7);
 			if (xmon_expect("OK", 5)) {
-				xmon_write(0, "ATA\r", 4);
+				xmon_write(NULL, "ATA\r", 4);
 				if (xmon_expect("CONNECT", 40))
 					break;
 			}
-			xmon_write(0, "+++", 3);
+			xmon_write(NULL, "+++", 3);
 			xmon_expect("OK", 3);
 		}
 	}
@@ -618,7 +618,7 @@
 	c = xmon_getchar();
 	if (c == -1) {
 	    if (p == str)
-		return 0;
+		return NULL;
 	    break;
 	}
 	*p++ = c;
diff -urN linux-2.6.8-rc2/arch/ppc/xmon/xmon.c linux-2.6.8-rc3/arch/ppc/xmon/xmon.c
--- linux-2.6.8-rc2/arch/ppc/xmon/xmon.c	2004-06-15 22:18:37.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc/xmon/xmon.c	2004-08-03 15:21:33.929611836 -0700
@@ -239,7 +239,7 @@
 		set_backlight_level(BACKLIGHT_MAX);
 		sync();
 	}
-	debugger_fault_handler = 0;
+	debugger_fault_handler = NULL;
 #endif	/* CONFIG_PMAC_BACKLIGHT */
 	cmd = cmds(excp);
 	if (cmd == 's') {
@@ -253,7 +253,7 @@
 		insert_bpts();
 	}
 	xmon_leave();
-	xmon_regs[smp_processor_id()] = 0;
+	xmon_regs[smp_processor_id()] = NULL;
 #ifdef CONFIG_SMP
 	clear_bit(0, &got_xmon);
 	clear_bit(smp_processor_id(), &cpus_in_xmon);
@@ -352,7 +352,7 @@
 	for (i = 0; i < NBPTS; ++i, ++bp)
 		if (bp->enabled && pc == bp->address)
 			return bp;
-	return 0;
+	return NULL;
 }
 
 static void
@@ -962,7 +962,7 @@
 			xmon_puts(sysmap);
 			sync();
 		}
-		debugger_fault_handler = 0;
+		debugger_fault_handler = NULL;
 	}
 	else
 		printf("No System.map\n");
@@ -1203,7 +1203,7 @@
 		__delay(200);
 		n = size;
 	}
-	debugger_fault_handler = 0;
+	debugger_fault_handler = NULL;
 	return n;
 }
 
@@ -1233,7 +1233,7 @@
 	} else {
 		printf("*** Error writing address %x\n", adrs + n);
 	}
-	debugger_fault_handler = 0;
+	debugger_fault_handler = NULL;
 	return n;
 }
 
@@ -1673,7 +1673,7 @@
 	} else {
 		printf("*** %x exception occurred\n", fault_except);
 	}
-	debugger_fault_handler = 0;
+	debugger_fault_handler = NULL;
 }
 
 /* Input scanning routines */
@@ -1886,7 +1886,7 @@
 				} while (cur);
 				sync();
 			}
-			debugger_fault_handler = 0;
+			debugger_fault_handler = NULL;
 			termch = 0;
 			break;
 	}
@@ -1939,7 +1939,7 @@
 				*(ep++) = 0;
 				if (saddr)
 					*saddr = prev;
-				debugger_fault_handler = 0;
+				debugger_fault_handler = NULL;
 				return rbuffer;
 			}
 			prev = next;
@@ -1951,7 +1951,7 @@
 bail:
 		sync();
 	}
-	debugger_fault_handler = 0;
+	debugger_fault_handler = NULL;
 	return NULL;
 }
 
@@ -2003,6 +2003,6 @@
 		}
 		sync();
 	}
-	debugger_fault_handler = 0;
+	debugger_fault_handler = NULL;
 	return result;
 }		
diff -urN linux-2.6.8-rc2/arch/ppc64/boot/div64.S linux-2.6.8-rc3/arch/ppc64/boot/div64.S
--- linux-2.6.8-rc2/arch/ppc64/boot/div64.S	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc64/boot/div64.S	2004-08-03 15:21:33.930611877 -0700
@@ -14,7 +14,6 @@
  * 2 of the License, or (at your option) any later version.
  */
 #include <asm/ppc_asm.h>
-#include <asm/processor.h>
 
 	.globl __div64_32
 __div64_32:
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/Makefile linux-2.6.8-rc3/arch/ppc64/kernel/Makefile
--- linux-2.6.8-rc2/arch/ppc64/kernel/Makefile	2004-08-03 15:21:05.756456321 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/Makefile	2004-08-03 15:21:34.000614749 -0700
@@ -46,6 +46,7 @@
 obj-$(CONFIG_LPARCFG)		+= lparcfg.o
 obj-$(CONFIG_HVC_CONSOLE)	+= hvconsole.o
 obj-$(CONFIG_BOOTX_TEXT)	+= btext.o
+obj-$(CONFIG_HVCS)		+= hvcserver.o
 
 obj-$(CONFIG_PPC_PMAC)		+= pmac_setup.o pmac_feature.o pmac_pci.o \
 				   pmac_time.o pmac_nvram.o pmac_low_i2c.o \
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/asm-offsets.c linux-2.6.8-rc3/arch/ppc64/kernel/asm-offsets.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/asm-offsets.c	2004-08-03 15:21:05.788457632 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/asm-offsets.c	2004-08-03 15:21:34.087618318 -0700
@@ -86,10 +86,17 @@
         DEFINE(PACASAVEDMSR, offsetof(struct paca_struct, saved_msr));
         DEFINE(PACASTABREAL, offsetof(struct paca_struct, stab_real));
         DEFINE(PACASTABVIRT, offsetof(struct paca_struct, stab_addr));
-	DEFINE(PACASTABRR, offsetof(struct paca_struct, stab_next_rr));
+	DEFINE(PACASTABRR, offsetof(struct paca_struct, stab_rr));
         DEFINE(PACAR1, offsetof(struct paca_struct, saved_r1));
 	DEFINE(PACATOC, offsetof(struct paca_struct, kernel_toc));
 	DEFINE(PACAPROCENABLED, offsetof(struct paca_struct, proc_enabled));
+	DEFINE(PACASLBCACHE, offsetof(struct paca_struct, slb_cache));
+	DEFINE(PACASLBCACHEPTR, offsetof(struct paca_struct, slb_cache_ptr));
+	DEFINE(PACACONTEXTID, offsetof(struct paca_struct, context.id));
+	DEFINE(PACASLBR3, offsetof(struct paca_struct, slb_r3));
+#ifdef CONFIG_HUGETLB_PAGE
+	DEFINE(PACAHTLBSEGS, offsetof(struct paca_struct, context.htlb_segs));
+#endif /* CONFIG_HUGETLB_PAGE */
 	DEFINE(PACADEFAULTDECR, offsetof(struct paca_struct, default_decr));
 	DEFINE(PACAPROFENABLED, offsetof(struct paca_struct, prof_enabled));
 	DEFINE(PACAPROFLEN, offsetof(struct paca_struct, prof_len));
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/eeh.c linux-2.6.8-rc3/arch/ppc64/kernel/eeh.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/eeh.c	2004-08-03 15:21:05.792457795 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/eeh.c	2004-08-03 15:21:34.131620123 -0700
@@ -473,10 +473,10 @@
 {
 	struct eeh_early_enable_info *info = data;
 	int ret;
-	char *status = get_property(dn, "status", 0);
-	u32 *class_code = (u32 *)get_property(dn, "class-code", 0);
-	u32 *vendor_id = (u32 *)get_property(dn, "vendor-id", 0);
-	u32 *device_id = (u32 *)get_property(dn, "device-id", 0);
+	char *status = get_property(dn, "status", NULL);
+	u32 *class_code = (u32 *)get_property(dn, "class-code", NULL);
+	u32 *vendor_id = (u32 *)get_property(dn, "vendor-id", NULL);
+	u32 *device_id = (u32 *)get_property(dn, "device-id", NULL);
 	u32 *regs;
 	int enable;
 
@@ -522,7 +522,7 @@
 
 	/* Ok... see if this device supports EEH.  Some do, some don't,
 	 * and the only way to find out is to check each and every one. */
-	regs = (u32 *)get_property(dn, "reg", 0);
+	regs = (u32 *)get_property(dn, "reg", NULL);
 	if (regs) {
 		/* First register entry is addr (00BBSS00)  */
 		/* Try to enable eeh */
@@ -802,7 +802,7 @@
 
 	/* Build list of strings to match */
 	nstrs = 0;
-	s = (char *)get_property(dn, "ibm,loc-code", 0);
+	s = (char *)get_property(dn, "ibm,loc-code", NULL);
 	if (s)
 		strs[nstrs++] = s;
 	sprintf(devname, "dev%04x:%04x", vendor_id, device_id);
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/entry.S linux-2.6.8-rc3/arch/ppc64/kernel/entry.S
--- linux-2.6.8-rc2/arch/ppc64/kernel/entry.S	2004-08-03 15:21:05.793457836 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/entry.S	2004-08-03 15:21:34.132620164 -0700
@@ -132,7 +132,7 @@
  */
 	ld	r11,.SYS_CALL_TABLE@toc(2)
 	andi.	r10,r10,_TIF_32BIT
-	beq-	15f
+	beq	15f
 	ld	r11,.SYS_CALL_TABLE32@toc(2)
 	clrldi	r3,r3,32
 	clrldi	r4,r4,32
@@ -143,8 +143,8 @@
 15:
 	slwi	r0,r0,3
 	ldx	r10,r11,r0	/* Fetch system call handler [ptr] */
-	mtlr	r10
-	blrl			/* Call handler */
+	mtctr   r10
+	bctrl			/* Call handler */
 
 syscall_exit:
 #ifdef SHOW_SYSCALLS
@@ -182,7 +182,7 @@
 	stdcx.	r0,0,r1			/* to clear the reservation */
 	andi.	r6,r8,MSR_PR
 	ld	r4,_LINK(r1)
-	beq	1f			/* only restore r13 if */
+	beq-	1f			/* only restore r13 if */
 	ld	r13,GPR13(r1)		/* returning to usermode */
 1:	ld	r2,GPR2(r1)
 	ld	r1,GPR1(r1)
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/head.S linux-2.6.8-rc3/arch/ppc64/kernel/head.S
--- linux-2.6.8-rc2/arch/ppc64/kernel/head.S	2004-08-03 15:21:05.799458082 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/head.S	2004-08-03 15:21:34.138620410 -0700
@@ -200,6 +200,7 @@
 #define EX_R13		32
 #define EX_SRR0		40
 #define EX_DAR		48
+#define EX_LR		48	/* SLB miss saves LR, but not DAR */
 #define EX_DSISR	56
 #define EX_CCR		60
 
@@ -433,18 +434,52 @@
 	.globl DataAccessSLB_Pseries
 DataAccessSLB_Pseries:
 	mtspr	SPRG1,r13
-	mtspr	SPRG2,r12
-	mfspr	r13,DAR
-	mfcr	r12
-	srdi	r13,r13,60
-	cmpdi	r13,0xc
-	beq	.do_slb_bolted_Pseries
-	mtcrf	0x80,r12
-	mfspr	r12,SPRG2
-	EXCEPTION_PROLOG_PSERIES(PACA_EXGEN, DataAccessSLB_common)
+	mfspr	r13,SPRG3		/* get paca address into r13 */
+	std	r9,PACA_EXSLB+EX_R9(r13)	/* save r9 - r12 */
+	std	r10,PACA_EXSLB+EX_R10(r13)
+	std	r11,PACA_EXSLB+EX_R11(r13)
+	std	r12,PACA_EXSLB+EX_R12(r13)
+	std	r3,PACASLBR3(r13)
+	mfspr	r9,SPRG1
+	std	r9,PACA_EXSLB+EX_R13(r13)
+	mfcr	r9
+	clrrdi	r12,r13,32		/* get high part of &label */
+	mfmsr	r10
+	mfspr	r11,SRR0		/* save SRR0 */
+	ori	r12,r12,(.do_slb_miss)@l
+	ori	r10,r10,MSR_IR|MSR_DR	/* DON'T set RI for SLB miss */
+	mtspr	SRR0,r12
+	mfspr	r12,SRR1		/* and SRR1 */
+	mtspr	SRR1,r10
+	mfspr	r3,DAR
+	rfid
 
 	STD_EXCEPTION_PSERIES(0x400, InstructionAccess)
-	STD_EXCEPTION_PSERIES(0x480, InstructionAccessSLB)
+
+	. = 0x480
+	.globl InstructionAccessSLB_Pseries
+InstructionAccessSLB_Pseries:
+	mtspr	SPRG1,r13
+	mfspr	r13,SPRG3		/* get paca address into r13 */
+	std	r9,PACA_EXSLB+EX_R9(r13)	/* save r9 - r12 */
+	std	r10,PACA_EXSLB+EX_R10(r13)
+	std	r11,PACA_EXSLB+EX_R11(r13)
+	std	r12,PACA_EXSLB+EX_R12(r13)
+	std	r3,PACASLBR3(r13)
+	mfspr	r9,SPRG1
+	std	r9,PACA_EXSLB+EX_R13(r13)
+	mfcr	r9
+	clrrdi	r12,r13,32		/* get high part of &label */
+	mfmsr	r10
+	mfspr	r11,SRR0		/* save SRR0 */
+	ori	r12,r12,(.do_slb_miss)@l
+	ori	r10,r10,MSR_IR|MSR_DR	/* DON'T set RI for SLB miss */
+	mtspr	SRR0,r12
+	mfspr	r12,SRR1		/* and SRR1 */
+	mtspr	SRR1,r10
+	mr	r3,r11			/* SRR0 is faulting address */
+	rfid
+
 	STD_EXCEPTION_PSERIES(0x500, HardwareInterrupt)
 	STD_EXCEPTION_PSERIES(0x600, Alignment)
 	STD_EXCEPTION_PSERIES(0x700, ProgramCheck)
@@ -494,11 +529,6 @@
 	mfspr	r12,SPRG2
 	EXCEPTION_PROLOG_PSERIES(PACA_EXSLB, .do_stab_bolted)
 
-_GLOBAL(do_slb_bolted_Pseries)
-	mtcrf	0x80,r12
-	mfspr	r12,SPRG2
-	EXCEPTION_PROLOG_PSERIES(PACA_EXSLB, .do_slb_bolted)
-
 	
 	/* Space for the naca.  Architected to be located at real address
 	 * NACA_PHYS_ADDR.  Various tools rely on this location being fixed.
@@ -587,27 +617,25 @@
 	.globl	DataAccessSLB_Iseries
 DataAccessSLB_Iseries:
 	mtspr	SPRG1,r13		/* save r13 */
-	mtspr	SPRG2,r12
-	mfspr	r13,DAR
-	mfcr	r12
-	srdi	r13,r13,60
-	cmpdi	r13,0xc
-	beq	.do_slb_bolted_Iseries
-	mtcrf	0x80,r12
-	mfspr	r12,SPRG2
-	EXCEPTION_PROLOG_ISERIES_1(PACA_EXGEN)
-	EXCEPTION_PROLOG_ISERIES_2
-	b	DataAccessSLB_common
-
-.do_slb_bolted_Iseries:
-	mtcrf	0x80,r12
-	mfspr	r12,SPRG2
 	EXCEPTION_PROLOG_ISERIES_1(PACA_EXSLB)
-	EXCEPTION_PROLOG_ISERIES_2
-	b	.do_slb_bolted
+	std	r3,PACASLBR3(r13)
+	ld	r11,PACALPPACA+LPPACASRR0(r13)
+	ld	r12,PACALPPACA+LPPACASRR1(r13)
+	mfspr	r3,DAR
+	b	.do_slb_miss
 
 	STD_EXCEPTION_ISERIES(0x400, InstructionAccess, PACA_EXGEN)
-	STD_EXCEPTION_ISERIES(0x480, InstructionAccessSLB, PACA_EXGEN)
+
+	.globl	InstructionAccessSLB_Iseries
+InstructionAccessSLB_Iseries:
+	mtspr	SPRG1,r13		/* save r13 */
+	EXCEPTION_PROLOG_ISERIES_1(PACA_EXSLB)
+	std	r3,PACASLBR3(r13)
+	ld	r11,PACALPPACA+LPPACASRR0(r13)
+	ld	r12,PACALPPACA+LPPACASRR1(r13)
+	mr	r3,r11
+	b	.do_slb_miss
+
 	MASKABLE_EXCEPTION_ISERIES(0x500, HardwareInterrupt)
 	STD_EXCEPTION_ISERIES(0x600, Alignment, PACA_EXGEN)
 	STD_EXCEPTION_ISERIES(0x700, ProgramCheck, PACA_EXGEN)
@@ -683,7 +711,7 @@
 	li	r11,1
 	stb	r11,PACALPPACA+LPPACADECRINT(r13)
 	lwz	r12,PACADEFAULTDECR(r13)
-	mtspr	DEC,r12
+	mtspr	SPRN_DEC,r12
 	/* fall through */
 
 	.globl HardwareInterrupt_Iseries_masked
@@ -865,21 +893,6 @@
 	b	.do_hash_page	 	/* Try to handle as hpte fault */
 
 	.align	7
-	.globl DataAccessSLB_common
-DataAccessSLB_common:
-	mfspr	r10,DAR
-	std	r10,PACA_EXGEN+EX_DAR(r13)
-	EXCEPTION_PROLOG_COMMON(0x380, PACA_EXGEN)
-	ld	r3,PACA_EXGEN+EX_DAR(r13)
-	std	r3,_DAR(r1)
-	bl	.slb_allocate
-	cmpdi	r3,0			/* Check return code */
-	beq	fast_exception_return	/* Return if we succeeded */
-	li	r5,0
-	std	r5,_DSISR(r1)
-	b	.handle_page_fault
-
-	.align	7
 	.globl InstructionAccess_common
 InstructionAccess_common:
 	EXCEPTION_PROLOG_COMMON(0x400, PACA_EXGEN)
@@ -889,21 +902,6 @@
 	b	.do_hash_page		/* Try to handle as hpte fault */
 
 	.align	7
-	.globl InstructionAccessSLB_common
-InstructionAccessSLB_common:
-	EXCEPTION_PROLOG_COMMON(0x480, PACA_EXGEN)
-	ld	r3,_NIP(r1)		/* SRR0 = NIA	*/
-	bl	.slb_allocate
-	or.	r3,r3,r3		/* Check return code */
-	beq+	fast_exception_return	/* Return if we succeeded */
-
-	ld	r4,_NIP(r1)
-	li	r5,0
-	std	r4,_DAR(r1)
-	std	r5,_DSISR(r1)
-	b      .handle_page_fault
-
-	.align	7
 	.globl HardwareInterrupt_common
 	.globl HardwareInterrupt_entry
 HardwareInterrupt_common:
@@ -1028,7 +1026,7 @@
 	bl	.local_irq_restore
 	b	11f
 #else
-	beq+	fast_exception_return   /* Return from exception on success */
+	beq	fast_exception_return   /* Return from exception on success */
 	/* fall through */
 #endif
 
@@ -1152,130 +1150,37 @@
 /*
  * r13 points to the PACA, r9 contains the saved CR,
  * r11 and r12 contain the saved SRR0 and SRR1.
+ * r3 has the faulting address
  * r9 - r13 are saved in paca->exslb.
+ * r3 is saved in paca->slb_r3
  * We assume we aren't going to take any exceptions during this procedure.
  */
-/* XXX note fix masking in get_kernel_vsid to match */
-_GLOBAL(do_slb_bolted)
+_GLOBAL(do_slb_miss)
+	mflr	r10
+
 	stw	r9,PACA_EXSLB+EX_CCR(r13)	/* save CR in exc. frame */
 	std	r11,PACA_EXSLB+EX_SRR0(r13)	/* save SRR0 in exc. frame */
+	std	r10,PACA_EXSLB+EX_LR(r13)	/* save LR */
 
-	/*
-	 * We take the next entry, round robin. Previously we tried
-	 * to find a free slot first but that took too long. Unfortunately
-	 * we dont have any LRU information to help us choose a slot.
-	 */
-
-	/* r13 = paca */
-1:	ld	r10,PACASTABRR(r13)
-	addi	r9,r10,1
-	cmpdi	r9,SLB_NUM_ENTRIES
-	blt+	2f
-	li	r9,2			/* dont touch slot 0 or 1 */
-2:	std	r9,PACASTABRR(r13)
-
-	/* r13 = paca, r10 = entry */
-
-	/* 
-	 * Never cast out the segment for our kernel stack. Since we
-	 * dont invalidate the ERAT we could have a valid translation
-	 * for the kernel stack during the first part of exception exit 
-	 * which gets invalidated due to a tlbie from another cpu at a
-	 * non recoverable point (after setting srr0/1) - Anton
-	 */
-	slbmfee	r9,r10
-	srdi	r9,r9,27
-	/*
-	 * Use paca->ksave as the value of the kernel stack pointer,
-	 * because this is valid at all times.
-	 * The >> 27 (rather than >> 28) is so that the LSB is the
-	 * valid bit - this way we check valid and ESID in one compare.
-	 * In order to completely close the tiny race in the context
-	 * switch (between updating r1 and updating paca->ksave),
-	 * we check against both r1 and paca->ksave.
-	 */
-	srdi	r11,r1,27
-	ori	r11,r11,1
-	cmpd	r11,r9
-	beq-	1b
-	ld	r11,PACAKSAVE(r13)
-	srdi	r11,r11,27
- 	ori	r11,r11,1
- 	cmpd	r11,r9
- 	beq-	1b
-
-	/* r13 = paca, r10 = entry */
-
-	/* (((ea >> 28) & 0x1fff) << 15) | (ea >> 60) */
-	mfspr	r9,DAR
-	rldicl	r11,r9,36,51
-	sldi	r11,r11,15
-	srdi	r9,r9,60
-	or	r11,r11,r9
-
-	/* VSID_RANDOMIZER */
-	li	r9,9
-	sldi	r9,r9,32
-	oris	r9,r9,58231
-	ori	r9,r9,39831
-
-	/* vsid = (ordinal * VSID_RANDOMIZER) & VSID_MASK */
-	mulld	r11,r11,r9
-	clrldi	r11,r11,28
-
-	/* r13 = paca, r10 = entry, r11 = vsid */
-
-	/* Put together slb word1 */
-	sldi	r11,r11,12
-
-BEGIN_FTR_SECTION
-	/* set kp and c bits */
-	ori	r11,r11,0x480
-END_FTR_SECTION_IFCLR(CPU_FTR_16M_PAGE)
-BEGIN_FTR_SECTION
-	/* set kp, l and c bits */
-	ori	r11,r11,0x580
-END_FTR_SECTION_IFSET(CPU_FTR_16M_PAGE)
-
-	/* r13 = paca, r10 = entry, r11 = slb word1 */
-
-	/* Put together slb word0 */
-	mfspr	r9,DAR
-	clrrdi	r9,r9,28	/* get the new esid */
-	oris	r9,r9,0x800	/* set valid bit */
-	rldimi	r9,r10,0,52	/* insert entry */
-
-	/* r13 = paca, r9 = slb word0, r11 = slb word1 */
-
-	/* 
-	 * No need for an isync before or after this slbmte. The exception
-	 * we enter with and the rfid we exit with are context synchronizing .
-	 */
-	slbmte	r11,r9
+	bl	.slb_allocate			/* handle it */
 
 	/* All done -- return from exception. */
+
+	ld	r10,PACA_EXSLB+EX_LR(r13)
+	ld	r3,PACASLBR3(r13)
 	lwz	r9,PACA_EXSLB+EX_CCR(r13)	/* get saved CR */
 	ld	r11,PACA_EXSLB+EX_SRR0(r13)	/* get saved SRR0 */
 
+	mtlr	r10
+
 	andi.	r10,r12,MSR_RI	/* check for unrecoverable exception */
 	beq-	unrecov_slb
 
-	/*
-	 * Until everyone updates binutils hardwire the POWER4 optimised
-	 * single field mtcrf
-	 */
-#if 0
-	.machine	push
-	.machine	"power4"
+.machine	push
+.machine	"power4"
 	mtcrf	0x80,r9
-	.machine	pop
-#else
-	.long 0x7d380120
-#endif
-
-	mfmsr	r10
-	clrrdi	r10,r10,2
-	mtmsrd	r10,1
+	mtcrf	0x01,r9		/* slb_allocate uses cr0 and cr7 */
+.machine	pop
 
 	mtspr	SRR0,r11
 	mtspr	SRR1,r12
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/hvconsole.c linux-2.6.8-rc3/arch/ppc64/kernel/hvconsole.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/hvconsole.c	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/hvconsole.c	2004-08-03 15:21:34.139620451 -0700
@@ -20,6 +20,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/module.h>
 #include <asm/hvcall.h>
 #include <asm/prom.h>
 #include <asm/hvconsole.h>
@@ -50,6 +51,8 @@
 	return 0;
 }
 
+EXPORT_SYMBOL(hvc_get_chars);
+
 int hvc_put_chars(int index, const char *buf, int count)
 {
 	unsigned long *lbuf = (unsigned long *) buf;
@@ -64,6 +67,8 @@
 	return -1;
 }
 
+EXPORT_SYMBOL(hvc_put_chars);
+
 /* return the number of client vterms present */
 /* XXX this requires an interface change to handle multiple discontiguous
  * vterms */
@@ -76,7 +81,7 @@
 	 * we should _always_ be able to find one. */
 	vty = of_find_node_by_name(NULL, "vty");
 	if (vty && device_is_compatible(vty, "hvterm1")) {
-		u32 *termno = (u32 *)get_property(vty, "reg", 0);
+		u32 *termno = (u32 *)get_property(vty, "reg", NULL);
 
 		if (termno && start_termno)
 			*start_termno = *termno;
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/hvcserver.c linux-2.6.8-rc3/arch/ppc64/kernel/hvcserver.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/hvcserver.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc64/kernel/hvcserver.c	2004-08-03 15:21:34.140620492 -0700
@@ -0,0 +1,219 @@
+/*
+ * hvcserver.c
+ * Copyright (C) 2004 Ryan S Arnold, IBM Corporation
+ *
+ * PPC64 virtual I/O console server support.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
+ */
+
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/module.h>
+#include <asm/hvcall.h>
+#include <asm/hvcserver.h>
+#include <asm/io.h>
+
+#define HVCS_ARCH_VERSION "1.0.0"
+
+MODULE_AUTHOR("Ryan S. Arnold <rsa@us.ibm.com>");
+MODULE_DESCRIPTION("IBM hvcs ppc64 API");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(HVCS_ARCH_VERSION);
+
+/*
+ * Convert arch specific return codes into relevant errnos.  The hvcs
+ * functions aren't performance sensitive, so this conversion isn't an
+ * issue.
+ */
+int hvcs_convert(long to_convert)
+{
+	switch (to_convert) {
+		case H_Success:
+			return 0;
+		case H_Parameter:
+			return -EINVAL;
+		case H_Hardware:
+			return -EIO;
+		case H_Busy:
+		case H_LongBusyOrder1msec:
+		case H_LongBusyOrder10msec:
+		case H_LongBusyOrder100msec:
+		case H_LongBusyOrder1sec:
+		case H_LongBusyOrder10sec:
+		case H_LongBusyOrder100sec:
+			return -EBUSY;
+		case H_Function: /* fall through */
+		default:
+			return -EPERM;
+	}
+}
+
+int hvcs_free_partner_info(struct list_head *head)
+{
+	struct hvcs_partner_info *pi;
+	struct list_head *element;
+
+	if (!head) {
+		return -EINVAL;
+	}
+
+	while (!list_empty(head)) {
+		element = head->next;
+		pi = list_entry(element, struct hvcs_partner_info, node);
+		list_del(element);
+		kfree(pi);
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL(hvcs_free_partner_info);
+
+/* Helper function for hvcs_get_partner_info */
+int hvcs_next_partner(unsigned int unit_address,
+		unsigned long last_p_partition_ID,
+		unsigned long last_p_unit_address, unsigned long *pi_buff)
+
+{
+	long retval;
+	retval = plpar_hcall_norets(H_VTERM_PARTNER_INFO, unit_address,
+			last_p_partition_ID,
+				last_p_unit_address, virt_to_phys(pi_buff));
+	return hvcs_convert(retval);
+}
+
+/*
+ * The unit_address parameter is the unit address of the vty-server vdevice
+ * in whose partner information the caller is interested.  This function
+ * uses a pointer to a list_head instance in which to store the partner info.
+ * This function returns non-zero on success, or if there is no partner info.
+ *
+ * Invocation of this function should always be followed by an invocation of
+ * hvcs_free_partner_info() using a pointer to the SAME list head instance
+ * that was used to store the partner_info list.
+ */
+int hvcs_get_partner_info(unsigned int unit_address, struct list_head *head,
+		unsigned long *pi_buff)
+{
+	/*
+	 * This is a page sized buffer to be passed to hvcall per invocation.
+	 * NOTE: the first long returned is unit_address.  The second long
+	 * returned is the partition ID and starting with pi_buff[2] are
+	 * HVCS_CLC_LENGTH characters, which are diff size than the unsigned
+	 * long, hence the casting mumbojumbo you see later.
+	 */
+	unsigned long	last_p_partition_ID;
+	unsigned long	last_p_unit_address;
+	struct hvcs_partner_info *next_partner_info = NULL;
+	int more = 1;
+	int retval;
+
+	memset(pi_buff, 0x00, PAGE_SIZE);
+	/* invalid parameters */
+	if (!head)
+		return -EINVAL;
+
+	last_p_partition_ID = last_p_unit_address = ~0UL;
+	INIT_LIST_HEAD(head);
+
+	if (!pi_buff)
+		return -ENOMEM;
+
+	do {
+		retval = hvcs_next_partner(unit_address, last_p_partition_ID,
+				last_p_unit_address, pi_buff);
+		if (retval) {
+			/*
+			 * Don't indicate that we've failed if we have
+			 * any list elements.
+			 */
+			if (!list_empty(head))
+				return 0;
+			return retval;
+		}
+
+		last_p_partition_ID = pi_buff[0];
+		last_p_unit_address = pi_buff[1];
+
+		/* This indicates that there are no further partners */
+		if (last_p_partition_ID == ~0UL
+				&& last_p_unit_address == ~0UL)
+			break;
+
+		/* This is a very small struct and will be freed soon in
+		 * hvcs_free_partner_info(). */
+		next_partner_info = kmalloc(sizeof(struct hvcs_partner_info),
+				GFP_ATOMIC);
+
+		if (!next_partner_info) {
+			printk(KERN_WARNING "HVCONSOLE: kmalloc() failed to"
+				" allocate partner info struct.\n");
+			hvcs_free_partner_info(head);
+			return -ENOMEM;
+		}
+
+		next_partner_info->unit_address
+			= (unsigned int)last_p_unit_address;
+		next_partner_info->partition_ID
+			= (unsigned int)last_p_partition_ID;
+
+		/* copy the Null-term char too */
+		strncpy(&next_partner_info->location_code[0],
+			(char *)&pi_buff[2],
+			strlen((char *)&pi_buff[2]) + 1);
+
+		list_add_tail(&(next_partner_info->node), head);
+		next_partner_info = NULL;
+
+	} while (more);
+
+	return 0;
+}
+EXPORT_SYMBOL(hvcs_get_partner_info);
+
+/*
+ * If this function is called once and -EINVAL is returned it may
+ * indicate that the partner info needs to be refreshed for the
+ * target unit address at which point the caller must invoke
+ * hvcs_get_partner_info() and then call this function again.  If,
+ * for a second time, -EINVAL is returned then it indicates that
+ * there is probably already a partner connection registered to a
+ * different vty-server@ vdevice.  It is also possible that a second
+ * -EINVAL may indicate that one of the parms is not valid, for
+ * instance if the link was removed between the vty-server@ vdevice
+ * and the vty@ vdevice that you are trying to open.  Don't shoot the
+ * messenger.  Firmware implemented it this way.
+ */
+int hvcs_register_connection( unsigned int unit_address,
+		unsigned int p_partition_ID, unsigned int p_unit_address)
+{
+	long retval;
+	retval = plpar_hcall_norets(H_REGISTER_VTERM, unit_address,
+				p_partition_ID, p_unit_address);
+	return hvcs_convert(retval);
+}
+EXPORT_SYMBOL(hvcs_register_connection);
+
+/*
+ * If -EBUSY is returned continue to call this function
+ * until 0 is returned.
+ */
+int hvcs_free_connection(unsigned int unit_address)
+{
+	long retval;
+	retval = plpar_hcall_norets(H_FREE_VTERM, unit_address);
+	return hvcs_convert(retval);
+}
+EXPORT_SYMBOL(hvcs_free_connection);
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/iSeries_htab.c linux-2.6.8-rc3/arch/ppc64/kernel/iSeries_htab.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/iSeries_htab.c	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/iSeries_htab.c	2004-08-03 15:21:34.141620533 -0700
@@ -16,17 +16,26 @@
 #include <asm/mmu_context.h>
 #include <asm/iSeries/HvCallHpt.h>
 #include <asm/abs_addr.h>
-
-#if 0
 #include <linux/spinlock.h>
-#include <linux/bitops.h>
-#include <linux/threads.h>
-#include <linux/smp.h>
-
-#include <asm/tlbflush.h>
-#include <asm/tlb.h>
-#include <asm/cputable.h>
-#endif
+
+static spinlock_t iSeries_hlocks[64] __cacheline_aligned_in_smp = { [0 ... 63] = SPIN_LOCK_UNLOCKED};
+
+/*
+ * Very primitive algorithm for picking up a lock
+ */
+static inline void iSeries_hlock(unsigned long slot)
+{
+	if (slot & 0x8)
+		slot = ~slot;
+	spin_lock(&iSeries_hlocks[(slot >> 4) & 0x3f]);
+}
+
+static inline void iSeries_hunlock(unsigned long slot)
+{
+	if (slot & 0x8)
+		slot = ~slot;
+	spin_unlock(&iSeries_hlocks[(slot >> 4) & 0x3f]);
+}
 
 static long iSeries_hpte_insert(unsigned long hpte_group, unsigned long va,
 			 unsigned long prpn, int secondary,
@@ -44,12 +53,15 @@
 	if (secondary)
 		return -1;
 
+	iSeries_hlock(hpte_group);
+
 	slot = HvCallHpt_findValid(&lhpte, va >> PAGE_SHIFT);
-	if (lhpte.dw0.dw0.v)
-		panic("select_hpte_slot found entry already valid\n");
+	BUG_ON(lhpte.dw0.dw0.v);
 
-	if (slot == -1)	/* No available entry found in either group */
+	if (slot == -1)	{ /* No available entry found in either group */
+		iSeries_hunlock(hpte_group);
 		return -1;
+	}
 
 	if (slot < 0) {		/* MSB set means secondary group */
 		secondary = 1;
@@ -69,6 +81,8 @@
 	/* Now fill in the actual HPTE */
 	HvCallHpt_addValidate(slot, secondary, &lhpte);
 
+	iSeries_hunlock(hpte_group);
+
 	return (secondary << 3) | (slot & 7);
 }
 
@@ -92,6 +106,8 @@
 	/* Pick a random slot to start at */
 	slot_offset = mftb() & 0x7;
 
+	iSeries_hlock(hpte_group);
+
 	for (i = 0; i < HPTES_PER_GROUP; i++) {
 		lhpte.dw0.dword0 = 
 			iSeries_hpte_getword0(hpte_group + slot_offset);
@@ -99,6 +115,7 @@
 		if (!lhpte.dw0.dw0.bolted) {
 			HvCallHpt_invalidateSetSwBitsGet(hpte_group + 
 							 slot_offset, 0, 0);
+			iSeries_hunlock(hpte_group);
 			return i;
 		}
 
@@ -106,6 +123,8 @@
 		slot_offset &= 0x7;
 	}
 
+	iSeries_hunlock(hpte_group);
+
 	return -1;
 }
 
@@ -121,11 +140,16 @@
 	HPTE hpte;
 	unsigned long avpn = va >> 23;
 
+	iSeries_hlock(slot);
+
 	HvCallHpt_get(&hpte, slot);
 	if ((hpte.dw0.dw0.avpn == avpn) && (hpte.dw0.dw0.v)) {
 		HvCallHpt_setPp(slot, (newpp & 0x3) | ((newpp & 0x4) << 1));
+		iSeries_hunlock(slot);
 		return 0;
 	}
+	iSeries_hunlock(slot);
+
 	return -1;
 }
 
@@ -186,11 +210,20 @@
 {
 	HPTE lhpte;
 	unsigned long avpn = va >> 23;
+	unsigned long flags;
+
+	local_irq_save(flags);
+
+	iSeries_hlock(slot);
 
 	lhpte.dw0.dword0 = iSeries_hpte_getword0(slot);
 	
 	if ((lhpte.dw0.dw0.avpn == avpn) && lhpte.dw0.dw0.v)
 		HvCallHpt_invalidateSetSwBitsGet(slot, 0, 0);
+
+	iSeries_hunlock(slot);
+
+	local_irq_restore(flags);
 }
 
 void hpte_init_iSeries(void)
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/irq.c linux-2.6.8-rc3/arch/ppc64/kernel/irq.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/irq.c	2004-08-03 15:21:05.821458984 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/irq.c	2004-08-03 15:21:34.145620697 -0700
@@ -589,7 +589,7 @@
 }
 
 #ifdef CONFIG_PPC_ISERIES
-int do_IRQ(struct pt_regs *regs)
+void do_IRQ(struct pt_regs *regs)
 {
 	struct paca_struct *lpaca;
 	struct ItLpQueue *lpq;
@@ -629,15 +629,13 @@
 		/* Signal a fake decrementer interrupt */
 		timer_interrupt(regs);
 	}
-
-	return 1; /* lets ret_from_int know we can do checks */
 }
 
 #else	/* CONFIG_PPC_ISERIES */
 
-int do_IRQ(struct pt_regs *regs)
+void do_IRQ(struct pt_regs *regs)
 {
-	int irq, first = 1;
+	int irq;
 
 	irq_enter();
 
@@ -656,25 +654,15 @@
 	}
 #endif
 
-	/*
-	 * Every arch is required to implement ppc_md.get_irq.
-	 * This function will either return an irq number or -1 to
-	 * indicate there are no more pending.  But the first time
-	 * through the loop this means there wasn't an IRQ pending.
-	 * The value -2 is for buggy hardware and means that this IRQ
-	 * has already been handled. -- Tom
-	 */
-	while ((irq = ppc_md.get_irq(regs)) >= 0) {
+	irq = ppc_md.get_irq(regs);
+
+	if (irq >= 0)
 		ppc_irq_dispatch_handler(regs, irq);
-		first = 0;
-	}
-	if (irq != -2 && first)
+	else
 		/* That's not SMP safe ... but who cares ? */
 		ppc_spurious_interrupts++;
 
 	irq_exit();
-
-	return 1; /* lets ret_from_int know we can do checks */
 }
 #endif	/* CONFIG_PPC_ISERIES */
 
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/open_pic.c linux-2.6.8-rc3/arch/ppc64/kernel/open_pic.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/open_pic.c	2004-08-03 15:21:05.864460745 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/open_pic.c	2004-08-03 15:21:34.150620902 -0700
@@ -168,7 +168,7 @@
         struct device_node *np;
         int i;
         unsigned int *addrp;
-        unsigned char* chrp_int_ack_special = 0;
+        unsigned char* chrp_int_ack_special = NULL;
         unsigned char init_senses[NR_IRQS - NUM_ISA_INTERRUPTS];
         int nmi_irq = -1;
 #if defined(CONFIG_VT) && defined(CONFIG_ADB_KEYBOARD) && defined(XMON)
@@ -642,13 +642,13 @@
 
 	/* IPIs are marked SA_INTERRUPT as they must run with irqs disabled */
 	request_irq(openpic_vec_ipi, openpic_ipi_action, SA_INTERRUPT,
-		    "IPI0 (call function)", 0);
+		    "IPI0 (call function)", NULL);
 	request_irq(openpic_vec_ipi+1, openpic_ipi_action, SA_INTERRUPT,
-		   "IPI1 (reschedule)", 0);
+		   "IPI1 (reschedule)", NULL);
 	request_irq(openpic_vec_ipi+2, openpic_ipi_action, SA_INTERRUPT,
-		   "IPI2 (unused)", 0);
+		   "IPI2 (unused)", NULL);
 	request_irq(openpic_vec_ipi+3, openpic_ipi_action, SA_INTERRUPT,
-		   "IPI3 (debugger break)", 0);
+		   "IPI3 (debugger break)", NULL);
 
 	for ( i = 0; i < OPENPIC_NUM_IPI ; i++ )
 		openpic_enable_ipi(openpic_vec_ipi+i);
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/pSeries_htab.c linux-2.6.8-rc3/arch/ppc64/kernel/pSeries_htab.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/pSeries_htab.c	2004-06-15 22:19:12.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/pSeries_htab.c	2004-08-03 15:21:34.151620943 -0700
@@ -198,7 +198,6 @@
 	HPTE *hptep = htab_data.htab + slot;
 	Hpte_dword0 dw0;
 	unsigned long avpn = va >> 23;
-	unsigned long flags;
 	int ret = 0;
 
 	if (large)
@@ -222,10 +221,10 @@
 		tlbiel(va);
 	} else {
 		if (!(cur_cpu_spec->cpu_features & CPU_FTR_LOCKLESS_TLBIE))
-			spin_lock_irqsave(&pSeries_tlbie_lock, flags);
+			spin_lock(&pSeries_tlbie_lock);
 		tlbie(va, large);
 		if (!(cur_cpu_spec->cpu_features & CPU_FTR_LOCKLESS_TLBIE))
-			spin_unlock_irqrestore(&pSeries_tlbie_lock, flags);
+			spin_unlock(&pSeries_tlbie_lock);
 	}
 
 	return ret;
@@ -275,6 +274,7 @@
 	if (large)
 		avpn &= ~0x1UL;
 
+	local_irq_save(flags);
 	pSeries_lock_hpte(hptep);
 
 	dw0 = hptep->dw0.dw0;
@@ -292,11 +292,12 @@
 		tlbiel(va);
 	} else {
 		if (!(cur_cpu_spec->cpu_features & CPU_FTR_LOCKLESS_TLBIE))
-			spin_lock_irqsave(&pSeries_tlbie_lock, flags);
+			spin_lock(&pSeries_tlbie_lock);
 		tlbie(va, large);
 		if (!(cur_cpu_spec->cpu_features & CPU_FTR_LOCKLESS_TLBIE))
-			spin_unlock_irqrestore(&pSeries_tlbie_lock, flags);
+			spin_unlock(&pSeries_tlbie_lock);
 	}
+	local_irq_restore(flags);
 }
 
 static void pSeries_flush_hash_range(unsigned long context,
@@ -311,6 +312,8 @@
 	/* XXX fix for large ptes */
 	unsigned long large = 0;
 
+	local_irq_save(flags);
+
 	j = 0;
 	for (i = 0; i < number; i++) {
 		if ((batch->addr[i] >= USER_START) &&
@@ -363,7 +366,7 @@
 	} else {
 		/* XXX double check that it is safe to take this late */
 		if (!(cur_cpu_spec->cpu_features & CPU_FTR_LOCKLESS_TLBIE))
-			spin_lock_irqsave(&pSeries_tlbie_lock, flags);
+			spin_lock(&pSeries_tlbie_lock);
 
 		asm volatile("ptesync":::"memory");
 
@@ -373,8 +376,10 @@
 		asm volatile("eieio; tlbsync; ptesync":::"memory");
 
 		if (!(cur_cpu_spec->cpu_features & CPU_FTR_LOCKLESS_TLBIE))
-			spin_unlock_irqrestore(&pSeries_tlbie_lock, flags);
+			spin_unlock(&pSeries_tlbie_lock);
 	}
+
+	local_irq_restore(flags);
 }
 
 void hpte_init_pSeries(void)
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/pSeries_iommu.c linux-2.6.8-rc3/arch/ppc64/kernel/pSeries_iommu.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/pSeries_iommu.c	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/pSeries_iommu.c	2004-08-03 15:21:34.152620984 -0700
@@ -147,7 +147,7 @@
 		bus = pci_bus_b(ln);
 		busdn = PCI_GET_DN(bus);
 
-		dma_window = (unsigned int *)get_property(busdn, "ibm,dma-window", 0);
+		dma_window = (unsigned int *)get_property(busdn, "ibm,dma-window", NULL);
 		if (dma_window) {
 			/* Bussubno hasn't been copied yet.
 			 * Do it now because iommu_table_setparms_lpar needs it.
@@ -231,7 +231,7 @@
 {
 	unsigned int *dma_window;
 
-	dma_window = (unsigned int *)get_property(dn, "ibm,dma-window", 0);
+	dma_window = (unsigned int *)get_property(dn, "ibm,dma-window", NULL);
 
 	if (!dma_window)
 		panic("iommu_table_setparms_lpar: device %s has no"
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/pSeries_lpar.c linux-2.6.8-rc3/arch/ppc64/kernel/pSeries_lpar.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/pSeries_lpar.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/pSeries_lpar.c	2004-08-03 15:21:34.153621026 -0700
@@ -269,7 +269,7 @@
 	}
 
 	/* now we have the stdout node; figure out what type of device it is. */
-	name = (char *)get_property(stdout_node, "name", 0);
+	name = (char *)get_property(stdout_node, "name", NULL);
 	if (!name) {
 		printk(KERN_WARNING "stdout node missing 'name' property!\n");
 		goto out;
@@ -277,7 +277,7 @@
 
 	if (strncmp(name, "vty", 3) == 0) {
 		if (device_is_compatible(stdout_node, "hvterm1")) {
-			termno = (u32 *)get_property(stdout_node, "reg", 0);
+			termno = (u32 *)get_property(stdout_node, "reg", NULL);
 			if (termno) {
 				vtermno = termno[0];
 				ppc_md.udbg_putc = udbg_putcLP;
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/pSeries_pci.c linux-2.6.8-rc3/arch/ppc64/kernel/pSeries_pci.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/pSeries_pci.c	2004-08-03 15:21:05.895462015 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/pSeries_pci.c	2004-08-03 15:21:34.155621108 -0700
@@ -284,10 +284,10 @@
 				isa_dn = of_find_node_by_type(NULL, "isa");
 				if (isa_dn) {
 					isa_io_base = pci_io_base;
-					of_node_put(isa_dn);
 					pci_process_ISA_OF_ranges(isa_dn,
 						hose->io_base_phys,
 						hose->io_base_virt);
+					of_node_put(isa_dn);
                                         /* Allow all IO */
                                         io_page_mask = -1;
 				}
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/pacaData.c linux-2.6.8-rc3/arch/ppc64/kernel/pacaData.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/pacaData.c	2004-08-03 15:21:05.896462056 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/pacaData.c	2004-08-03 15:21:34.156621149 -0700
@@ -29,8 +29,10 @@
 
 /* Stack space used when we detect a bad kernel stack pointer, and
  * early in SMP boots before relocation is enabled.
+ *
+ * ABI requires stack to be 128-byte aligned
  */
-char emergency_stack[PAGE_SIZE * NR_CPUS];
+char emergency_stack[PAGE_SIZE * NR_CPUS] __attribute__((aligned(128)));
 
 /* The Paca is an array with one entry per processor.  Each contains an 
  * ItLpPaca, which contains the information shared between the 
@@ -55,7 +57,6 @@
 	.stab_addr = (asrv),		/* Virt pointer to segment table */ \
 	.emergency_sp = &emergency_stack[((number)+1) * PAGE_SIZE],	    \
 	.cpu_start = (start),		/* Processor start */		    \
-	.stab_next_rr = 1,						    \
 	.lppaca = {							    \
 		.xDesc = 0xd397d781,	/* "LpPa" */			    \
 		.xSize = sizeof(struct ItLpPaca),			    \
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/pci_dn.c linux-2.6.8-rc3/arch/ppc64/kernel/pci_dn.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/pci_dn.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/pci_dn.c	2004-08-03 15:21:34.157621190 -0700
@@ -49,13 +49,13 @@
 #ifdef CONFIG_PPC_PSERIES
 	struct pci_controller *phb = (struct pci_controller *)data;
 	u32 *regs;
-	char *device_type = get_property(dn, "device_type", 0);
+	char *device_type = get_property(dn, "device_type", NULL);
 	char *model;
 
 	dn->phb = phb;
-	if (device_type && strcmp(device_type, "pci") == 0 && get_property(dn, "class-code", 0) == 0) {
+	if (device_type && strcmp(device_type, "pci") == 0 && get_property(dn, "class-code", NULL) == 0) {
 		/* special case for PHB's.  Sigh. */
-		regs = (u32 *)get_property(dn, "bus-range", 0);
+		regs = (u32 *)get_property(dn, "bus-range", NULL);
 		dn->busno = regs[0];
 
 		model = (char *)get_property(dn, "model", NULL);
@@ -65,7 +65,7 @@
 		else
 			dn->devfn = 0;	/* assumption */
 	} else {
-		regs = (u32 *)get_property(dn, "reg", 0);
+		regs = (u32 *)get_property(dn, "reg", NULL);
 		if (regs) {
 			/* First register entry is addr (00BBSS00)  */
 			dn->busno = (regs[0] >> 16) & 0xff;
@@ -107,7 +107,7 @@
 	for (dn = start->child; dn; dn = nextdn) {
 		nextdn = NULL;
 #ifdef CONFIG_PPC_PSERIES
-		if (get_property(dn, "class-code", 0)) {
+		if (get_property(dn, "class-code", NULL)) {
 			if (pre && (ret = pre(dn, data)) != NULL)
 				return ret;
 			if (dn->child) {
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/pmac_pci.c linux-2.6.8-rc3/arch/ppc64/kernel/pmac_pci.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/pmac_pci.c	2004-06-15 22:19:42.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/pmac_pci.c	2004-08-03 15:21:34.158621231 -0700
@@ -57,7 +57,7 @@
 		int len;
 
 		/* For PCI<->PCI bridges or CardBus bridges, we go down */
-		class_code = (unsigned int *) get_property(node, "class-code", 0);
+		class_code = (unsigned int *) get_property(node, "class-code", NULL);
 		if (!class_code || ((*class_code >> 8) != PCI_CLASS_BRIDGE_PCI &&
 			(*class_code >> 8) != PCI_CLASS_BRIDGE_CARDBUS))
 			continue;
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/proc_ppc64.c linux-2.6.8-rc3/arch/ppc64/kernel/proc_ppc64.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/proc_ppc64.c	2004-06-15 22:19:43.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/proc_ppc64.c	2004-08-03 15:21:34.160621313 -0700
@@ -84,7 +84,7 @@
 {
 	struct proc_dir_entry *root;
 
-	root = proc_mkdir("ppc64", 0);
+	root = proc_mkdir("ppc64", NULL);
 	if (!root)
 		return 1;
 
@@ -94,7 +94,7 @@
 	if (!proc_mkdir("rtas", root))
 		return 1;
 
-	if (!proc_symlink("rtas", 0, "ppc64/rtas"))
+	if (!proc_symlink("rtas", NULL, "ppc64/rtas"))
 		return 1;
 
 	return 0;
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/prom.c linux-2.6.8-rc3/arch/ppc64/kernel/prom.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/prom.c	2004-08-03 15:21:05.904462384 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/prom.c	2004-08-03 15:21:34.168621641 -0700
@@ -199,16 +199,16 @@
 	unsigned long offset = reloc_offset();
 	struct prom_t *_prom = PTRRELOC(&prom);
 	va_list list;
-        
+
 	_prom->args.service = ADDR(service);
 	_prom->args.nargs = nargs;
 	_prom->args.nret = nret;
-        _prom->args.rets = (prom_arg_t *)&(_prom->args.args[nargs]);
+	_prom->args.rets = (prom_arg_t *)&(_prom->args.args[nargs]);
 
-        va_start(list, nret);
+	va_start(list, nret);
 	for (i=0; i < nargs; i++)
 		_prom->args.args[i] = va_arg(list, prom_arg_t);
-        va_end(list);
+	va_end(list);
 
 	for (i=0; i < nret ;i++)
 		_prom->args.rets[i] = 0;
@@ -244,17 +244,17 @@
 static void __init prom_print_hex(unsigned long val)
 {
 	unsigned long offset = reloc_offset();
-        int i, nibbles = sizeof(val)*2;
-        char buf[sizeof(val)*2+1];
+	int i, nibbles = sizeof(val)*2;
+	char buf[sizeof(val)*2+1];
 	struct prom_t *_prom = PTRRELOC(&prom);
 
-        for (i = nibbles-1;  i >= 0;  i--) {
-                buf[i] = (val & 0xf) + '0';
-                if (buf[i] > '9')
-                    buf[i] += ('a'-'0'-10);
-                val >>= 4;
-        }
-        buf[nibbles] = '\0';
+	for (i = nibbles-1;  i >= 0;  i--) {
+		buf[i] = (val & 0xf) + '0';
+		if (buf[i] > '9')
+			buf[i] += ('a'-'0'-10);
+		val >>= 4;
+	}
+	buf[nibbles] = '\0';
 	call_prom("write", 3, 1, _prom->stdout, buf, nibbles);
 }
 
@@ -343,22 +343,22 @@
 {
 	phandle node;
 	char type[64];
-        unsigned long num_cpus = 0;
-        unsigned long offset = reloc_offset();
+	unsigned long num_cpus = 0;
+	unsigned long offset = reloc_offset();
 	struct prom_t *_prom = PTRRELOC(&prom);
-        struct naca_struct *_naca = RELOC(naca);
-        struct systemcfg *_systemcfg = RELOC(systemcfg);
+	struct naca_struct *_naca = RELOC(naca);
+	struct systemcfg *_systemcfg = RELOC(systemcfg);
 
 	/* NOTE: _naca->debug_switch is already initialized. */
 	prom_debug("prom_initialize_naca: start...\n");
 
 	_naca->pftSize = 0;	/* ilog2 of htab size.  computed below. */
 
-        for (node = 0; prom_next_node(&node); ) {
-                type[0] = 0;
+	for (node = 0; prom_next_node(&node); ) {
+		type[0] = 0;
 		prom_getprop(node, "device_type", type, sizeof(type));
 
-                if (!strcmp(type, RELOC("cpu"))) {
+		if (!strcmp(type, RELOC("cpu"))) {
 			num_cpus += 1;
 
 			/* We're assuming *all* of the CPUs have the same
@@ -404,7 +404,7 @@
 					_naca->pftSize = pft_size[1];
 				}
 			}
-                } else if (!strcmp(type, RELOC("serial"))) {
+		} else if (!strcmp(type, RELOC("serial"))) {
 			phandle isa, pci;
 			struct isa_reg_property reg;
 			union pci_range ranges;
@@ -435,7 +435,7 @@
 					((((unsigned long)ranges.pci64.phys_hi) << 32) |
 					 (ranges.pci64.phys_lo)) + reg.address;
 			}
-                }
+		}
 	}
 
 	if (_systemcfg->platform == PLATFORM_POWERMAC)
@@ -465,8 +465,8 @@
 	}
 
 	/* We gotta have at least 1 cpu... */
-        if ( (_systemcfg->processorCount = num_cpus) < 1 )
-                PROM_BUG();
+	if ( (_systemcfg->processorCount = num_cpus) < 1 )
+		PROM_BUG();
 
 	_systemcfg->physicalMemorySize = lmb_phys_mem_size();
 
@@ -496,21 +496,21 @@
 	_systemcfg->version.minor = SYSTEMCFG_MINOR;
 	_systemcfg->processor = _get_PVR();
 
-        prom_debug("systemcfg->processorCount       = 0x%x\n",
+	prom_debug("systemcfg->processorCount       = 0x%x\n",
 		   _systemcfg->processorCount);
-        prom_debug("systemcfg->physicalMemorySize   = 0x%x\n",
+	prom_debug("systemcfg->physicalMemorySize   = 0x%x\n",
 		   _systemcfg->physicalMemorySize);
-        prom_debug("naca->pftSize                   = 0x%x\n",
+	prom_debug("naca->pftSize                   = 0x%x\n",
 		   _naca->pftSize);
-        prom_debug("systemcfg->dCacheL1LineSize     = 0x%x\n",
+	prom_debug("systemcfg->dCacheL1LineSize     = 0x%x\n",
 		   _systemcfg->dCacheL1LineSize);
-        prom_debug("systemcfg->iCacheL1LineSize     = 0x%x\n",
+	prom_debug("systemcfg->iCacheL1LineSize     = 0x%x\n",
 		   _systemcfg->iCacheL1LineSize);
-        prom_debug("naca->serialPortAddr            = 0x%x\n",
+	prom_debug("naca->serialPortAddr            = 0x%x\n",
 		   _naca->serialPortAddr);
-        prom_debug("naca->interrupt_controller      = 0x%x\n",
+	prom_debug("naca->interrupt_controller      = 0x%x\n",
 		   _naca->interrupt_controller);
-        prom_debug("systemcfg->platform             = 0x%x\n",
+	prom_debug("systemcfg->platform             = 0x%x\n",
 		   _systemcfg->platform);
 	prom_debug("prom_initialize_naca: end...\n");
 }
@@ -547,36 +547,36 @@
 #ifdef DEBUG_PROM
 void prom_dump_lmb(void)
 {
-        unsigned long i;
-        unsigned long offset = reloc_offset();
+	unsigned long i;
+	unsigned long offset = reloc_offset();
 	struct lmb *_lmb  = PTRRELOC(&lmb);
 
-        prom_printf("\nprom_dump_lmb:\n");
-        prom_printf("    memory.cnt                  = 0x%x\n",
+	prom_printf("\nprom_dump_lmb:\n");
+	prom_printf("    memory.cnt		  = 0x%x\n",
 		    _lmb->memory.cnt);
-        prom_printf("    memory.size                 = 0x%x\n",
+	prom_printf("    memory.size		 = 0x%x\n",
 		    _lmb->memory.size);
-        for (i=0; i < _lmb->memory.cnt ;i++) {
-                prom_printf("    memory.region[0x%x].base       = 0x%x\n",
+	for (i=0; i < _lmb->memory.cnt ;i++) {
+		prom_printf("    memory.region[0x%x].base       = 0x%x\n",
 			    i, _lmb->memory.region[i].base);
-                prom_printf("                      .physbase = 0x%x\n",
+		prom_printf("		      .physbase = 0x%x\n",
 			    _lmb->memory.region[i].physbase);
-                prom_printf("                      .size     = 0x%x\n",
+		prom_printf("		      .size     = 0x%x\n",
 			    _lmb->memory.region[i].size);
-        }
+	}
 
-        prom_printf("\n    reserved.cnt                  = 0x%x\n",
+	prom_printf("\n    reserved.cnt		  = 0x%x\n",
 		    _lmb->reserved.cnt);
-        prom_printf("    reserved.size                 = 0x%x\n",
+	prom_printf("    reserved.size		 = 0x%x\n",
 		    _lmb->reserved.size);
-        for (i=0; i < _lmb->reserved.cnt ;i++) {
-                prom_printf("    reserved.region[0x%x\n].base       = 0x%x\n",
+	for (i=0; i < _lmb->reserved.cnt ;i++) {
+		prom_printf("    reserved.region[0x%x\n].base       = 0x%x\n",
 			    i, _lmb->reserved.region[i].base);
-                prom_printf("                      .physbase = 0x%x\n",
+		prom_printf("		      .physbase = 0x%x\n",
 			    _lmb->reserved.region[i].physbase);
-                prom_printf("                      .size     = 0x%x\n",
+		prom_printf("		      .size     = 0x%x\n",
 			    _lmb->reserved.region[i].size);
-        }
+	}
 }
 #endif /* DEBUG_PROM */
 
@@ -584,9 +584,9 @@
 {
 	phandle node;
 	char type[64];
-        unsigned long i, offset = reloc_offset();
+	unsigned long i, offset = reloc_offset();
 	struct prom_t *_prom = PTRRELOC(&prom);
-        struct systemcfg *_systemcfg = RELOC(systemcfg);
+	struct systemcfg *_systemcfg = RELOC(systemcfg);
 	union lmb_reg_property reg;
 	unsigned long lmb_base, lmb_size;
 	unsigned long num_regs, bytes_per_reg = (_prom->encode_phys_size*2)/8;
@@ -599,11 +599,11 @@
 	if (_systemcfg->platform == PLATFORM_POWERMAC)
 		bytes_per_reg = 12;
 
-        for (node = 0; prom_next_node(&node); ) {
-                type[0] = 0;
-                prom_getprop(node, "device_type", type, sizeof(type));
+	for (node = 0; prom_next_node(&node); ) {
+		type[0] = 0;
+		prom_getprop(node, "device_type", type, sizeof(type));
 
-                if (strcmp(type, RELOC("memory")))
+		if (strcmp(type, RELOC("memory")))
 			continue;
 
 		num_regs = prom_getprop(node, "reg", &reg, sizeof(reg))
@@ -651,7 +651,7 @@
 	struct rtas_t *_rtas = PTRRELOC(&rtas);
 	struct systemcfg *_systemcfg = RELOC(systemcfg);
 	ihandle prom_rtas;
-        u32 getprop_rval;
+	u32 getprop_rval;
 	char hypertas_funcs[4];
 
 	prom_debug("prom_instantiate_rtas: start...\n");
@@ -669,7 +669,7 @@
 
 		prom_getprop(prom_rtas, "rtas-size",
 			     &getprop_rval, sizeof(getprop_rval));
-	        _rtas->size = getprop_rval;
+		_rtas->size = getprop_rval;
 		prom_printf("instantiating rtas");
 		if (_rtas->size != 0) {
 			unsigned long rtas_region = RTAS_INSTANTIATE_MAX;
@@ -707,9 +707,9 @@
 			prom_printf(" done\n");
 		}
 
-        	prom_debug("rtas->base                = 0x%x\n", _rtas->base);
-        	prom_debug("rtas->entry               = 0x%x\n", _rtas->entry);
-        	prom_debug("rtas->size                = 0x%x\n", _rtas->size);
+		prom_debug("rtas->base		= 0x%x\n", _rtas->base);
+		prom_debug("rtas->entry	       = 0x%x\n", _rtas->entry);
+		prom_debug("rtas->size		= 0x%x\n", _rtas->size);
 	}
 	prom_debug("prom_instantiate_rtas: end...\n");
 }
@@ -744,7 +744,7 @@
 {
 	phandle node;
 	ihandle phb_node;
-        unsigned long offset = reloc_offset();
+	unsigned long offset = reloc_offset();
 	char compatible[64], path[64], type[64], model[64];
 	unsigned long i, table = 0;
 	unsigned long base, vbase, align;
@@ -775,9 +775,9 @@
 
 		/* Keep the old logic in tack to avoid regression. */
 		if (compatible[0] != 0) {
-			if((strstr(compatible, RELOC("python")) == NULL) &&
-			   (strstr(compatible, RELOC("Speedwagon")) == NULL) &&
-			   (strstr(compatible, RELOC("Winnipeg")) == NULL))
+			if ((strstr(compatible, RELOC("python")) == NULL) &&
+			    (strstr(compatible, RELOC("Speedwagon")) == NULL) &&
+			    (strstr(compatible, RELOC("Winnipeg")) == NULL))
 				continue;
 		} else if (model[0] != 0) {
 			if ((strstr(model, RELOC("ython")) == NULL) &&
@@ -853,21 +853,21 @@
 		/* Call OF to setup the TCE hardware */
 		if (call_prom("package-to-path", 3, 1, node,
 			      path, sizeof(path)-1) == PROM_ERROR) {
-                        prom_printf("package-to-path failed\n");
-                } else {
-                        prom_printf("opening PHB %s", path);
-                }
-
-                phb_node = call_prom("open", 1, 1, path);
-                if ( (long)phb_node <= 0) {
-                        prom_printf("... failed\n");
-                } else {
-                        prom_printf("... done\n");
-                }
-                call_prom("call-method", 6, 0, ADDR("set-64-bit-addressing"),
+			prom_printf("package-to-path failed\n");
+		} else {
+			prom_printf("opening PHB %s", path);
+		}
+
+		phb_node = call_prom("open", 1, 1, path);
+		if ( (long)phb_node <= 0) {
+			prom_printf("... failed\n");
+		} else {
+			prom_printf("... done\n");
+		}
+		call_prom("call-method", 6, 0, ADDR("set-64-bit-addressing"),
 			  phb_node, -1, minsize,
 			  (u32) base, (u32) (base >> 32));
-                call_prom("close", 1, 0, phb_node);
+		call_prom("close", 1, 0, phb_node);
 
 		table++;
 	}
@@ -910,15 +910,15 @@
 	unsigned int cpu_threads, hw_cpu_num;
 	int propsize;
 	extern void __secondary_hold(void);
-        extern unsigned long __secondary_hold_spinloop;
-        extern unsigned long __secondary_hold_acknowledge;
-        unsigned long *spinloop
+	extern unsigned long __secondary_hold_spinloop;
+	extern unsigned long __secondary_hold_acknowledge;
+	unsigned long *spinloop
 		= (void *)virt_to_abs(&__secondary_hold_spinloop);
-        unsigned long *acknowledge
+	unsigned long *acknowledge
 		= (void *)virt_to_abs(&__secondary_hold_acknowledge);
-        unsigned long secondary_hold
+	unsigned long secondary_hold
 		= virt_to_abs(*PTRRELOC((unsigned long *)__secondary_hold));
-        struct systemcfg *_systemcfg = RELOC(systemcfg);
+	struct systemcfg *_systemcfg = RELOC(systemcfg);
 	struct paca_struct *lpaca = PTRRELOC(&paca[0]);
 	struct prom_t *_prom = PTRRELOC(&prom);
 #ifdef CONFIG_SMP
@@ -962,12 +962,12 @@
 	prom_debug("    1) *acknowledge   = 0x%x\n", *acknowledge);
 	prom_debug("    1) secondary_hold = 0x%x\n", secondary_hold);
 
-        /* Set the common spinloop variable, so all of the secondary cpus
+	/* Set the common spinloop variable, so all of the secondary cpus
 	 * will block when they are awakened from their OF spinloop.
 	 * This must occur for both SMP and non SMP kernels, since OF will
 	 * be trashed when we move the kernel.
-         */
-        *spinloop = 0;
+	 */
+	*spinloop = 0;
 
 #ifdef CONFIG_HMT
 	for (i=0; i < NR_CPUS; i++) {
@@ -986,7 +986,7 @@
 		if (strcmp(type, RELOC("okay")) != 0)
 			continue;
 
-                reg = -1;
+		reg = -1;
 		prom_getprop(node, "reg", &reg, sizeof(reg));
 
 		path = (char *) mem;
@@ -1124,7 +1124,7 @@
 	ihandle prom_options = 0;
 	char option[9];
 	unsigned long offset = reloc_offset();
-        struct naca_struct *_naca = RELOC(naca);
+	struct naca_struct *_naca = RELOC(naca);
 	char found = 0;
 
 	if (strstr(RELOC(cmd_line), RELOC("smt-enabled="))) {
@@ -1253,10 +1253,10 @@
 	struct prom_t *_prom = PTRRELOC(&prom);
 	u32 val;
 
-        if (prom_getprop(_prom->chosen, "stdout", &val, sizeof(val)) <= 0)
-                prom_panic("cannot find stdout");
+	if (prom_getprop(_prom->chosen, "stdout", &val, sizeof(val)) <= 0)
+		prom_panic("cannot find stdout");
 
-        _prom->stdout = val;
+	_prom->stdout = val;
 }
 
 static int __init prom_find_machine_type(void)
@@ -1306,7 +1306,7 @@
 	ihandle ih;
 	int i, j;
 	unsigned long offset = reloc_offset();
-        struct prom_t *_prom = PTRRELOC(&prom);
+	struct prom_t *_prom = PTRRELOC(&prom);
 	char type[16], *path;
 	static unsigned char default_colors[] = {
 		0x00, 0x00, 0x00,
@@ -1403,7 +1403,7 @@
 				break;
 #endif /* CONFIG_LOGO_LINUX_CLUT224 */
 	}
-	
+
 	return DOUBLEWORD_ALIGN(mem);
 }
 
@@ -1412,11 +1412,11 @@
 				unsigned long needed, unsigned long align)
 {
 	void *ret;
-	unsigned long offset = reloc_offset();
 
 	*mem_start = ALIGN(*mem_start, align);
 	if (*mem_start + needed > *mem_end) {
 #ifdef CONFIG_BLK_DEV_INITRD
+		unsigned long offset = reloc_offset();
 		/* FIXME: Apple OF doesn't map unclaimed mem.  If this
 		 * ever happened on G5, we'd need to fix. */
 		unsigned long initrd_len;
@@ -1592,7 +1592,7 @@
 {
 	struct bi_record *first, *last;
 
-  	prom_debug("birec_verify: r6=0x%x\n", (unsigned long)bi_recs);
+	prom_debug("birec_verify: r6=0x%x\n", (unsigned long)bi_recs);
 	if (bi_recs != NULL)
 		prom_debug("  tag=0x%x\n", bi_recs->tag);
 
@@ -1601,7 +1601,7 @@
 
 	last = (struct bi_record *)(long)bi_recs->data[0];
 
-  	prom_debug("  last=0x%x\n", (unsigned long)last);
+	prom_debug("  last=0x%x\n", (unsigned long)last);
 	if (last != NULL)
 		prom_debug("  last_tag=0x%x\n", last->tag);
 
@@ -1609,7 +1609,7 @@
 		return NULL;
 
 	first = (struct bi_record *)(long)last->data[0];
-  	prom_debug("  first=0x%x\n", (unsigned long)first);
+	prom_debug("  first=0x%x\n", (unsigned long)first);
 
 	if ( first == NULL || first != bi_recs )
 		return NULL;
@@ -1681,9 +1681,9 @@
 	/* Init prom stdout device */
 	prom_init_stdout();
 
-  	prom_debug("klimit=0x%x\n", RELOC(klimit));
-  	prom_debug("offset=0x%x\n", offset);
-  	prom_debug("->mem=0x%x\n", RELOC(klimit) - offset);
+	prom_debug("klimit=0x%x\n", RELOC(klimit));
+	prom_debug("offset=0x%x\n", offset);
+	prom_debug("->mem=0x%x\n", RELOC(klimit) - offset);
 
 	/* check out if we have bi_recs */
 	_prom->bi_recs = prom_bi_rec_verify((struct bi_record *)r6);
@@ -1713,7 +1713,7 @@
 		copy_and_flush(0, KERNELBASE - offset, 0x100, 0);
 
 	/* Start storing things at klimit */
-      	mem = RELOC(klimit) - offset;
+	mem = RELOC(klimit) - offset;
 
 	/* Get the full OF pathname of the stdout device */
 	p = (char *) mem;
@@ -1728,9 +1728,9 @@
 	_prom->encode_phys_size = (getprop_rval == 1) ? 32 : 64;
 
 	/* Determine which cpu is actually running right _now_ */
-        if (prom_getprop(_prom->chosen, "cpu",
+	if (prom_getprop(_prom->chosen, "cpu",
 			 &prom_cpu, sizeof(prom_cpu)) <= 0)
-                prom_panic("cannot find boot cpu");
+		prom_panic("cannot find boot cpu");
 
 	cpu_pkg = call_prom("instance-to-package", 1, 1, prom_cpu);
 	prom_getprop(cpu_pkg, "reg", &getprop_rval, sizeof(getprop_rval));
@@ -1739,7 +1739,7 @@
 
 	RELOC(boot_cpuid) = 0;
 
-  	prom_debug("Booting CPU hw index = 0x%x\n", _prom->cpu);
+	prom_debug("Booting CPU hw index = 0x%x\n", _prom->cpu);
 
 	/* Get the boot device and translate it to a full OF pathname. */
 	p = (char *) mem;
@@ -1773,18 +1773,18 @@
 	if (_systemcfg->platform != PLATFORM_POWERMAC)
 		prom_instantiate_rtas();
 
-        /* Initialize some system info into the Naca early... */
-        prom_initialize_naca();
+	/* Initialize some system info into the Naca early... */
+	prom_initialize_naca();
 
 	smt_setup();
 
-        /* If we are on an SMP machine, then we *MUST* do the
-         * following, regardless of whether we have an SMP
-         * kernel or not.
-         */
+	/* If we are on an SMP machine, then we *MUST* do the
+	 * following, regardless of whether we have an SMP
+	 * kernel or not.
+	 */
 	prom_hold_cpus(mem);
 
-  	prom_debug("after basic inits, mem=0x%x\n", mem);
+	prom_debug("after basic inits, mem=0x%x\n", mem);
 #ifdef CONFIG_BLK_DEV_INITRD
 	prom_debug("initrd_start=0x%x\n", RELOC(initrd_start));
 	prom_debug("initrd_end=0x%x\n", RELOC(initrd_end));
@@ -1796,7 +1796,7 @@
 	RELOC(klimit) = mem + offset;
 
 	prom_debug("new klimit is\n");
-  	prom_debug("klimit=0x%x\n", RELOC(klimit));
+	prom_debug("klimit=0x%x\n", RELOC(klimit));
 	prom_debug(" ->mem=0x%x\n", mem);
 
 	lmb_reserve(0, __pa(RELOC(klimit)));
@@ -1881,8 +1881,7 @@
  * Find out the size of each entry of the interrupts property
  * for a node.
  */
-static int __devinit
-prom_n_intr_cells(struct device_node *np)
+int __devinit prom_n_intr_cells(struct device_node *np)
 {
 	struct device_node *p;
 	unsigned int *icp;
@@ -1896,7 +1895,7 @@
 		    || get_property(p, "interrupt-map", NULL) != NULL) {
 			printk("oops, node %s doesn't have #interrupt-cells\n",
 			       p->full_name);
-		return 1;
+			return 1;
 		}
 	}
 #ifdef DEBUG_IRQ
@@ -2082,7 +2081,7 @@
 		i = 0;
 		adr = (struct address_range *) mem_start;
 		while ((l -= sizeof(struct pci_reg_property)) >= 0) {
- 			if (!measure_only) {
+			if (!measure_only) {
 				adr[i].space = pci_addrs[i].addr.a_hi;
 				adr[i].address = pci_addrs[i].addr.a_lo;
 				adr[i].size = pci_addrs[i].size_lo;
@@ -2121,7 +2120,7 @@
 		i = 0;
 		adr = (struct address_range *) mem_start;
 		while ((l -= sizeof(struct reg_property32)) >= 0) {
- 			if (!measure_only) {
+			if (!measure_only) {
 				adr[i].space = 2;
 				adr[i].address = rp[i].address + base_address;
 				adr[i].size = rp[i].size;
@@ -2161,7 +2160,7 @@
 		i = 0;
 		adr = (struct address_range *) mem_start;
 		while ((l -= sizeof(struct reg_property32)) >= 0) {
- 			if (!measure_only) {
+			if (!measure_only) {
 				adr[i].space = 2;
 				adr[i].address = rp[i].address + base_address;
 				adr[i].size = rp[i].size;
@@ -2189,7 +2188,7 @@
 		i = 0;
 		adr = (struct address_range *) mem_start;
 		while ((l -= sizeof(struct reg_property)) >= 0) {
- 			if (!measure_only) {
+			if (!measure_only) {
 				adr[i].space = rp[i].space;
 				adr[i].address = rp[i].address;
 				adr[i].size = rp[i].size;
@@ -2218,7 +2217,7 @@
 		i = 0;
 		adr = (struct address_range *) mem_start;
 		while ((l -= rpsize) >= 0) {
- 			if (!measure_only) {
+			if (!measure_only) {
 				adr[i].space = 0;
 				adr[i].address = rp[naddrc - 1];
 				adr[i].size = rp[naddrc + nsizec - 1];
@@ -2296,7 +2295,7 @@
 	return mem_start;
 }
 
-/*
+/**
  * finish_device_tree is called once things are running normally
  * (i.e. with text and data mapped to the address they were linked at).
  * It traverses the device tree and fills in the name, type,
@@ -2347,7 +2346,7 @@
 	return 1;
 }
 
-/*
+/**
  * Work out the sense (active-low level / active-high edge)
  * of each interrupt from the device tree.
  */
@@ -2369,7 +2368,7 @@
 	}
 }
 
-/*
+/**
  * Construct and return a list of the device_nodes with a given name.
  */
 struct device_node *
@@ -2388,7 +2387,7 @@
 	return head;
 }
 
-/*
+/**
  * Construct and return a list of the device_nodes with a given type.
  */
 struct device_node *
@@ -2407,7 +2406,7 @@
 	return head;
 }
 
-/*
+/**
  * Returns all nodes linked together
  */
 struct device_node *
@@ -2424,7 +2423,7 @@
 	return head;
 }
 
-/* Checks if the given "compat" string matches one of the strings in
+/** Checks if the given "compat" string matches one of the strings in
  * the device's "compatible" property
  */
 int
@@ -2448,7 +2447,7 @@
 }
 
 
-/*
+/**
  * Indicates whether the root node has a given value in its
  * compatible property.
  */
@@ -2457,7 +2456,7 @@
 {
 	struct device_node *root;
 	int rc = 0;
-  
+
 	root = of_find_node_by_path("/");
 	if (root) {
 		rc = device_is_compatible(root, compat);
@@ -2466,7 +2465,7 @@
 	return rc;
 }
 
-/*
+/**
  * Construct and return a list of the device_nodes with a given type
  * and compatible property.
  */
@@ -2489,7 +2488,7 @@
 	return head;
 }
 
-/*
+/**
  * Find the device_node with a given full_name.
  */
 struct device_node *
@@ -2904,7 +2903,7 @@
 	u32 *regs;
 	int err = 0;
 	phandle *ibm_phandle;
- 
+
 	node->name = get_property(node, "name", NULL);
 	node->type = get_property(node, "device_type", NULL);
 
@@ -2957,27 +2956,26 @@
 		if (err) goto out;
 	}
 
-       /* now do the rough equivalent of update_dn_pci_info, this
-        * probably is not correct for phb's, but should work for
-	* IOAs and slots.
-        */
-
-       node->phb = parent->phb;
-
-       regs = (u32 *)get_property(node, "reg", NULL);
-       if (regs) {
-               node->busno = (regs[0] >> 16) & 0xff;
-               node->devfn = (regs[0] >> 8) & 0xff;
-       }
+	/* now do the rough equivalent of update_dn_pci_info, this
+	 * probably is not correct for phb's, but should work for
+	 * IOAs and slots.
+	 */
+
+	node->phb = parent->phb;
+
+	regs = (u32 *)get_property(node, "reg", NULL);
+	if (regs) {
+		node->busno = (regs[0] >> 16) & 0xff;
+		node->devfn = (regs[0] >> 8) & 0xff;
+	}
 
 	/* fixing up iommu_table */
 
-	if(strcmp(node->name, "pci") == 0 &&
-                get_property(node, "ibm,dma-window", NULL)) {
-                node->bussubno = node->busno;
-                iommu_devnode_init(node);
-        }
-	else
+	if (strcmp(node->name, "pci") == 0 &&
+	    get_property(node, "ibm,dma-window", NULL)) {
+		node->bussubno = node->busno;
+		iommu_devnode_init(node);
+	} else
 		node->iommu_table = parent->iommu_table;
 
 out:
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/ras.c linux-2.6.8-rc3/arch/ppc64/kernel/ras.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/ras.c	2004-08-03 15:21:05.906462466 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/ras.c	2004-08-03 15:21:34.171621764 -0700
@@ -52,6 +52,16 @@
 #include <asm/rtas.h>
 #include <asm/ppcdebug.h>
 
+static unsigned char ras_log_buf[RTAS_ERROR_LOG_MAX];
+static spinlock_t ras_log_buf_lock = SPIN_LOCK_UNLOCKED;
+
+static int ras_get_sensor_state_token;
+static int ras_check_exception_token;
+
+#define EPOW_SENSOR_TOKEN	9
+#define EPOW_SENSOR_INDEX	0
+#define RAS_VECTOR_OFFSET	0x500
+
 static irqreturn_t ras_epow_interrupt(int irq, void *dev_id,
 					struct pt_regs * regs);
 static irqreturn_t ras_error_interrupt(int irq, void *dev_id,
@@ -59,6 +69,35 @@
 
 /* #define DEBUG */
 
+static void request_ras_irqs(struct device_node *np, char *propname,
+			irqreturn_t (*handler)(int, void *, struct pt_regs *),
+			const char *name)
+{
+	unsigned int *ireg, len, i;
+	int virq, n_intr;
+
+	ireg = (unsigned int *)get_property(np, propname, &len);
+	if (ireg == NULL)
+		return;
+	n_intr = prom_n_intr_cells(np);
+	len /= n_intr * sizeof(*ireg);
+
+	for (i = 0; i < len; i++) {
+		virq = virt_irq_create_mapping(*ireg);
+		if (virq == NO_IRQ) {
+			printk(KERN_ERR "Unable to allocate interrupt "
+			       "number for %s\n", np->full_name);
+			return;
+		}
+		if (request_irq(irq_offset_up(virq), handler, 0, name, NULL)) {
+			printk(KERN_ERR "Unable to request interrupt %d for "
+			       "%s\n", irq_offset_up(virq), np->full_name);
+			return;
+		}
+		ireg += n_intr;
+	}
+}
+
 /*
  * Initialize handlers for the set of interrupts caused by hardware errors
  * and power system events.
@@ -66,52 +105,34 @@
 static int __init init_ras_IRQ(void)
 {
 	struct device_node *np;
-	unsigned int *ireg, len, i;
-	int virq;
 
-	if ((np = of_find_node_by_path("/event-sources/internal-errors")) &&
-	    (ireg = (unsigned int *)get_property(np, "open-pic-interrupt",
-						 &len))) {
-		for (i=0; i<(len / sizeof(*ireg)); i++) {
-			virq = virt_irq_create_mapping(*(ireg));
-			if (virq == NO_IRQ) {
-				printk(KERN_ERR "Unable to allocate interrupt "
-				       "number for %s\n", np->full_name);
-				break;
-			}
-			request_irq(irq_offset_up(virq),
-				    ras_error_interrupt, 0, 
-				    "RAS_ERROR", NULL);
-			ireg++;
-		}
+	ras_get_sensor_state_token = rtas_token("get-sensor-state");
+	ras_check_exception_token = rtas_token("check-exception");
+
+	/* Internal Errors */
+	np = of_find_node_by_path("/event-sources/internal-errors");
+	if (np != NULL) {
+		request_ras_irqs(np, "open-pic-interrupt", ras_error_interrupt,
+				 "RAS_ERROR");
+		request_ras_irqs(np, "interrupts", ras_error_interrupt,
+				 "RAS_ERROR");
+		of_node_put(np);
 	}
-	of_node_put(np);
 
-	if ((np = of_find_node_by_path("/event-sources/epow-events")) &&
-	    (ireg = (unsigned int *)get_property(np, "open-pic-interrupt",
-						 &len))) {
-		for (i=0; i<(len / sizeof(*ireg)); i++) {
-			virq = virt_irq_create_mapping(*(ireg));
-			if (virq == NO_IRQ) {
-				printk(KERN_ERR "Unable to allocate interrupt "
-				       " number for %s\n", np->full_name);
-				break;
-			}
-			request_irq(irq_offset_up(virq),
-				    ras_epow_interrupt, 0, 
-				    "RAS_EPOW", NULL);
-			ireg++;
-		}
+	/* EPOW Events */
+	np = of_find_node_by_path("/event-sources/epow-events");
+	if (np != NULL) {
+		request_ras_irqs(np, "open-pic-interrupt", ras_epow_interrupt,
+				 "RAS_EPOW");
+		request_ras_irqs(np, "interrupts", ras_epow_interrupt,
+				 "RAS_EPOW");
+		of_node_put(np);
 	}
-	of_node_put(np);
 
 	return 1;
 }
 __initcall(init_ras_IRQ);
 
-static struct rtas_error_log log_buf;
-static spinlock_t log_lock = SPIN_LOCK_UNLOCKED;
-
 /*
  * Handle power subsystem events (EPOW).
  *
@@ -122,30 +143,35 @@
 static irqreturn_t
 ras_epow_interrupt(int irq, void *dev_id, struct pt_regs * regs)
 {
-	struct rtas_error_log log_entry;
-	unsigned int size = sizeof(log_entry);
 	int status = 0xdeadbeef;
+	int state = 0;
+	int critical;
 
-	spin_lock(&log_lock);
+	status = rtas_call(ras_get_sensor_state_token, 2, 2, &state,
+			   EPOW_SENSOR_TOKEN, EPOW_SENSOR_INDEX);
 
-	status = rtas_call(rtas_token("check-exception"), 6, 1, NULL, 
-			   0x500, irq, 
-			   RTAS_EPOW_WARNING | RTAS_POWERMGM_EVENTS, 
-			   1,  /* Time Critical */
-			   __pa(&log_buf), size);
-
-	log_entry = log_buf;
-
-	spin_unlock(&log_lock);
-
-	udbg_printf("EPOW <0x%lx 0x%x>\n",
-		    *((unsigned long *)&log_entry), status); 
-	printk(KERN_WARNING 
-		"EPOW <0x%lx 0x%x>\n",*((unsigned long *)&log_entry), status);
+	if (state > 3)
+		critical = 1;  /* Time Critical */
+	else
+		critical = 0;
+
+	spin_lock(&ras_log_buf_lock);
+
+	status = rtas_call(ras_check_exception_token, 6, 1, NULL,
+			   RAS_VECTOR_OFFSET,
+			   virt_irq_to_real(irq_offset_down(irq)),
+			   RTAS_EPOW_WARNING | RTAS_POWERMGM_EVENTS,
+			   critical, __pa(&ras_log_buf), RTAS_ERROR_LOG_MAX);
+
+	udbg_printf("EPOW <0x%lx 0x%x 0x%x>\n",
+		    *((unsigned long *)&ras_log_buf), status, state);
+	printk(KERN_WARNING "EPOW <0x%lx 0x%x 0x%x>\n",
+	       *((unsigned long *)&ras_log_buf), status, state);
 
 	/* format and print the extended information */
-	log_error((char *)&log_entry, ERR_TYPE_RTAS_LOG, 0);
-	
+	log_error(ras_log_buf, ERR_TYPE_RTAS_LOG, 0);
+
+	spin_unlock(&ras_log_buf_lock);
 	return IRQ_HANDLED;
 }
 
@@ -160,37 +186,33 @@
 static irqreturn_t
 ras_error_interrupt(int irq, void *dev_id, struct pt_regs * regs)
 {
-	struct rtas_error_log log_entry;
-	unsigned int size = sizeof(log_entry);
+	struct rtas_error_log *rtas_elog;
 	int status = 0xdeadbeef;
 	int fatal;
 
-	spin_lock(&log_lock);
+	spin_lock(&ras_log_buf_lock);
 
-	status = rtas_call(rtas_token("check-exception"), 6, 1, NULL, 
-			   0x500, irq, 
-			   RTAS_INTERNAL_ERROR, 
-			   1, /* Time Critical */
-			   __pa(&log_buf), size);
+	status = rtas_call(ras_check_exception_token, 6, 1, NULL,
+			   RAS_VECTOR_OFFSET,
+			   virt_irq_to_real(irq_offset_down(irq)),
+			   RTAS_INTERNAL_ERROR, 1 /*Time Critical */,
+			   __pa(&ras_log_buf), RTAS_ERROR_LOG_MAX);
 
-	log_entry = log_buf;
+	rtas_elog = (struct rtas_error_log *)ras_log_buf;
 
-	spin_unlock(&log_lock);
-
-	if ((status == 0) && (log_entry.severity >= SEVERITY_ERROR_SYNC)) 
+	if ((status == 0) && (rtas_elog->severity >= SEVERITY_ERROR_SYNC))
 		fatal = 1;
 	else
 		fatal = 0;
 
 	/* format and print the extended information */
-	log_error((char *)&log_entry, ERR_TYPE_RTAS_LOG, fatal); 
+	log_error(ras_log_buf, ERR_TYPE_RTAS_LOG, fatal);
 
 	if (fatal) {
-		udbg_printf("HW Error <0x%lx 0x%x>\n",
-			    *((unsigned long *)&log_entry), status);
-		printk(KERN_EMERG 
-		       "Error: Fatal hardware error <0x%lx 0x%x>\n",
-		       *((unsigned long *)&log_entry), status);
+		udbg_printf("Fatal HW Error <0x%lx 0x%x>\n",
+			    *((unsigned long *)&ras_log_buf), status);
+		printk(KERN_EMERG "Error: Fatal hardware error <0x%lx 0x%x>\n",
+		       *((unsigned long *)&ras_log_buf), status);
 
 #ifndef DEBUG
 		/* Don't actually power off when debugging so we can test
@@ -201,10 +223,12 @@
 #endif
 	} else {
 		udbg_printf("Recoverable HW Error <0x%lx 0x%x>\n",
-			    *((unsigned long *)&log_entry), status); 
-		printk(KERN_WARNING 
+			    *((unsigned long *)&ras_log_buf), status);
+		printk(KERN_WARNING
 		       "Warning: Recoverable hardware error <0x%lx 0x%x>\n",
-		       *((unsigned long *)&log_entry), status);
+		       *((unsigned long *)&ras_log_buf), status);
 	}
+
+	spin_unlock(&ras_log_buf_lock);
 	return IRQ_HANDLED;
 }
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/rtas.c linux-2.6.8-rc3/arch/ppc64/kernel/rtas.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/rtas.c	2004-08-03 15:21:05.908462548 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/rtas.c	2004-08-03 15:21:34.173621846 -0700
@@ -31,7 +31,7 @@
 #include <asm/delay.h>
 #include <asm/uaccess.h>
 
-struct flash_block_list_header rtas_firmware_flash_list = {0, 0};
+struct flash_block_list_header rtas_firmware_flash_list = {0, NULL};
 
 struct rtas_t rtas = { 
 	.lock = SPIN_LOCK_UNLOCKED
@@ -329,7 +329,7 @@
 		if (f->next)
 			f->next = (struct flash_block_list *)virt_to_abs(f->next);
 		else
-			f->next = 0LL;
+			f->next = NULL;
 		/* make num_blocks into the version/length field */
 		f->num_blocks = (FLASH_BLOCK_LIST_VERSION << 56) | ((f->num_blocks+1)*16);
 	}
@@ -500,7 +500,7 @@
 
 	BUG_ON(rtas_args->token == RTAS_UNKNOWN_SERVICE);
 
-	printk("%u %u Ready to die...\n",
+	printk("cpu %u (hwid %u) Ready to die...\n",
 	       smp_processor_id(), hard_smp_processor_id());
 	enter_rtas(__pa(rtas_args));
 
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/rtasd.c linux-2.6.8-rc3/arch/ppc64/kernel/rtasd.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/rtasd.c	2004-08-03 15:21:05.910462630 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/rtasd.c	2004-08-03 15:21:34.175621928 -0700
@@ -33,7 +33,7 @@
 #define DEBUG(A...)
 #endif
 
-static spinlock_t log_lock = SPIN_LOCK_UNLOCKED;
+static spinlock_t rtasd_log_lock = SPIN_LOCK_UNLOCKED;
 
 DECLARE_WAIT_QUEUE_HEAD(rtas_log_wait);
 
@@ -152,7 +152,7 @@
 	if (buf == NULL)
 		return;
 
-	spin_lock_irqsave(&log_lock, s);
+	spin_lock_irqsave(&rtasd_log_lock, s);
 
 	/* get length and increase count */
 	switch (err_type & ERR_TYPE_MASK) {
@@ -163,7 +163,7 @@
 		break;
 	case ERR_TYPE_KERNEL_PANIC:
 	default:
-		spin_unlock_irqrestore(&log_lock, s);
+		spin_unlock_irqrestore(&rtasd_log_lock, s);
 		return;
 	}
 
@@ -174,7 +174,7 @@
 	/* Check to see if we need to or have stopped logging */
 	if (fatal || no_more_logging) {
 		no_more_logging = 1;
-		spin_unlock_irqrestore(&log_lock, s);
+		spin_unlock_irqrestore(&rtasd_log_lock, s);
 		return;
 	}
 
@@ -199,12 +199,12 @@
 		else
 			rtas_log_start += 1;
 
-		spin_unlock_irqrestore(&log_lock, s);
+		spin_unlock_irqrestore(&rtasd_log_lock, s);
 		wake_up_interruptible(&rtas_log_wait);
 		break;
 	case ERR_TYPE_KERNEL_PANIC:
 	default:
-		spin_unlock_irqrestore(&log_lock, s);
+		spin_unlock_irqrestore(&rtasd_log_lock, s);
 		return;
 	}
 
@@ -247,24 +247,24 @@
 		return -ENOMEM;
 
 
-	spin_lock_irqsave(&log_lock, s);
+	spin_lock_irqsave(&rtasd_log_lock, s);
 	/* if it's 0, then we know we got the last one (the one in NVRAM) */
 	if (rtas_log_size == 0 && !no_more_logging)
 		nvram_clear_error_log();
-	spin_unlock_irqrestore(&log_lock, s);
+	spin_unlock_irqrestore(&rtasd_log_lock, s);
 
 
 	error = wait_event_interruptible(rtas_log_wait, rtas_log_size);
 	if (error)
 		goto out;
 
-	spin_lock_irqsave(&log_lock, s);
+	spin_lock_irqsave(&rtasd_log_lock, s);
 	offset = rtas_error_log_buffer_max * (rtas_log_start & LOG_NUMBER_MASK);
 	memcpy(tmp, &rtas_log_buf[offset], count);
 
 	rtas_log_start += 1;
 	rtas_log_size -= 1;
-	spin_unlock_irqrestore(&log_lock, s);
+	spin_unlock_irqrestore(&rtasd_log_lock, s);
 
 	error = copy_to_user(buf, tmp, count) ? -EFAULT : count;
 out:
@@ -455,7 +455,7 @@
 	else
 		printk(KERN_ERR "Failed to create error_log proc entry\n");
 
-	if (kernel_thread(rtasd, 0, CLONE_FS) < 0)
+	if (kernel_thread(rtasd, NULL, CLONE_FS) < 0)
 		printk(KERN_ERR "Failed to start RTAS daemon\n");
 
 	return 0;
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/rtc.c linux-2.6.8-rc3/arch/ppc64/kernel/rtc.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/rtc.c	2004-08-03 15:21:05.910462630 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/rtc.c	2004-08-03 15:21:34.175621928 -0700
@@ -207,7 +207,7 @@
 		return retval;
 
 #ifdef CONFIG_PROC_FS
-	if(create_proc_read_entry ("driver/rtc", 0, 0, rtc_read_proc, NULL) == NULL)
+	if (create_proc_read_entry ("driver/rtc", 0, NULL, rtc_read_proc, NULL) == NULL)
 		misc_deregister(&rtc_dev);
 		return -ENOMEM;
 #endif
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/smp.c linux-2.6.8-rc3/arch/ppc64/kernel/smp.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/smp.c	2004-08-03 15:21:05.915462835 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/smp.c	2004-08-03 15:21:34.180622133 -0700
@@ -300,6 +300,10 @@
 void cpu_die(void)
 {
 	local_irq_disable();
+	/* Some hardware requires clearing the CPPR, while other hardware does not
+	 * it is safe either way
+	 */
+	pSeriesLP_cppr_info(0, 0);
 	rtas_stop_self();
 	/* Should never get here... */
 	BUG();
@@ -385,8 +389,6 @@
 
 	/* Fixup atomic count: it exited inside IRQ handler. */
 	paca[lcpu].__current->thread_info->preempt_count	= 0;
-	/* Fixup SLB round-robin so next segment (kernel) goes in segment 0 */
-	paca[lcpu].stab_next_rr = 0;
 
 	/* At boot this is done in prom.c. */
 	paca[lcpu].hw_cpu_id = pcpu;
@@ -422,7 +424,11 @@
 	}
 
 	maxcpus = ireg[num_addr_cell + num_size_cell];
-	/* DRENG need to account for threads here too */
+
+	/* Double maxcpus for processors which have SMT capability */
+	if (cur_cpu_spec->cpu_features & CPU_FTR_SMT)
+		maxcpus *= 2;
+
 
 	if (maxcpus > NR_CPUS) {
 		printk(KERN_WARNING
@@ -715,7 +721,7 @@
 			printk("smp_call_function on cpu %d: other cpus not "
 			       "responding (%d)\n", smp_processor_id(),
 			       atomic_read(&data.started));
-			debugger(0);
+			debugger(NULL);
 			goto out;
 		}
 	}
@@ -730,7 +736,7 @@
 				       smp_processor_id(),
 				       atomic_read(&data.finished),
 				       atomic_read(&data.started));
-				debugger(0);
+				debugger(NULL);
 				goto out;
 			}
 		}
@@ -927,7 +933,11 @@
 
 	if (smp_ops->give_timebase)
 		smp_ops->give_timebase();
-	cpu_set(cpu, cpu_online_map);
+
+	/* Wait until cpu puts itself in the online map */
+	while (!cpu_online(cpu))
+		cpu_relax();
+
 	return 0;
 }
 
@@ -963,6 +973,10 @@
 #endif
 #endif
 
+	spin_lock(&call_lock);
+	cpu_set(cpu, cpu_online_map);
+	spin_unlock(&call_lock);
+
 	local_irq_enable();
 
 	return cpu_idle(NULL);
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/stab.c linux-2.6.8-rc3/arch/ppc64/kernel/stab.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/stab.c	2004-08-03 15:21:05.916462876 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/stab.c	2004-08-03 15:21:34.181622174 -0700
@@ -20,26 +20,10 @@
 #include <asm/naca.h>
 #include <asm/cputable.h>
 
-static int make_ste(unsigned long stab, unsigned long esid, unsigned long vsid);
-static void make_slbe(unsigned long esid, unsigned long vsid, int large,
-		      int kernel_segment);
+static int make_ste(unsigned long stab, unsigned long esid,
+		    unsigned long vsid);
 
-static inline void slb_add_bolted(void)
-{
-#ifndef CONFIG_PPC_ISERIES
-	unsigned long esid = GET_ESID(VMALLOCBASE);
-	unsigned long vsid = get_kernel_vsid(VMALLOCBASE);
-
-	WARN_ON(!irqs_disabled());
-
-	/*
-	 * Bolt in the first vmalloc segment. Since modules end
-	 * up there it gets hit very heavily.
-	 */
-	get_paca()->stab_next_rr = 1;
-	make_slbe(esid, vsid, 0, 1);
-#endif
-}
+void slb_initialize(void);
 
 /*
  * Build an entry for the base kernel segment and put it into
@@ -48,32 +32,13 @@
  */
 void stab_initialize(unsigned long stab)
 {
-	unsigned long esid, vsid; 
-	int seg0_largepages = 0;
-
-	esid = GET_ESID(KERNELBASE);
-	vsid = get_kernel_vsid(esid << SID_SHIFT); 
-
-	if (cur_cpu_spec->cpu_features & CPU_FTR_16M_PAGE)
-		seg0_largepages = 1;
+	unsigned long vsid = get_kernel_vsid(KERNELBASE);
 
 	if (cur_cpu_spec->cpu_features & CPU_FTR_SLB) {
-		/* Invalidate the entire SLB & all the ERATS */
-#ifdef CONFIG_PPC_ISERIES
-		asm volatile("isync; slbia; isync":::"memory");
-#else
-		asm volatile("isync":::"memory");
-		asm volatile("slbmte  %0,%0"::"r" (0) : "memory");
-		asm volatile("isync; slbia; isync":::"memory");
-		get_paca()->stab_next_rr = 0;
-		make_slbe(esid, vsid, seg0_largepages, 1);
-		asm volatile("isync":::"memory");
-#endif
-
-		slb_add_bolted();
+		slb_initialize();
 	} else {
 		asm volatile("isync; slbia; isync":::"memory");
-		make_ste(stab, esid, vsid);
+		make_ste(stab, GET_ESID(KERNELBASE), vsid);
 
 		/* Order update */
 		asm volatile("sync":::"memory"); 
@@ -129,7 +94,7 @@
 	 * Could not find empty entry, pick one with a round robin selection.
 	 * Search all entries in the two groups.
 	 */
-	castout_entry = get_paca()->stab_next_rr;
+	castout_entry = get_paca()->stab_rr;
 	for (i = 0; i < 16; i++) {
 		if (castout_entry < 8) {
 			global_entry = (esid & 0x1f) << 3;
@@ -148,7 +113,7 @@
 		castout_entry = (castout_entry + 1) & 0xf;
 	}
 
-	get_paca()->stab_next_rr = (castout_entry + 1) & 0xf;
+	get_paca()->stab_rr = (castout_entry + 1) & 0xf;
 
 	/* Modify the old entry to the new value. */
 
@@ -314,229 +279,3 @@
 
 	preload_stab(tsk, mm);
 }
-
-/*
- * SLB stuff
- */
-
-/*
- * Create a segment buffer entry for the given esid/vsid pair.
- *
- * NOTE: A context syncronising instruction is required before and after
- * this, in the common case we use exception entry and rfid.
- */
-static void make_slbe(unsigned long esid, unsigned long vsid, int large,
-		      int kernel_segment)
-{
-	unsigned long entry, castout_entry;
-	union {
-		unsigned long word0;
-		slb_dword0    data;
-	} esid_data;
-	union {
-		unsigned long word0;
-		slb_dword1    data;
-	} vsid_data;
-	struct paca_struct *lpaca = get_paca();
-
-	/*
-	 * We take the next entry, round robin. Previously we tried
-	 * to find a free slot first but that took too long. Unfortunately
-	 * we dont have any LRU information to help us choose a slot.
-	 */
-
-	/* 
-	 * Never cast out the segment for our kernel stack. Since we
-	 * dont invalidate the ERAT we could have a valid translation
-	 * for the kernel stack during the first part of exception exit 
-	 * which gets invalidated due to a tlbie from another cpu at a
-	 * non recoverable point (after setting srr0/1) - Anton
-	 *
-	 * paca Ksave is always valid (even when on the interrupt stack)
-	 * so we use that.
-	 */
-	castout_entry = lpaca->stab_next_rr;
-	do {
-		entry = castout_entry;
-		castout_entry++; 
-		/*
-		 * We bolt in the first kernel segment and the first
-		 * vmalloc segment.
-		 */
-		if (castout_entry >= SLB_NUM_ENTRIES)
-			castout_entry = 2;
-		asm volatile("slbmfee  %0,%1" : "=r" (esid_data) : "r" (entry));
-	} while (esid_data.data.v &&
-		 esid_data.data.esid == GET_ESID(lpaca->kstack));
-
-	lpaca->stab_next_rr = castout_entry;
-
-	/* slbie not needed as the previous mapping is still valid. */
-
-	/* 
-	 * Write the new SLB entry.
-	 */
-	vsid_data.word0 = 0;
-	vsid_data.data.vsid = vsid;
-	vsid_data.data.kp = 1;
-	if (large)
-		vsid_data.data.l = 1;
-	if (kernel_segment)
-		vsid_data.data.c = 1;
-	else
-		vsid_data.data.ks = 1;
-
-	esid_data.word0 = 0;
-	esid_data.data.esid = esid;
-	esid_data.data.v = 1;
-	esid_data.data.index = entry;
-
-	/*
-	 * No need for an isync before or after this slbmte. The exception
-	 * we enter with and the rfid we exit with are context synchronizing.
-	 */
-	asm volatile("slbmte  %0,%1" : : "r" (vsid_data), "r" (esid_data)); 
-}
-
-static inline void __slb_allocate(unsigned long esid, unsigned long vsid,
-				  mm_context_t context)
-{
-	int large = 0;
-	int region_id = REGION_ID(esid << SID_SHIFT);
-	unsigned long offset;
-
-	if (cur_cpu_spec->cpu_features & CPU_FTR_16M_PAGE) {
-		if (region_id == KERNEL_REGION_ID)
-			large = 1;
-		else if (region_id == USER_REGION_ID)
-			large = in_hugepage_area(context, esid << SID_SHIFT);
-	}
-
-	make_slbe(esid, vsid, large, region_id != USER_REGION_ID);
-
-	if (region_id != USER_REGION_ID)
-		return;
-
-	offset = __get_cpu_var(stab_cache_ptr);
-	if (offset < NR_STAB_CACHE_ENTRIES)
-		__get_cpu_var(stab_cache[offset++]) = esid;
-	else
-		offset = NR_STAB_CACHE_ENTRIES+1;
-	__get_cpu_var(stab_cache_ptr) = offset;
-}
-
-/*
- * Allocate a segment table entry for the given ea.
- */
-int slb_allocate(unsigned long ea)
-{
-	unsigned long vsid, esid;
-	mm_context_t context;
-
-	/* Check for invalid effective addresses. */
-	if (unlikely(!IS_VALID_EA(ea)))
-		return 1;
-
-	/* Kernel or user address? */
-	if (REGION_ID(ea) >= KERNEL_REGION_ID) {
-		context = KERNEL_CONTEXT(ea);
-		vsid = get_kernel_vsid(ea);
-	} else {
-		if (unlikely(!current->mm))
-			return 1;
-
-		context = current->mm->context;
-		vsid = get_vsid(context.id, ea);
-	}
-
-	esid = GET_ESID(ea);
-#ifndef CONFIG_PPC_ISERIES
-	BUG_ON((esid << SID_SHIFT) == VMALLOCBASE);
-#endif
-	__slb_allocate(esid, vsid, context);
-
-	return 0;
-}
-
-/*
- * preload some userspace segments into the SLB.
- */
-static void preload_slb(struct task_struct *tsk, struct mm_struct *mm)
-{
-	unsigned long pc = KSTK_EIP(tsk);
-	unsigned long stack = KSTK_ESP(tsk);
-	unsigned long unmapped_base;
-	unsigned long pc_esid = GET_ESID(pc);
-	unsigned long stack_esid = GET_ESID(stack);
-	unsigned long unmapped_base_esid;
-	unsigned long vsid;
-
-	if (test_tsk_thread_flag(tsk, TIF_32BIT))
-		unmapped_base = TASK_UNMAPPED_BASE_USER32;
-	else
-		unmapped_base = TASK_UNMAPPED_BASE_USER64;
-
-	unmapped_base_esid = GET_ESID(unmapped_base);
-
-	if (!IS_VALID_EA(pc) || (REGION_ID(pc) >= KERNEL_REGION_ID))
-		return;
-	vsid = get_vsid(mm->context.id, pc);
-	__slb_allocate(pc_esid, vsid, mm->context);
-
-	if (pc_esid == stack_esid)
-		return;
-
-	if (!IS_VALID_EA(stack) || (REGION_ID(stack) >= KERNEL_REGION_ID))
-		return;
-	vsid = get_vsid(mm->context.id, stack);
-	__slb_allocate(stack_esid, vsid, mm->context);
-
-	if (pc_esid == unmapped_base_esid || stack_esid == unmapped_base_esid)
-		return;
-
-	if (!IS_VALID_EA(unmapped_base) ||
-	    (REGION_ID(unmapped_base) >= KERNEL_REGION_ID))
-		return;
-	vsid = get_vsid(mm->context.id, unmapped_base);
-	__slb_allocate(unmapped_base_esid, vsid, mm->context);
-}
-
-/* Flush all user entries from the segment table of the current processor. */
-void flush_slb(struct task_struct *tsk, struct mm_struct *mm)
-{
-	unsigned long offset = __get_cpu_var(stab_cache_ptr);
-	union {
-		unsigned long word0;
-		slb_dword0 data;
-	} esid_data;
-
-	if (offset <= NR_STAB_CACHE_ENTRIES) {
-		int i;
-		asm volatile("isync" : : : "memory");
-		for (i = 0; i < offset; i++) {
-			esid_data.word0 = 0;
-			esid_data.data.esid = __get_cpu_var(stab_cache[i]);
-			BUG_ON(esid_data.data.esid == GET_ESID(VMALLOCBASE));
-			asm volatile("slbie %0" : : "r" (esid_data));
-		}
-		asm volatile("isync" : : : "memory");
-	} else {
-		asm volatile("isync; slbia; isync" : : : "memory");
-		slb_add_bolted();
-	}
-
-	/* Workaround POWER5 < DD2.1 issue */
-	if (offset == 1 || offset > NR_STAB_CACHE_ENTRIES) {
-		/* 
-		 * flush segment in EEH region, we dont normally access
-		 * addresses in this region.
-		 */
-		esid_data.word0 = 0;
-		esid_data.data.esid = EEH_REGION_ID;
-		asm volatile("slbie %0" : : "r" (esid_data));
-	}
-
-	__get_cpu_var(stab_cache_ptr) = 0;
-
-	preload_slb(tsk, mm);
-}
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/vio.c linux-2.6.8-rc3/arch/ppc64/kernel/vio.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/vio.c	2004-08-03 15:21:05.924463203 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/vio.c	2004-08-03 15:21:34.563637846 -0700
@@ -380,7 +380,7 @@
 	viodev->dev.platform_data = of_node_get(of_node);
 
 	viodev->irq = NO_IRQ;
-	irq_p = (unsigned int *)get_property(of_node, "interrupts", 0);
+	irq_p = (unsigned int *)get_property(of_node, "interrupts", NULL);
 	if (irq_p) {
 		int virq = virt_irq_create_mapping(*irq_p);
 		if (virq == NO_IRQ) {
diff -urN linux-2.6.8-rc2/arch/ppc64/kernel/xics.c linux-2.6.8-rc3/arch/ppc64/kernel/xics.c
--- linux-2.6.8-rc2/arch/ppc64/kernel/xics.c	2004-08-03 15:21:05.974465252 -0700
+++ linux-2.6.8-rc3/arch/ppc64/kernel/xics.c	2004-08-03 15:21:34.565637928 -0700
@@ -190,7 +190,7 @@
 		      val64); 
 }
 
-static void pSeriesLP_cppr_info(int n_cpu, u8 value)
+void pSeriesLP_cppr_info(int n_cpu, u8 value)
 {
 	unsigned long lpar_rc;
 
@@ -475,7 +475,7 @@
 		while (1);
 	}
 nextnode:
-	ireg = (uint *)get_property(np, "ibm,interrupt-server-ranges", 0);
+	ireg = (uint *)get_property(np, "ibm,interrupt-server-ranges", NULL);
 	if (ireg) {
 		/*
 		 * set node starting index for this node
@@ -532,7 +532,7 @@
 		xics_irq_8259_cascade_real = -1;
 		xics_irq_8259_cascade = -1;
 	} else {
-		ireg = (uint *) get_property(np, "interrupts", 0);
+		ireg = (uint *) get_property(np, "interrupts", NULL);
 		if (!ireg) {
 			printk(KERN_WARNING "Can't find ISA Interrupts Property\n");
 			udbg_printf("Can't find ISA Interrupts Property\n");
@@ -589,7 +589,7 @@
 	if (naca->interrupt_controller == IC_PPC_XIC &&
 	    xics_irq_8259_cascade != -1) {
 		if (request_irq(irq_offset_up(xics_irq_8259_cascade),
-				no_action, 0, "8259 cascade", 0))
+				no_action, 0, "8259 cascade", NULL))
 			printk(KERN_ERR "xics_init_IRQ: couldn't get 8259 cascade\n");
 		i8259_init();
 	}
@@ -604,7 +604,7 @@
 
 	/* IPIs are marked SA_INTERRUPT as they must run with irqs disabled */
 	request_irq(irq_offset_up(XICS_IPI), xics_ipi_action, SA_INTERRUPT,
-		    "IPI", 0);
+		    "IPI", NULL);
 	get_irq_desc(irq_offset_up(XICS_IPI))->status |= IRQ_PER_CPU;
 }
 #endif
@@ -657,9 +657,7 @@
 	int set_indicator = rtas_token("set-indicator");
 	const unsigned int giqs = 9005UL; /* Global Interrupt Queue Server */
 	int status = 0;
-	unsigned int irq, cpu = smp_processor_id();
-	int xics_status[2];
-	unsigned long flags;
+	unsigned int irq, virq, cpu = smp_processor_id();
 
 	BUG_ON(set_indicator == RTAS_UNKNOWN_SERVICE);
 
@@ -676,12 +674,20 @@
 	ops->cppr_info(cpu, DEFAULT_PRIORITY);
 	iosync();
 
-	printk(KERN_WARNING "HOTPLUG: Migrating IRQs away\n");
-	for_each_irq(irq) {
-		irq_desc_t *desc = get_irq_desc(irq);
+	for_each_irq(virq) {
+		irq_desc_t *desc;
+		int xics_status[2];
+		unsigned long flags;
+
+		/* We cant set affinity on ISA interrupts */
+		if (virq < irq_offset_value())
+			continue;
+
+		desc = get_irq_desc(virq);
+		irq = virt_irq_to_real(irq_offset_down(virq));
 
 		/* We need to get IPIs still. */
-		if (irq_offset_down(irq) == XICS_IPI)
+		if (irq == XICS_IPI || irq == NO_IRQ)
 			continue;
 
 		/* We only need to migrate enabled IRQS */
@@ -696,7 +702,7 @@
 		if (status) {
 			printk(KERN_ERR "migrate_irqs_away: irq=%d "
 					"ibm,get-xive returns %d\n",
-					irq, status);
+					virq, status);
 			goto unlock;
 		}
 
@@ -709,21 +715,20 @@
 			goto unlock;
 
 		printk(KERN_WARNING "IRQ %d affinity broken off cpu %u\n",
-		       irq, cpu);
+		       virq, cpu);
 
 		/* Reset affinity to all cpus */
 		xics_status[0] = default_distrib_server;
 
-		status = rtas_call(ibm_set_xive, 3, 1, NULL,
-				irq, xics_status[0], xics_status[1]);
+		status = rtas_call(ibm_set_xive, 3, 1, NULL, irq,
+				xics_status[0], xics_status[1]);
 		if (status)
 			printk(KERN_ERR "migrate_irqs_away irq=%d "
 					"ibm,set-xive returns %d\n",
-					irq, status);
+					virq, status);
 
 unlock:
 		spin_unlock_irqrestore(&desc->lock, flags);
 	}
-
 }
 #endif
diff -urN linux-2.6.8-rc2/arch/ppc64/mm/Makefile linux-2.6.8-rc3/arch/ppc64/mm/Makefile
--- linux-2.6.8-rc2/arch/ppc64/mm/Makefile	2004-06-15 22:18:45.000000000 -0700
+++ linux-2.6.8-rc3/arch/ppc64/mm/Makefile	2004-08-03 15:21:34.568638051 -0700
@@ -4,6 +4,6 @@
 
 EXTRA_CFLAGS += -mno-minimal-toc
 
-obj-y := fault.o init.o imalloc.o hash_utils.o hash_low.o tlb.o
+obj-y := fault.o init.o imalloc.o hash_utils.o hash_low.o tlb.o slb_low.o slb.o
 obj-$(CONFIG_DISCONTIGMEM) += numa.o
 obj-$(CONFIG_HUGETLB_PAGE) += hugetlbpage.o
diff -urN linux-2.6.8-rc2/arch/ppc64/mm/fault.c linux-2.6.8-rc3/arch/ppc64/mm/fault.c
--- linux-2.6.8-rc2/arch/ppc64/mm/fault.c	2004-08-03 15:21:05.978465416 -0700
+++ linux-2.6.8-rc3/arch/ppc64/mm/fault.c	2004-08-03 15:21:34.675642440 -0700
@@ -93,13 +93,15 @@
 	unsigned long is_write = error_code & 0x02000000;
 	unsigned long trap = TRAP(regs);
 
-	if (trap == 0x300 || trap == 0x380) {
+	BUG_ON((trap == 0x380) || (trap == 0x480));
+
+	if (trap == 0x300) {
 		if (debugger_fault_handler(regs))
 			return 0;
 	}
 
 	/* On a kernel SLB miss we can only check for a valid exception entry */
-	if (!user_mode(regs) && (trap == 0x380 || address >= TASK_SIZE))
+	if (!user_mode(regs) && (address >= TASK_SIZE))
 		return SIGSEGV;
 
 	if (error_code & 0x00400000) {
diff -urN linux-2.6.8-rc2/arch/ppc64/mm/hash_utils.c linux-2.6.8-rc3/arch/ppc64/mm/hash_utils.c
--- linux-2.6.8-rc2/arch/ppc64/mm/hash_utils.c	2004-08-03 15:21:05.979465457 -0700
+++ linux-2.6.8-rc3/arch/ppc64/mm/hash_utils.c	2004-08-03 15:21:34.767646215 -0700
@@ -251,7 +251,6 @@
 	struct mm_struct *mm;
 	pte_t *ptep;
 	int ret;
-	int cpu;
 	int user_region = 0;
 	int local = 0;
 	cpumask_t tmp;
@@ -303,8 +302,7 @@
 	if (pgdir == NULL)
 		return 1;
 
-	cpu = get_cpu();
-	tmp = cpumask_of_cpu(cpu);
+	tmp = cpumask_of_cpu(smp_processor_id());
 	if (user_region && cpus_equal(mm->cpu_vm_mask, tmp))
 		local = 1;
 
@@ -313,13 +311,10 @@
 		ret = hash_huge_page(mm, access, ea, vsid, local);
 	else {
 		ptep = find_linux_pte(pgdir, ea);
-		if (ptep == NULL) {
-			put_cpu();
+		if (ptep == NULL)
 			return 1;
-		}
 		ret = __hash_page(ea, access, vsid, ptep, trap, local);
 	}
-	put_cpu();
 
 	return ret;
 }
diff -urN linux-2.6.8-rc2/arch/ppc64/mm/init.c linux-2.6.8-rc3/arch/ppc64/mm/init.c
--- linux-2.6.8-rc2/arch/ppc64/mm/init.c	2004-08-03 15:21:05.980465498 -0700
+++ linux-2.6.8-rc3/arch/ppc64/mm/init.c	2004-08-03 15:21:34.769646297 -0700
@@ -545,6 +545,8 @@
 
 	boot_mapsize = init_bootmem(start >> PAGE_SHIFT, total_pages);
 
+	max_pfn = max_low_pfn;
+
 	/* add all physical memory to the bootmem map. Also find the first */
 	for (i=0; i < lmb.memory.cnt; i++) {
 		unsigned long physbase, size;
@@ -629,7 +631,6 @@
 
 	num_physpages = max_low_pfn;	/* RAM is assumed contiguous */
 	high_memory = (void *) __va(max_low_pfn * PAGE_SIZE);
-	max_pfn = max_low_pfn;
 
 #ifdef CONFIG_DISCONTIGMEM
 {
@@ -654,7 +655,7 @@
 
 	totalram_pages += free_all_bootmem();
 
-	for (addr = KERNELBASE; addr <= (unsigned long)__va(lmb_end_of_DRAM());
+	for (addr = KERNELBASE; addr < (unsigned long)__va(lmb_end_of_DRAM());
 	     addr += PAGE_SIZE) {
 		if (!PageReserved(virt_to_page(addr)))
 			continue;
@@ -764,8 +765,8 @@
 	void *pgdir;
 	pte_t *ptep;
 	int local = 0;
-	int cpu;
 	cpumask_t tmp;
+	unsigned long flags;
 
 	/* handle i-cache coherency */
 	if (!(cur_cpu_spec->cpu_features & CPU_FTR_COHERENT_ICACHE) &&
@@ -795,14 +796,14 @@
 
 	vsid = get_vsid(vma->vm_mm->context.id, ea);
 
-	cpu = get_cpu();
-	tmp = cpumask_of_cpu(cpu);
+	local_irq_save(flags);
+	tmp = cpumask_of_cpu(smp_processor_id());
 	if (cpus_equal(vma->vm_mm->cpu_vm_mask, tmp))
 		local = 1;
 
 	__hash_page(ea, pte_val(pte) & (_PAGE_USER|_PAGE_RW), vsid, ptep,
 		    0x300, local);
-	put_cpu();
+	local_irq_restore(flags);
 }
 
 void * reserve_phb_iospace(unsigned long size)
diff -urN linux-2.6.8-rc2/arch/ppc64/mm/numa.c linux-2.6.8-rc3/arch/ppc64/mm/numa.c
--- linux-2.6.8-rc2/arch/ppc64/mm/numa.c	2004-08-03 15:21:05.981465539 -0700
+++ linux-2.6.8-rc3/arch/ppc64/mm/numa.c	2004-08-03 15:21:34.770646338 -0700
@@ -356,6 +356,7 @@
 
 	min_low_pfn = 0;
 	max_low_pfn = lmb_end_of_DRAM() >> PAGE_SHIFT;
+	max_pfn = max_low_pfn;
 
 	if (parse_numa_properties())
 		setup_nonnuma();
diff -urN linux-2.6.8-rc2/arch/ppc64/mm/slb.c linux-2.6.8-rc3/arch/ppc64/mm/slb.c
--- linux-2.6.8-rc2/arch/ppc64/mm/slb.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc64/mm/slb.c	2004-08-03 15:21:34.771646379 -0700
@@ -0,0 +1,136 @@
+/*
+ * PowerPC64 SLB support.
+ *
+ * Copyright (C) 2004 David Gibson <dwg@au.ibm.com>, IBM
+ * Based on earlier code writteh by:
+ * Dave Engebretsen and Mike Corrigan {engebret|mikejc}@us.ibm.com
+ *    Copyright (c) 2001 Dave Engebretsen
+ * Copyright (C) 2002 Anton Blanchard <anton@au.ibm.com>, IBM
+ *
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/config.h>
+#include <asm/pgtable.h>
+#include <asm/mmu.h>
+#include <asm/mmu_context.h>
+#include <asm/paca.h>
+#include <asm/naca.h>
+#include <asm/cputable.h>
+
+extern void slb_allocate(unsigned long ea);
+
+static inline void create_slbe(unsigned long ea, unsigned long vsid,
+			       unsigned long flags, unsigned long entry)
+{
+	ea = (ea & ESID_MASK) | SLB_ESID_V | entry;
+	vsid = (vsid << SLB_VSID_SHIFT) | flags;
+	asm volatile("slbmte  %0,%1" :
+		     : "r" (vsid), "r" (ea)
+		     : "memory" );
+}
+
+static void slb_add_bolted(void)
+{
+#ifndef CONFIG_PPC_ISERIES
+	WARN_ON(!irqs_disabled());
+
+	/* If you change this make sure you change SLB_NUM_BOLTED
+	 * appropriately too */
+
+	/* Slot 1 - first VMALLOC segment
+         * 	Since modules end up there it gets hit very heavily.
+         */
+	create_slbe(VMALLOCBASE, get_kernel_vsid(VMALLOCBASE),
+		    SLB_VSID_KERNEL, 1);
+
+	asm volatile("isync":::"memory");
+#endif
+}
+
+/* Flush all user entries from the segment table of the current processor. */
+void switch_slb(struct task_struct *tsk, struct mm_struct *mm)
+{
+	unsigned long offset = get_paca()->slb_cache_ptr;
+	unsigned long esid_data;
+	unsigned long pc = KSTK_EIP(tsk);
+	unsigned long stack = KSTK_ESP(tsk);
+	unsigned long unmapped_base;
+
+	if (offset <= SLB_CACHE_ENTRIES) {
+		int i;
+		asm volatile("isync" : : : "memory");
+		for (i = 0; i < offset; i++) {
+			esid_data = (unsigned long)get_paca()->slb_cache[i]
+				<< SID_SHIFT;
+			asm volatile("slbie %0" : : "r" (esid_data));
+		}
+		asm volatile("isync" : : : "memory");
+	} else {
+		asm volatile("isync; slbia; isync" : : : "memory");
+		slb_add_bolted();
+	}
+
+	/* Workaround POWER5 < DD2.1 issue */
+	if (offset == 1 || offset > SLB_CACHE_ENTRIES) {
+		/* flush segment in EEH region, we shouldn't ever
+		 * access addresses in this region. */
+		asm volatile("slbie %0" : : "r"(EEHREGIONBASE));
+	}
+
+	get_paca()->slb_cache_ptr = 0;
+	get_paca()->context = mm->context;
+
+	/*
+	 * preload some userspace segments into the SLB.
+	 */
+	if (test_tsk_thread_flag(tsk, TIF_32BIT))
+		unmapped_base = TASK_UNMAPPED_BASE_USER32;
+	else
+		unmapped_base = TASK_UNMAPPED_BASE_USER64;
+
+	if (pc >= KERNELBASE)
+		return;
+	slb_allocate(pc);
+
+	if (GET_ESID(pc) == GET_ESID(stack))
+		return;
+
+	if (stack >= KERNELBASE)
+		return;
+	slb_allocate(stack);
+
+	if ((GET_ESID(pc) == GET_ESID(unmapped_base))
+	    || (GET_ESID(stack) == GET_ESID(unmapped_base)))
+		return;
+
+	if (unmapped_base >= KERNELBASE)
+		return;
+	slb_allocate(unmapped_base);
+}
+
+void slb_initialize(void)
+{
+#ifdef CONFIG_PPC_ISERIES
+	asm volatile("isync; slbia; isync":::"memory");
+#else
+	unsigned long flags = SLB_VSID_KERNEL;
+
+	/* Invalidate the entire SLB (even slot 0) & all the ERATS */
+	if (cur_cpu_spec->cpu_features & CPU_FTR_16M_PAGE)
+		flags |= SLB_VSID_L;
+
+	asm volatile("isync":::"memory");
+	asm volatile("slbmte  %0,%0"::"r" (0) : "memory");
+	asm volatile("isync; slbia; isync":::"memory");
+	create_slbe(KERNELBASE, get_kernel_vsid(KERNELBASE),
+		    flags, 0);
+
+#endif
+	slb_add_bolted();
+	get_paca()->stab_rr = SLB_NUM_BOLTED;
+}
diff -urN linux-2.6.8-rc2/arch/ppc64/mm/slb_low.S linux-2.6.8-rc3/arch/ppc64/mm/slb_low.S
--- linux-2.6.8-rc2/arch/ppc64/mm/slb_low.S	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/arch/ppc64/mm/slb_low.S	2004-08-03 15:21:34.772646420 -0700
@@ -0,0 +1,168 @@
+/*
+ * arch/ppc64/mm/slb_low.S
+ *
+ * Low-level SLB routines
+ *
+ * Copyright (C) 2004 David Gibson <dwg@au.ibm.com>, IBM
+ *
+ * Based on earlier C version:
+ * Dave Engebretsen and Mike Corrigan {engebret|mikejc}@us.ibm.com
+ *    Copyright (c) 2001 Dave Engebretsen
+ * Copyright (C) 2002 Anton Blanchard <anton@au.ibm.com>, IBM
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  as published by the Free Software Foundation; either version
+ *  2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/config.h>
+#include <asm/processor.h>
+#include <asm/page.h>
+#include <asm/mmu.h>
+#include <asm/ppc_asm.h>
+#include <asm/offsets.h>
+#include <asm/cputable.h>
+
+/* void slb_allocate(unsigned long ea);
+ *
+ * Create an SLB entry for the given EA (user or kernel).
+ * 	r3 = faulting address, r13 = PACA
+ *	r9, r10, r11 are clobbered by this function
+ * No other registers are examined or changed.
+ */
+_GLOBAL(slb_allocate)
+	/*
+	 * First find a slot, round robin. Previously we tried to find
+	 * a free slot first but that took too long. Unfortunately we
+	 * dont have any LRU information to help us choose a slot.
+	 */
+	srdi	r9,r1,27
+	ori	r9,r9,1			/* mangle SP for later compare */
+
+	ld	r10,PACASTABRR(r13)
+3:
+	addi	r10,r10,1
+	/* use a cpu feature mask if we ever change our slb size */
+	cmpldi	r10,SLB_NUM_ENTRIES
+
+	blt+	4f
+	li	r10,SLB_NUM_BOLTED
+4:
+	slbmfee	r11,r10
+	/* Don't throw out the segment for our kernel stack. Since we
+	 * dont invalidate the ERAT we could have a valid translation
+	 * for the kernel stack during the first part of exception
+	 * exit which gets invalidated due to a tlbie from another cpu
+	 * at a non recoverable point (after setting srr0/1) - Anton
+	 *
+	 * The >> 27 (rather than >> 28) is so that the LSB is the
+	 * valid bit - this way we check valid and ESID in one compare.
+	 */
+	srdi	r11,r11,27
+	cmpd	r11,r9
+	beq-	3b
+
+	std	r10,PACASTABRR(r13)
+
+	/* r3 = faulting address, r10 = entry */
+
+	srdi	r9,r3,60		/* get region */
+	srdi	r3,r3,28		/* get esid */
+	cmpldi	cr7,r9,0xc		/* cmp KERNELBASE for later use */
+
+	/* r9 = region, r3 = esid, cr7 = <>KERNELBASE */
+
+	rldicr.	r11,r3,32,16
+	bne-	8f			/* invalid ea bits set */
+	addi	r11,r9,-1
+	cmpldi	r11,0xb
+	blt-	8f			/* invalid region */
+
+	/* r9 = region, r3 = esid, r10 = entry, cr7 = <>KERNELBASE */
+
+	blt	cr7,0f			/* user or kernel? */
+
+	/* kernel address */
+	li	r11,SLB_VSID_KERNEL
+BEGIN_FTR_SECTION
+	bne	cr7,9f
+	li	r11,(SLB_VSID_KERNEL|SLB_VSID_L)
+END_FTR_SECTION_IFSET(CPU_FTR_16M_PAGE)
+	b	9f
+
+0:	/* user address */
+	li	r11,SLB_VSID_USER
+#ifdef CONFIG_HUGETLB_PAGE
+BEGIN_FTR_SECTION
+	/* check against the hugepage ranges */
+	cmpldi	r3,(TASK_HPAGE_END>>SID_SHIFT)
+	bge	6f			/* >= TASK_HPAGE_END */
+	cmpldi	r3,(TASK_HPAGE_BASE>>SID_SHIFT)
+	bge	5f			/* TASK_HPAGE_BASE..TASK_HPAGE_END */
+	cmpldi	r3,16
+	bge	6f			/* 4GB..TASK_HPAGE_BASE */
+
+	lhz	r9,PACAHTLBSEGS(r13)
+	srd	r9,r9,r3
+	andi.	r9,r9,1
+	beq	6f
+
+5:	/* this is a hugepage user address */
+	li	r11,(SLB_VSID_USER|SLB_VSID_L)
+END_FTR_SECTION_IFSET(CPU_FTR_16M_PAGE)
+#endif /* CONFIG_HUGETLB_PAGE */
+
+6:	ld	r9,PACACONTEXTID(r13)
+
+9:	/* r9 = "context", r3 = esid, r11 = flags, r10 = entry */
+
+	rldimi	r9,r3,15,0		/* r9= VSID ordinal */
+
+7:	rldimi	r10,r3,28,0		/* r10= ESID<<28 | entry */
+	oris	r10,r10,SLB_ESID_V@h	/* r10 |= SLB_ESID_V */
+
+	/* r9 = ordinal, r3 = esid, r11 = flags, r10 = esid_data */
+
+	li	r3,VSID_RANDOMIZER@higher
+	sldi	r3,r3,32
+	oris	r3,r3,VSID_RANDOMIZER@h
+	ori	r3,r3,VSID_RANDOMIZER@l
+
+	mulld	r9,r3,r9		/* r9 = ordinal * VSID_RANDOMIZER */
+	clrldi	r9,r9,28		/* r9 &= VSID_MASK */
+	sldi	r9,r9,SLB_VSID_SHIFT	/* r9 <<= SLB_VSID_SHIFT */
+	or	r9,r9,r11		/* r9 |= flags */
+
+	/* r9 = vsid_data, r10 = esid_data, cr7 = <>KERNELBASE */
+
+	/*
+	 * No need for an isync before or after this slbmte. The exception
+	 * we enter with and the rfid we exit with are context synchronizing.
+	 */
+	slbmte	r9,r10
+
+	bgelr	cr7			/* we're done for kernel addresses */
+
+	/* Update the slb cache */
+	lhz	r3,PACASLBCACHEPTR(r13)	/* offset = paca->slb_cache_ptr */
+	cmpldi	r3,SLB_CACHE_ENTRIES
+	bge	1f
+
+	/* still room in the slb cache */
+	sldi	r11,r3,1		/* r11 = offset * sizeof(u16) */
+	rldicl	r10,r10,36,28		/* get low 16 bits of the ESID */
+	add	r11,r11,r13		/* r11 = (u16 *)paca + offset */
+	sth	r10,PACASLBCACHE(r11)	/* paca->slb_cache[offset] = esid */
+	addi	r3,r3,1			/* offset++ */
+	b	2f
+1:					/* offset >= SLB_CACHE_ENTRIES */
+	li	r3,SLB_CACHE_ENTRIES+1
+2:
+	sth	r3,PACASLBCACHEPTR(r13)	/* paca->slb_cache_ptr = offset */
+	blr
+
+8:	/* invalid EA */
+	li	r9,0			/* 0 VSID ordinal -> BAD_VSID */
+	li	r11,SLB_VSID_USER	/* flags don't much matter */
+	b	7b
diff -urN linux-2.6.8-rc2/arch/s390/defconfig linux-2.6.8-rc3/arch/s390/defconfig
--- linux-2.6.8-rc2/arch/s390/defconfig	2004-08-03 15:21:06.037467833 -0700
+++ linux-2.6.8-rc3/arch/s390/defconfig	2004-08-03 15:21:34.838649127 -0700
@@ -268,10 +268,12 @@
 # QoS and/or fair queueing
 #
 CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_CLK_JIFFIES=y
+# CONFIG_NET_SCH_CLK_GETTIMEOFDAY is not set
+# CONFIG_NET_SCH_CLK_CPU is not set
 CONFIG_NET_SCH_CBQ=m
 # CONFIG_NET_SCH_HTB is not set
 # CONFIG_NET_SCH_HFSC is not set
-CONFIG_NET_SCH_CSZ=m
 CONFIG_NET_SCH_PRIO=m
 CONFIG_NET_SCH_RED=m
 CONFIG_NET_SCH_SFQ=m
@@ -279,7 +281,7 @@
 CONFIG_NET_SCH_TBF=m
 CONFIG_NET_SCH_GRED=m
 CONFIG_NET_SCH_DSMARK=m
-# CONFIG_NET_SCH_DELAY is not set
+# CONFIG_NET_SCH_NETEM is not set
 # CONFIG_NET_SCH_INGRESS is not set
 CONFIG_NET_QOS=y
 CONFIG_NET_ESTIMATOR=y
@@ -391,7 +393,8 @@
 #
 # DOS/FAT/NT Filesystems
 #
-# CONFIG_FAT_FS is not set
+# CONFIG_MSDOS_FS is not set
+# CONFIG_VFAT_FS is not set
 # CONFIG_NTFS_FS is not set
 
 #
@@ -416,6 +419,7 @@
 # CONFIG_BEFS_FS is not set
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
+# CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_HPFS_FS is not set
@@ -520,6 +524,6 @@
 #
 # Library routines
 #
-# CONFIG_CRC16 is not set
+# CONFIG_CRC_CCITT is not set
 # CONFIG_CRC32 is not set
 # CONFIG_LIBCRC32C is not set
diff -urN linux-2.6.8-rc2/arch/s390/kernel/entry.S linux-2.6.8-rc3/arch/s390/kernel/entry.S
--- linux-2.6.8-rc2/arch/s390/kernel/entry.S	2004-08-03 15:21:06.041467997 -0700
+++ linux-2.6.8-rc3/arch/s390/kernel/entry.S	2004-08-03 15:21:34.842649291 -0700
@@ -62,107 +62,53 @@
  *    R15 - kernel stack pointer
  */
 
-        .macro  SAVE_ALL_BASE psworg,savearea,sync
-        stm     %r12,%r15,\savearea
-	l	%r13,__LC_SVC_NEW_PSW+4   # load &system_call to %r13
+	.macro	SAVE_ALL_BASE savearea
+	stm	%r12,%r15,\savearea
+	l	%r13,__LC_SVC_NEW_PSW+4	# load &system_call to %r13
 	.endm
 
-        .macro  CLEANUP_SAVE_ALL_BASE psworg,savearea,sync
-	l	%r1,SP_PSW+4(%r15)
-	cli	1(%r1),0xcf
-	bne	BASED(0f)
-	mvc	\savearea(16),SP_R12(%r15)
-0:	st	%r13,SP_R13(%r15)
-	.endm
-
-        .macro  SAVE_ALL psworg,savearea,sync
+	.macro	SAVE_ALL psworg,savearea,sync
+	la	%r12,\psworg
 	.if	\sync
-        tm      \psworg+1,0x01            # test problem state bit
-        bz      BASED(1f)                 # skip stack setup save
-        l       %r15,__LC_KERNEL_STACK    # problem state -> load ksp
+	tm	\psworg+1,0x01		# test problem state bit
+	bz	BASED(2f)		# skip stack setup save
+	l	%r15,__LC_KERNEL_STACK	# problem state -> load ksp
 	.else
-        tm      \psworg+1,0x01            # test problem state bit
-        bnz     BASED(0f)                 # from user -> load async stack
-	l	%r14,__LC_ASYNC_STACK	  # are we already on the async stack ?
-	slr     %r14,%r15
+	tm	\psworg+1,0x01		# test problem state bit
+	bnz	BASED(1f)		# from user -> load async stack
+	clc	\psworg+4(4),BASED(.Lcritical_end)
+	bhe	BASED(0f)
+	clc	\psworg+4(4),BASED(.Lcritical_start)
+	bl	BASED(0f)
+	l	%r14,BASED(.Lcleanup_critical)
+	basr	%r14,%r14
+	tm	0(%r12),0x01		# retest problem state after cleanup
+	bnz	BASED(1f)
+0:	l	%r14,__LC_ASYNC_STACK	# are we already on the async stack ?
+	slr	%r14,%r15
 	sra	%r14,13
-	be	BASED(1f)
-0:	l	%r15,__LC_ASYNC_STACK
+	be	BASED(2f)
+1:	l	%r15,__LC_ASYNC_STACK
 	.endif
-1:      s       %r15,BASED(.Lc_spsize)    # make room for registers & psw
-	l	%r14,BASED(.L\psworg)
-	slr	%r12,%r12
-	icm	%r14,12,__LC_SVC_ILC
-        stm     %r0,%r11,SP_R0(%r15)      # store gprs 0-12 to kernel stack
-        st      %r2,SP_ORIG_R2(%r15)      # store original content of gpr 2
-        mvc     SP_R12(16,%r15),\savearea # move R13-R15 to stack
-        mvc     SP_PSW(8,%r15),\psworg    # move user PSW to stack
-	st	%r14,SP_ILC(%r15)
-        st      %r12,0(%r15)              # clear back chain
-        .endm
-
-	.macro	CLEANUP_SAVE_ALL psworg,savearea,sync
-	l	%r1,\savearea+12
-	.if	\sync
-	tm	\psworg+1,0x01
-	bz	BASED(1f)
-	l	%r1,__LC_KERNEL_STACK
-	.else
-	tm	\psworg+1,0x01
-	bnz	BASED(0f)
-	l	%r0,__LC_ASYNC_STACK
-	slr	%r0,%r1
-	sra	%r0,13
-	bz	BASED(1f)
-0:	l	%r1,__LC_ASYNC_STACK
-	.endif
-1:	s	%r1,BASED(.Lc_spsize)
-	st	%r1,SP_R15(%r15)
-	l	%r0,BASED(.L\psworg)
-	xc	SP_R12(4,%r15),SP_R12(%r15)
-	icm	%r0,12,__LC_SVC_ILC
-	st	%r0,SP_R14(%r15)
-	mvc	SP_R0(48,%r1),SP_R0(%r15)
-	mvc	SP_ORIG_R2(4,%r1),SP_R2(%r15)
-	mvc	SP_R12(16,%r1),\savearea
-	mvc	SP_PSW(8,%r1),\psworg
-	st	%r0,SP_ILC(%r1)
-	xc	0(4,%r1),0(%r1)
-	.endm
-
-        .macro  RESTORE_ALL               # system exit macro
-        mvc     __LC_RETURN_PSW(8),SP_PSW(%r15)  # move user PSW to lowcore
-        ni      __LC_RETURN_PSW+1,0xfd    # clear wait state bit
-        lm      %r0,%r15,SP_R0(%r15)      # load gprs 0-15 of user
-        lpsw    __LC_RETURN_PSW           # back to caller
-        .endm
-
-	.macro	CLEANUP_RESTORE_ALL
-	l	%r1,SP_PSW+4(%r15)
-	cli	0(%r1),0x82
-	bne	BASED(0f)
-	mvc	SP_PSW(8,%r15),__LC_RETURN_PSW
-	b	BASED(1f)
-0:	l	%r1,SP_R15(%r15)
-	mvc	SP_PSW(8,%r15),SP_PSW(%r1)
-	mvc	SP_R0(64,%r15),SP_R0(%r1)
-1:
+2:	s	%r15,BASED(.Lc_spsize)	# make room for registers & psw
+	mvc	SP_PSW(8,%r15),0(%r12)	# move user PSW to stack
+	la	%r12,\psworg
+	st	%r2,SP_ORIG_R2(%r15)	# store original content of gpr 2
+	icm	%r12,12,__LC_SVC_ILC
+	stm	%r0,%r11,SP_R0(%r15)	# store gprs %r0-%r11 to kernel stack
+	st	%r12,SP_ILC(%r15)
+	mvc	SP_R12(16,%r15),\savearea # move %r12-%r15 to stack
+	la	%r12,0
+	st	%r12,0(%r15)		# clear back chain
 	.endm
 
-        .macro  GET_THREAD_INFO
-	l	%r9,__LC_THREAD_INFO
-        .endm
-
-	.macro	CHECK_CRITICAL
-        tm      SP_PSW+1(%r15),0x01      # test problem state bit
-	bnz	BASED(0f)		 # from user -> not critical
-	clc	SP_PSW+4(4,%r15),BASED(.Lcritical_end)
-	bnl	BASED(0f)
-	clc	SP_PSW+4(4,%r15),BASED(.Lcritical_start)
-	bl	BASED(0f)
-	l	%r1,BASED(.Lcleanup_critical)
-	basr	%r14,%r1
-0:
+	.macro  RESTORE_ALL sync
+	mvc	__LC_RETURN_PSW(8),SP_PSW(%r15) # move user PSW to lowcore
+	.if !\sync
+	ni	__LC_RETURN_PSW+1,0xfd	# clear wait state bit
+	.endif
+	lm	%r0,%r15,SP_R0(%r15)	# load gprs 0-15 of user
+	lpsw	__LC_RETURN_PSW		# back to caller
 	.endm
 
 /*
@@ -226,12 +172,11 @@
 
 	.globl  system_call
 system_call:
-	SAVE_ALL_BASE __LC_SVC_OLD_PSW,__LC_SAVE_AREA,1
+	SAVE_ALL_BASE __LC_SAVE_AREA
         SAVE_ALL __LC_SVC_OLD_PSW,__LC_SAVE_AREA,1
 	lh	%r7,0x8a	  # get svc number from lowcore
-sysc_enter:
-        GET_THREAD_INFO           # load pointer to task_struct to R9
 sysc_do_svc:
+	l	%r9,__LC_THREAD_INFO	# load pointer to thread_info struct
 	sla	%r7,2             # *4 and test for svc 0
 	bnz	BASED(sysc_nr_ok) # svc number > 0
 	# svc 0: system call number in %r1
@@ -256,13 +201,12 @@
 	tm	__TI_flags+3(%r9),_TIF_WORK_SVC
 	bnz	BASED(sysc_work)  # there is work to do (signals etc.)
 sysc_leave:
-        RESTORE_ALL
+        RESTORE_ALL 1
 
 #
 # recheck if there is more work to do
 #
 sysc_work_loop:
-        GET_THREAD_INFO           # load pointer to task_struct to R9
 	tm	__TI_flags+3(%r9),_TIF_WORK_SVC
 	bz	BASED(sysc_leave)      # there is no work to do
 #
@@ -359,7 +303,7 @@
         .globl  ret_from_fork
 ret_from_fork:
 	l	%r13,__LC_SVC_NEW_PSW+4
-        GET_THREAD_INFO           # load pointer to task_struct to R9
+	l	%r9,__LC_THREAD_INFO	# load pointer to thread_info struct
         l       %r1,BASED(.Lschedtail)
 	basr    %r14,%r1
         stosm   24(%r15),0x03     # reenable interrupts
@@ -455,17 +399,17 @@
  * we just ignore the PER event (FIXME: is there anything we have to do
  * for LPSW?).
  */
-	SAVE_ALL_BASE __LC_PGM_OLD_PSW,__LC_SAVE_AREA,1
+	SAVE_ALL_BASE __LC_SAVE_AREA
         tm      __LC_PGM_INT_CODE+1,0x80 # check whether we got a per exception
         bnz     BASED(pgm_per)           # got per exception -> special case
 	SAVE_ALL __LC_PGM_OLD_PSW,__LC_SAVE_AREA,1
+	l	%r9,__LC_THREAD_INFO	# load pointer to thread_info struct
         l       %r3,__LC_PGM_ILC         # load program interruption code
 	la	%r8,0x7f
 	nr	%r8,%r3
 pgm_do_call:
         l       %r7,BASED(.Ljump_table)
         sll     %r8,2
-	GET_THREAD_INFO
         l       %r7,0(%r8,%r7)		 # load address of handler routine
         la      %r2,SP_PTREGS(%r15)	 # address of register-save area
 	la      %r14,BASED(sysc_return)
@@ -481,7 +425,7 @@
         clc     __LC_PGM_OLD_PSW(8),__LC_SVC_NEW_PSW
         be      BASED(pgm_svcper)
 # no interesting special case, ignore PER event
-        lm      %r13,%r15,__LC_SAVE_AREA
+        lm      %r12,%r15,__LC_SAVE_AREA
 	lpsw    0x28
 
 #
@@ -489,7 +433,7 @@
 #
 pgm_per_std:
 	SAVE_ALL __LC_PGM_OLD_PSW,__LC_SAVE_AREA,1
-	GET_THREAD_INFO
+	l	%r9,__LC_THREAD_INFO	# load pointer to thread_info struct
 	l	%r1,__TI_task(%r9)
 	mvc	__THREAD_per+__PER_atmid(2,%r1),__LC_PER_ATMID
 	mvc	__THREAD_per+__PER_address(4,%r1),__LC_PER_ADDRESS
@@ -507,7 +451,7 @@
 pgm_svcper:
 	SAVE_ALL __LC_SVC_OLD_PSW,__LC_SAVE_AREA,1
 	lh	%r7,0x8a		# get svc number from lowcore
-	GET_THREAD_INFO			# load pointer to task_struct to R9
+	l	%r9,__LC_THREAD_INFO	# load pointer to thread_info struct
 	l	%r1,__TI_task(%r9)
 	mvc	__THREAD_per+__PER_atmid(2,%r1),__LC_PER_ATMID
 	mvc	__THREAD_per+__PER_address(4,%r1),__LC_PER_ADDRESS
@@ -522,11 +466,10 @@
 
         .globl io_int_handler
 io_int_handler:
-	SAVE_ALL_BASE __LC_IO_OLD_PSW,__LC_SAVE_AREA+16,0
-        SAVE_ALL __LC_IO_OLD_PSW,__LC_SAVE_AREA+16,0
 	stck	__LC_INT_CLOCK
-	CHECK_CRITICAL
-        GET_THREAD_INFO           # load pointer to task_struct to R9
+	SAVE_ALL_BASE __LC_SAVE_AREA+16
+        SAVE_ALL __LC_IO_OLD_PSW,__LC_SAVE_AREA+16,0
+	l	%r9,__LC_THREAD_INFO	# load pointer to thread_info struct
         l       %r1,BASED(.Ldo_IRQ)        # load address of do_IRQ
         la      %r2,SP_PTREGS(%r15) # address of register-save area
         basr    %r14,%r1          # branch to standard irq handler
@@ -541,7 +484,7 @@
 	tm	__TI_flags+3(%r9),_TIF_WORK_INT
 	bnz	BASED(io_work)         # there is work to do (signals etc.)
 io_leave:
-        RESTORE_ALL
+        RESTORE_ALL 0
 
 #ifdef CONFIG_PREEMPT
 io_preempt:
@@ -560,7 +503,6 @@
         l       %r1,BASED(.Lschedule)
 	basr	%r14,%r1	       # call schedule
         stnsm   24(%r15),0xfc          # disable I/O and ext. interrupts
-        GET_THREAD_INFO                # load pointer to task_struct to R9
 	xc      __TI_precount(4,%r9),__TI_precount(%r9)
 	b	BASED(io_resume_loop)
 #endif
@@ -593,7 +535,6 @@
         stosm   24(%r15),0x03          # reenable interrupts
 	basr    %r14,%r1	       # call scheduler
         stnsm   24(%r15),0xfc          # disable I/O and ext. interrupts
-        GET_THREAD_INFO                # load pointer to task_struct to R9
 	tm	__TI_flags+3(%r9),_TIF_WORK_INT
 	bz	BASED(io_leave)        # there is no work to do
 	b	BASED(io_work_loop)
@@ -616,11 +557,10 @@
 
         .globl  ext_int_handler
 ext_int_handler:
-	SAVE_ALL_BASE __LC_EXT_OLD_PSW,__LC_SAVE_AREA+16,0
-        SAVE_ALL __LC_EXT_OLD_PSW,__LC_SAVE_AREA+16,0
 	stck	__LC_INT_CLOCK
-	CHECK_CRITICAL
-        GET_THREAD_INFO                # load pointer to task_struct to R9
+	SAVE_ALL_BASE __LC_SAVE_AREA+16
+        SAVE_ALL __LC_EXT_OLD_PSW,__LC_SAVE_AREA+16,0
+	l	%r9,__LC_THREAD_INFO	# load pointer to thread_info struct
 	la	%r2,SP_PTREGS(%r15)    # address of register-save area
 	lh	%r3,__LC_EXT_INT_CODE  # get interruption code
 	l	%r1,BASED(.Ldo_extint)
@@ -633,12 +573,12 @@
 
         .globl mcck_int_handler
 mcck_int_handler:
-	SAVE_ALL_BASE __LC_MCK_OLD_PSW,__LC_SAVE_AREA+32,0
+	SAVE_ALL_BASE __LC_SAVE_AREA+32
         SAVE_ALL __LC_MCK_OLD_PSW,__LC_SAVE_AREA+32,0
 	l       %r1,BASED(.Ls390_mcck)
 	basr    %r14,%r1	  # call machine check handler
 mcck_return:
-        RESTORE_ALL
+        RESTORE_ALL 0
 
 #ifdef CONFIG_SMP
 /*
@@ -671,50 +611,68 @@
 restart_go:
 #endif
 
-cleanup_table:
-	.long	system_call, sysc_enter, cleanup_sysc_enter
-	.long	sysc_return, sysc_leave, cleanup_sysc_return
-	.long	sysc_leave, sysc_work_loop, cleanup_sysc_leave
-	.long	sysc_work_loop, sysc_reschedule, cleanup_sysc_return
-cleanup_table_entries=(.-cleanup_table) / 12
+cleanup_table_system_call:
+	.long	system_call + 0x80000000, sysc_do_svc + 0x80000000
+cleanup_table_sysc_return:
+	.long	sysc_return + 0x80000000, sysc_leave + 0x80000000
+cleanup_table_sysc_leave:
+	.long	sysc_leave + 0x80000000, sysc_work_loop + 0x80000000
+cleanup_table_sysc_work_loop:
+	.long	sysc_work_loop + 0x80000000, sysc_reschedule + 0x80000000
 
 cleanup_critical:
-	lhi	%r0,cleanup_table_entries
-	la	%r1,BASED(cleanup_table)
-	l	%r2,SP_PSW+4(%r15)
-	la	%r2,0(%r2)
-cleanup_loop:
-	cl	%r2,0(%r1)
-	bl	BASED(cleanup_cont)
-	cl	%r2,4(%r1)
-	bl	BASED(cleanup_found)
-cleanup_cont:
-	la	%r1,12(%r1)
-	bct	%r0,BASED(cleanup_loop)
+	clc	4(4,%r12),BASED(cleanup_table_system_call)
+	bl	BASED(0f)
+	clc	4(4,%r12),BASED(cleanup_table_system_call+4)
+	bl	BASED(cleanup_system_call)
+0:
+	clc	4(4,%r12),BASED(cleanup_table_sysc_return)
+	bl	BASED(0f)
+	clc	4(4,%r12),BASED(cleanup_table_sysc_return+4)
+	bl	BASED(cleanup_sysc_return)
+0:
+	clc	4(4,%r12),BASED(cleanup_table_sysc_leave)
+	bl	BASED(0f)
+	clc	4(4,%r12),BASED(cleanup_table_sysc_leave+4)
+	bl	BASED(cleanup_sysc_leave)
+0:
+	clc	4(4,%r12),BASED(cleanup_table_sysc_work_loop)
+	bl	BASED(0f)
+	clc	4(4,%r12),BASED(cleanup_table_sysc_work_loop+4)
+	bl	BASED(cleanup_sysc_leave)
+0:
 	br	%r14
-cleanup_found:
-	l	%r1,8(%r1)
-	br	%r1
 
-cleanup_sysc_enter:
-	CLEANUP_SAVE_ALL_BASE __LC_SVC_OLD_PSW,__LC_SAVE_AREA,1
-	CLEANUP_SAVE_ALL __LC_SVC_OLD_PSW,__LC_SAVE_AREA,1
-	lh	%r0,0x8a
-	st	%r0,SP_R7(%r15)
-	la	%r1,BASED(sysc_enter)
-	o	%r1,BASED(.Lamode)
-	st	%r1,SP_PSW+4(%r15)
+cleanup_system_call:
+	mvc	__LC_RETURN_PSW(4),0(%r12)
+	clc	4(4,%r12),BASED(cleanup_table_system_call)
+	bne	BASED(0f)
+	mvc	__LC_SAVE_AREA(16),__LC_SAVE_AREA+16
+0:	st	%r13,__LC_SAVE_AREA+20
+	SAVE_ALL __LC_SVC_OLD_PSW,__LC_SAVE_AREA,1
+	st	%r15,__LC_SAVE_AREA+28
+	lh	%r7,0x8a
+	mvc	__LC_RETURN_PSW+4(4),BASED(cleanup_table_system_call+4)
+	la	%r12,__LC_RETURN_PSW
 	br	%r14
 
 cleanup_sysc_return:
-	la	%r1,BASED(sysc_return)
-	o	%r1,BASED(.Lamode)
-	st	%r1,SP_PSW+4(%r15)
+	mvc	__LC_RETURN_PSW(4),0(%r12)
+	mvc	__LC_RETURN_PSW+4(4),BASED(cleanup_table_sysc_return)
+	la	%r12,__LC_RETURN_PSW
 	br	%r14
 
 cleanup_sysc_leave:
-	CLEANUP_RESTORE_ALL
+	clc	4(4,%r12),BASED(cleanup_sysc_leave_lpsw)
+	be	BASED(0f)
+	mvc	__LC_RETURN_PSW(8),SP_PSW(%r15)
+	mvc	__LC_SAVE_AREA+16(16),SP_R12(%r15)
+	lm	%r0,%r11,SP_R0(%r15)
+	l	%r15,SP_R15(%r15)
+0:	la	%r12,__LC_RETURN_PSW
 	br	%r14
+cleanup_sysc_leave_lpsw:
+	.long	sysc_leave + 10 + 0x80000000
 
 /*
  * Integer constants
@@ -724,12 +682,11 @@
 .Lc_overhead:  .long  STACK_FRAME_OVERHEAD
 .Lc_pactive:   .long  PREEMPT_ACTIVE
 .Lnr_syscalls: .long  NR_syscalls
-.L0x018:       .long  0x018
-.L0x020:       .long  0x020
-.L0x028:       .long  0x028
-.L0x030:       .long  0x030
-.L0x038:       .long  0x038
-.Lamode:       .long  0x80000000
+.L0x018:       .short 0x018
+.L0x020:       .short 0x020
+.L0x028:       .short 0x028
+.L0x030:       .short 0x030
+.L0x038:       .short 0x038
 
 /*
  * Symbol constants
diff -urN linux-2.6.8-rc2/arch/s390/kernel/entry64.S linux-2.6.8-rc3/arch/s390/kernel/entry64.S
--- linux-2.6.8-rc2/arch/s390/kernel/entry64.S	2004-08-03 15:21:06.042468038 -0700
+++ linux-2.6.8-rc3/arch/s390/kernel/entry64.S	2004-08-03 15:21:34.844649373 -0700
@@ -52,6 +52,8 @@
 		 _TIF_RESTART_SVC | _TIF_SINGLE_STEP )
 _TIF_WORK_INT = (_TIF_SIGPENDING | _TIF_NEED_RESCHED)
 
+#define BASED(name) name-system_call(%r13)
+
 /*
  * Register usage in interrupt handlers:
  *    R9  - pointer to current task structure
@@ -60,99 +62,52 @@
  *    R15 - kernel stack pointer
  */
 
+        .macro  SAVE_ALL_BASE savearea
+	stmg	%r12,%r15,\savearea
+	larl	%r13,system_call
+	.endm
+
         .macro  SAVE_ALL psworg,savearea,sync
-        stmg    %r13,%r15,\savearea
+	la	%r12,\psworg
 	.if	\sync
-        tm      \psworg+1,0x01           # test problem state bit
-        jz      1f                       # skip stack setup save
-	lg      %r15,__LC_KERNEL_STACK   # problem state -> load ksp
+	tm	\psworg+1,0x01		# test problem state bit
+	jz	2f			# skip stack setup save
+	lg	%r15,__LC_KERNEL_STACK	# problem state -> load ksp
 	.else
-        tm      \psworg+1,0x01           # test problem state bit
-	jnz	0f			 # from user -> load kernel stack
-	lg	%r14,__LC_ASYNC_STACK	 # are we already on the async. stack ?
+	tm	\psworg+1,0x01		# test problem state bit
+	jnz	1f			# from user -> load kernel stack
+	clc	\psworg+8(8),BASED(.Lcritical_end)
+	jhe	0f
+	clc	\psworg+8(8),BASED(.Lcritical_start)
+	jl	0f
+	brasl	%r14,cleanup_critical
+	tm	0(%r12),0x01		# retest problem state after cleanup
+	jnz	1f
+0:	lg	%r14,__LC_ASYNC_STACK	# are we already on the async. stack ?
 	slgr	%r14,%r15
 	srag	%r14,%r14,14
-	jz	1f
-0:	lg      %r15,__LC_ASYNC_STACK    # load async stack
+	jz	2f
+1:	lg	%r15,__LC_ASYNC_STACK	# load async stack
 	.endif
-1:      aghi    %r15,-SP_SIZE            # make room for registers & psw
-	lghi	%r14,\psworg
-	slgr	%r13,%r13
-	icm	%r14,12,__LC_SVC_ILC
-        stmg    %r0,%r12,SP_R0(%r15)     # store gprs 0-13 to kernel stack
-        stg     %r2,SP_ORIG_R2(%r15)     # store original content of gpr 2
-        mvc     SP_R13(24,%r15),\savearea # move r13, r14 and r15 to stack
-        mvc     SP_PSW(16,%r15),\psworg  # move user PSW to stack
-	st	%r14,SP_ILC(%r15)
-	stg	%r13,0(%r15)
+2:	aghi    %r15,-SP_SIZE		# make room for registers & psw
+	mvc     SP_PSW(16,%r15),0(%r12)	# move user PSW to stack
+	la	%r12,\psworg
+	stg	%r2,SP_ORIG_R2(%r15)	# store original content of gpr 2
+	icm	%r12,12,__LC_SVC_ILC
+	stmg	%r0,%r11,SP_R0(%r15)	# store gprs %r0-%r11 to kernel stack
+	st	%r12,SP_ILC(%r15)
+	mvc	SP_R12(32,%r15),\savearea # move %r12-%r15 to stack
+	la	%r12,0
+	stg	%r12,0(%r15)
         .endm
 
-	.macro	CLEANUP_SAVE_ALL psworg,savearea,sync
-	lg	%r1,SP_PSW+8(%r15)
-	cli	1(%r1),0xdf
-	jne	2f
-	mvc	\savearea(24),SP_R13(%r15)
-2:	lg	%r1,\savearea+16
-	.if	\sync
-	tm	\psworg+1,0x01
-	jz	1f
-	lg	%r1,__LC_KERNEL_STACK
-	.else
-	tm	\psworg+1,0x01
-	jnz	0f
-	lg	%r0,__LC_ASYNC_STACK
-	slgr	%r0,%r1
-	srag	%r0,%r0,14
-	jz	1f
-0:	lg	%r1,__LC_ASYNC_STACK
+	.macro	RESTORE_ALL sync
+	mvc	__LC_RETURN_PSW(16),SP_PSW(%r15) # move user PSW to lowcore
+	.if !\sync
+	ni	__LC_RETURN_PSW+1,0xfd	# clear wait state bit
 	.endif
-1:	aghi	%r1,-SP_SIZE
-	stg	%r1,SP_R15(%r15)
-	lghi	%r0,\psworg
-	xc	SP_R13(8,%r15),SP_R13(%r15)
-	icm	%r0,12,__LC_SVC_ILC
-	stg	%r0,SP_R14(%r15)
-	mvc	SP_R0(104,%r1),SP_R0(%r15)
-	mvc	SP_ORIG_R2(8,%r1),SP_R2(%r15)
-	mvc	SP_R13(24,%r1),\savearea
-	mvc	SP_PSW(16,%r1),\psworg
-	st	%r0,SP_ILC(%r1)
-	xc	0(8,%r1),0(%r1)
-	.endm
-
-        .macro  RESTORE_ALL              # system exit macro
-        mvc     __LC_RETURN_PSW(16),SP_PSW(%r15) # move user PSW to lowcore
-        ni      __LC_RETURN_PSW+1,0xfd   # clear wait state bit
-        lmg     %r0,%r15,SP_R0(%r15)     # load gprs 0-15 of user
-        lpswe   __LC_RETURN_PSW          # back to caller
-        .endm
-
-	.macro	CLEANUP_RESTORE_ALL
-	lg	%r1,SP_PSW+8(%r15)
-	cli	0(%r1),0xb2
-	jne	0f
-	mvc	SP_PSW(16,%r15),__LC_RETURN_PSW
-	j	1f
-0:	lg	%r1,SP_R15(%r15)
-	mvc	SP_PSW(16,%r15),SP_PSW(%r1)
-	mvc	SP_R0(128,%r15),SP_R0(%r1)
-1:
-	.endm
-
-        .macro  GET_THREAD_INFO
-	lg	%r9,__LC_THREAD_INFO     # load pointer to thread_info struct
-        .endm
-
-	.macro	CHECK_CRITICAL
-        tm      SP_PSW+1(%r15),0x01      # test problem state bit
-	jnz	0f			 # from user -> not critical
-	larl	%r1,.Lcritical_start
-	clc	SP_PSW+8(8,%r15),8(%r1)  # compare ip with __critical_end
-	jnl	0f
-	clc	SP_PSW+8(8,%r15),0(%r1)  # compare ip with __critical_start
-	jl	0f
-	brasl	%r14,cleanup_critical
-0:
+	lmg	%r0,%r15,SP_R0(%r15)	# load gprs 0-15 of user
+	lpswe	__LC_RETURN_PSW		# back to caller
 	.endm
 
 /*
@@ -211,16 +166,15 @@
 
 	.globl  system_call
 system_call:
+	SAVE_ALL_BASE __LC_SAVE_AREA
         SAVE_ALL __LC_SVC_OLD_PSW,__LC_SAVE_AREA,1
 	llgh    %r7,__LC_SVC_INT_CODE # get svc number from lowcore
-sysc_enter:
-        GET_THREAD_INFO           # load pointer to task_struct to R9
 sysc_do_svc:
+	lg	%r9,__LC_THREAD_INFO	# load pointer to thread_info struct
         slag    %r7,%r7,2         # *4 and test for svc 0
 	jnz	sysc_nr_ok
 	# svc 0: system call number in %r1
-	lghi	%r0,NR_syscalls
-	clr	%r1,%r0
+	cl	%r1,BASED(.Lnr_syscalls)
 	jnl	sysc_nr_ok
 	lgfr	%r7,%r1           # clear high word in r1
 	slag    %r7,%r7,2         # svc 0: system call number in %r1
@@ -248,13 +202,12 @@
 	tm	__TI_flags+7(%r9),_TIF_WORK_SVC
 	jnz	sysc_work         # there is work to do (signals etc.)
 sysc_leave:
-        RESTORE_ALL
+        RESTORE_ALL 1
 
 #
 # recheck if there is more work to do
 #
 sysc_work_loop:
-        GET_THREAD_INFO           # load pointer to task_struct to R9
 	tm	__TI_flags+7(%r9),_TIF_WORK_SVC
 	jz	sysc_leave        # there is no work to do
 #
@@ -348,8 +301,9 @@
 # a new process exits the kernel with ret_from_fork
 #
         .globl  ret_from_fork
-ret_from_fork:  
-        GET_THREAD_INFO           # load pointer to task_struct to R9
+ret_from_fork:
+	lg	%r13,__LC_SVC_NEW_PSW+8
+	lg	%r9,__LC_THREAD_INFO	# load pointer to thread_info struct
         brasl   %r14,schedule_tail
         stosm   24(%r15),0x03     # reenable interrupts
 	j	sysc_return
@@ -492,15 +446,16 @@
  * we just ignore the PER event (FIXME: is there anything we have to do
  * for LPSW?).
  */
+	SAVE_ALL_BASE __LC_SAVE_AREA
         tm      __LC_PGM_INT_CODE+1,0x80 # check whether we got a per exception
         jnz     pgm_per                  # got per exception -> special case
 	SAVE_ALL __LC_PGM_OLD_PSW,__LC_SAVE_AREA,1
+	lg	%r9,__LC_THREAD_INFO	# load pointer to thread_info struct
 	lgf     %r3,__LC_PGM_ILC	 # load program interruption code
 	lghi	%r8,0x7f
 	ngr	%r8,%r3
 pgm_do_call:
         sll     %r8,3
-	GET_THREAD_INFO
         larl    %r1,pgm_check_table
         lg      %r1,0(%r8,%r1)		 # load address of handler routine
         la      %r2,SP_PTREGS(%r15)	 # address of register-save area
@@ -517,6 +472,7 @@
         clc     __LC_PGM_OLD_PSW(16),__LC_SVC_NEW_PSW
         je      pgm_svcper
 # no interesting special case, ignore PER event
+	lmg	%r12,%r15,__LC_SAVE_AREA
 	lpswe   __LC_PGM_OLD_PSW
 
 #
@@ -524,7 +480,7 @@
 #
 pgm_per_std:
 	SAVE_ALL __LC_PGM_OLD_PSW,__LC_SAVE_AREA,1
-	GET_THREAD_INFO
+	lg	%r9,__LC_THREAD_INFO	# load pointer to thread_info struct
 	lg	%r1,__TI_task(%r9)
 	mvc	__THREAD_per+__PER_atmid(2,%r1),__LC_PER_ATMID
 	mvc	__THREAD_per+__PER_address(8,%r1),__LC_PER_ADDRESS
@@ -542,7 +498,7 @@
 pgm_svcper:
 	SAVE_ALL __LC_SVC_OLD_PSW,__LC_SAVE_AREA,1
 	llgh    %r7,__LC_SVC_INT_CODE	# get svc number from lowcore
-	GET_THREAD_INFO			# load pointer to task_struct to R9
+	lg	%r9,__LC_THREAD_INFO	# load pointer to thread_info struct
 	lg	%r1,__TI_task(%r9)
 	mvc	__THREAD_per+__PER_atmid(2,%r1),__LC_PER_ATMID
 	mvc	__THREAD_per+__PER_address(8,%r1),__LC_PER_ADDRESS
@@ -556,10 +512,10 @@
  */
         .globl io_int_handler
 io_int_handler:
-        SAVE_ALL __LC_IO_OLD_PSW,__LC_SAVE_AREA+32,0
 	stck	__LC_INT_CLOCK
-	CHECK_CRITICAL
-        GET_THREAD_INFO                # load pointer to task_struct to R9
+	SAVE_ALL_BASE __LC_SAVE_AREA+32
+        SAVE_ALL __LC_IO_OLD_PSW,__LC_SAVE_AREA+32,0
+	lg	%r9,__LC_THREAD_INFO	# load pointer to thread_info struct
         la      %r2,SP_PTREGS(%r15)    # address of register-save area
 	brasl   %r14,do_IRQ            # call standard irq handler
 
@@ -573,7 +529,7 @@
 	tm	__TI_flags+7(%r9),_TIF_WORK_INT
 	jnz	io_work                # there is work to do (signals etc.)
 io_leave:
-        RESTORE_ALL
+        RESTORE_ALL 0
 
 #ifdef CONFIG_PREEMPT
 io_preempt:
@@ -593,7 +549,6 @@
         stosm   48(%r15),0x03          # reenable interrupts
 	brasl   %r14,schedule          # call schedule
         stnsm   48(%r15),0xfc          # disable I/O and ext. interrupts
-        GET_THREAD_INFO                # load pointer to task_struct to R9
 	xc      __TI_precount(4,%r9),__TI_precount(%r9)
 	j	io_resume_loop
 #endif
@@ -625,7 +580,6 @@
         stosm   48(%r15),0x03       # reenable interrupts
         brasl   %r14,schedule       # call scheduler
         stnsm   48(%r15),0xfc       # disable I/O and ext. interrupts
-        GET_THREAD_INFO             # load pointer to task_struct to R9
 	tm	__TI_flags+7(%r9),_TIF_WORK_INT
 	jz	io_leave               # there is no work to do
 	j	io_work_loop
@@ -646,10 +600,10 @@
  */
         .globl  ext_int_handler
 ext_int_handler:
-        SAVE_ALL __LC_EXT_OLD_PSW,__LC_SAVE_AREA+32,0
-	CHECK_CRITICAL
-        GET_THREAD_INFO                # load pointer to task_struct to R9
 	stck	__LC_INT_CLOCK
+	SAVE_ALL_BASE __LC_SAVE_AREA+32
+        SAVE_ALL __LC_EXT_OLD_PSW,__LC_SAVE_AREA+32,0
+	lg	%r9,__LC_THREAD_INFO	# load pointer to thread_info struct
 	la	%r2,SP_PTREGS(%r15)    # address of register-save area
 	llgh	%r3,__LC_EXT_INT_CODE  # get interruption code
 	brasl   %r14,do_extint
@@ -660,10 +614,11 @@
  */
         .globl mcck_int_handler
 mcck_int_handler:
+	SAVE_ALL_BASE __LC_SAVE_AREA+64
         SAVE_ALL __LC_MCK_OLD_PSW,__LC_SAVE_AREA+64,0
 	brasl   %r14,s390_do_machine_check
 mcck_return:
-        RESTORE_ALL
+        RESTORE_ALL 0
 
 #ifdef CONFIG_SMP
 /*
@@ -694,46 +649,68 @@
 restart_go:
 #endif
 
-cleanup_table:
-	.quad	system_call, sysc_enter, cleanup_sysc_enter
-	.quad	sysc_return, sysc_leave, cleanup_sysc_return
-	.quad	sysc_leave, sysc_work_loop, cleanup_sysc_leave
-	.quad	sysc_work_loop, sysc_reschedule, cleanup_sysc_return
-cleanup_table_entries=(.-cleanup_table) / 24
+cleanup_table_system_call:
+	.quad	system_call, sysc_do_svc
+cleanup_table_sysc_return:
+	.quad	sysc_return, sysc_leave
+cleanup_table_sysc_leave:
+	.quad	sysc_leave, sysc_work_loop
+cleanup_table_sysc_work_loop:
+	.quad	sysc_work_loop, sysc_reschedule
 
 cleanup_critical:
-	lghi	%r0,cleanup_table_entries
-	larl	%r1,cleanup_table
-	lg	%r2,SP_PSW+8(%r15)
-cleanup_loop:
-	clg	%r2,0(%r1)
-	jl	cleanup_cont
-	clg	%r2,8(%r1)
-	jl	cleanup_found
-cleanup_cont:
-	la	%r1,24(%r1)
-	brct	%r0,cleanup_loop
+	clc	8(8,%r12),BASED(cleanup_table_system_call)
+	jl	0f
+	clc	8(8,%r12),BASED(cleanup_table_system_call+8)
+	jl	cleanup_system_call
+0:
+	clc	8(8,%r12),BASED(cleanup_table_sysc_return)
+	jl	0f
+	clc	8(8,%r12),BASED(cleanup_table_sysc_return+8)
+	jl	cleanup_sysc_return
+0:
+	clc	8(8,%r12),BASED(cleanup_table_sysc_leave)
+	jl	0f
+	clc	8(8,%r12),BASED(cleanup_table_sysc_leave+8)
+	jl	cleanup_sysc_leave
+0:
+	clc	8(8,%r12),BASED(cleanup_table_sysc_work_loop)
+	jl	0f
+	clc	8(8,%r12),BASED(cleanup_table_sysc_work_loop+8)
+	jl	cleanup_sysc_leave
+0:
 	br	%r14
-cleanup_found:
-	lg	%r1,16(%r1)
-	br	%r1
-
-cleanup_sysc_enter:
-	CLEANUP_SAVE_ALL __LC_SVC_OLD_PSW,__LC_SAVE_AREA,1
-	llgh	%r0,0x8a
-	stg	%r0,SP_R7(%r15)
-	larl	%r1,sysc_enter
-	stg	%r1,SP_PSW+8(%r15)
+
+cleanup_system_call:
+	mvc	__LC_RETURN_PSW(8),0(%r12)
+	clc	8(8,%r12),BASED(cleanup_table_system_call)
+	jne	0f
+	mvc	__LC_SAVE_AREA(32),__LC_SAVE_AREA+32
+0:	stg	%r13,__LC_SAVE_AREA+40
+	SAVE_ALL __LC_SVC_OLD_PSW,__LC_SAVE_AREA,1
+	stg	%r15,__LC_SAVE_AREA+56
+	llgh	%r7,__LC_SVC_INT_CODE
+	mvc	__LC_RETURN_PSW+8(8),BASED(cleanup_table_system_call+8)
+	la	%r12,__LC_RETURN_PSW
 	br	%r14
 
 cleanup_sysc_return:
-	larl	%r1,sysc_return
-	stg	%r1,SP_PSW+8(%r15)
+	mvc	__LC_RETURN_PSW(8),0(%r12)
+	mvc	__LC_RETURN_PSW+8(8),BASED(cleanup_table_sysc_return)
+	la	%r12,__LC_RETURN_PSW
 	br	%r14
 
 cleanup_sysc_leave:
-	CLEANUP_RESTORE_ALL
+	clc	8(8,%r12),BASED(cleanup_sysc_leave_lpsw)
+	je	0f
+	mvc	__LC_RETURN_PSW(16),SP_PSW(%r15)
+	mvc	__LC_SAVE_AREA+32(32),SP_R12(%r15)
+	lmg	%r0,%r11,SP_R0(%r15)
+	lg	%r15,SP_R15(%r15)
+0:	la	%r12,__LC_RETURN_PSW
 	br	%r14
+cleanup_sysc_leave_lpsw:
+	.quad	sysc_leave + 12
 
 /*
  * Integer constants
@@ -741,6 +718,12 @@
                .align 4
 .Lconst:
 .Lc_pactive:   .long  PREEMPT_ACTIVE
+.Lnr_syscalls: .long  NR_syscalls
+.L0x0130:      .short 0x130
+.L0x0140:      .short 0x140
+.L0x0150:      .short 0x150
+.L0x0160:      .short 0x160
+.L0x0170:      .short 0x170
 .Lcritical_start:
                .quad  __critical_start
 .Lcritical_end:
diff -urN linux-2.6.8-rc2/arch/s390/lib/string.c linux-2.6.8-rc3/arch/s390/lib/string.c
--- linux-2.6.8-rc2/arch/s390/lib/string.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/arch/s390/lib/string.c	2004-08-03 15:21:34.856649866 -0700
@@ -394,12 +394,3 @@
 	return s;
 }
 EXPORT_SYMBOL_NOVERS(memset);
-
-/*
- * missing exports for string functions defined in lib/string.c
- */
-EXPORT_SYMBOL_NOVERS(memmove);
-EXPORT_SYMBOL_NOVERS(strchr);
-EXPORT_SYMBOL_NOVERS(strnchr);
-EXPORT_SYMBOL_NOVERS(strncmp);
-EXPORT_SYMBOL_NOVERS(strpbrk);
diff -urN linux-2.6.8-rc2/arch/sparc/lib/copy_user.S linux-2.6.8-rc3/arch/sparc/lib/copy_user.S
--- linux-2.6.8-rc2/arch/sparc/lib/copy_user.S	2004-06-15 22:19:29.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc/lib/copy_user.S	2004-08-03 15:21:35.281667301 -0700
@@ -64,52 +64,52 @@
 
 /* Both these macros have to start with exactly the same insn */
 #define MOVE_BIGCHUNK(src, dst, offset, t0, t1, t2, t3, t4, t5, t6, t7) \
-	ldd	[%src + offset + 0x00], %t0; \
-	ldd	[%src + offset + 0x08], %t2; \
-	ldd	[%src + offset + 0x10], %t4; \
-	ldd	[%src + offset + 0x18], %t6; \
-	st	%t0, [%dst + offset + 0x00]; \
-	st	%t1, [%dst + offset + 0x04]; \
-	st	%t2, [%dst + offset + 0x08]; \
-	st	%t3, [%dst + offset + 0x0c]; \
-	st	%t4, [%dst + offset + 0x10]; \
-	st	%t5, [%dst + offset + 0x14]; \
-	st	%t6, [%dst + offset + 0x18]; \
-	st	%t7, [%dst + offset + 0x1c];
+	ldd	[%src + (offset) + 0x00], %t0; \
+	ldd	[%src + (offset) + 0x08], %t2; \
+	ldd	[%src + (offset) + 0x10], %t4; \
+	ldd	[%src + (offset) + 0x18], %t6; \
+	st	%t0, [%dst + (offset) + 0x00]; \
+	st	%t1, [%dst + (offset) + 0x04]; \
+	st	%t2, [%dst + (offset) + 0x08]; \
+	st	%t3, [%dst + (offset) + 0x0c]; \
+	st	%t4, [%dst + (offset) + 0x10]; \
+	st	%t5, [%dst + (offset) + 0x14]; \
+	st	%t6, [%dst + (offset) + 0x18]; \
+	st	%t7, [%dst + (offset) + 0x1c];
 
 #define MOVE_BIGALIGNCHUNK(src, dst, offset, t0, t1, t2, t3, t4, t5, t6, t7) \
-	ldd	[%src + offset + 0x00], %t0; \
-	ldd	[%src + offset + 0x08], %t2; \
-	ldd	[%src + offset + 0x10], %t4; \
-	ldd	[%src + offset + 0x18], %t6; \
-	std	%t0, [%dst + offset + 0x00]; \
-	std	%t2, [%dst + offset + 0x08]; \
-	std	%t4, [%dst + offset + 0x10]; \
-	std	%t6, [%dst + offset + 0x18];
+	ldd	[%src + (offset) + 0x00], %t0; \
+	ldd	[%src + (offset) + 0x08], %t2; \
+	ldd	[%src + (offset) + 0x10], %t4; \
+	ldd	[%src + (offset) + 0x18], %t6; \
+	std	%t0, [%dst + (offset) + 0x00]; \
+	std	%t2, [%dst + (offset) + 0x08]; \
+	std	%t4, [%dst + (offset) + 0x10]; \
+	std	%t6, [%dst + (offset) + 0x18];
 
 #define MOVE_LASTCHUNK(src, dst, offset, t0, t1, t2, t3) \
-	ldd	[%src - offset - 0x10], %t0; \
-	ldd	[%src - offset - 0x08], %t2; \
-	st	%t0, [%dst - offset - 0x10]; \
-	st	%t1, [%dst - offset - 0x0c]; \
-	st	%t2, [%dst - offset - 0x08]; \
-	st	%t3, [%dst - offset - 0x04];
+	ldd	[%src - (offset) - 0x10], %t0; \
+	ldd	[%src - (offset) - 0x08], %t2; \
+	st	%t0, [%dst - (offset) - 0x10]; \
+	st	%t1, [%dst - (offset) - 0x0c]; \
+	st	%t2, [%dst - (offset) - 0x08]; \
+	st	%t3, [%dst - (offset) - 0x04];
 
 #define MOVE_HALFCHUNK(src, dst, offset, t0, t1, t2, t3) \
-	lduh	[%src + offset + 0x00], %t0; \
-	lduh	[%src + offset + 0x02], %t1; \
-	lduh	[%src + offset + 0x04], %t2; \
-	lduh	[%src + offset + 0x06], %t3; \
-	sth	%t0, [%dst + offset + 0x00]; \
-	sth	%t1, [%dst + offset + 0x02]; \
-	sth	%t2, [%dst + offset + 0x04]; \
-	sth	%t3, [%dst + offset + 0x06];
+	lduh	[%src + (offset) + 0x00], %t0; \
+	lduh	[%src + (offset) + 0x02], %t1; \
+	lduh	[%src + (offset) + 0x04], %t2; \
+	lduh	[%src + (offset) + 0x06], %t3; \
+	sth	%t0, [%dst + (offset) + 0x00]; \
+	sth	%t1, [%dst + (offset) + 0x02]; \
+	sth	%t2, [%dst + (offset) + 0x04]; \
+	sth	%t3, [%dst + (offset) + 0x06];
 
 #define MOVE_SHORTCHUNK(src, dst, offset, t0, t1) \
-	ldub	[%src - offset - 0x02], %t0; \
-	ldub	[%src - offset - 0x01], %t1; \
-	stb	%t0, [%dst - offset - 0x02]; \
-	stb	%t1, [%dst - offset - 0x01];
+	ldub	[%src - (offset) - 0x02], %t0; \
+	ldub	[%src - (offset) - 0x01], %t1; \
+	stb	%t0, [%dst - (offset) - 0x02]; \
+	stb	%t1, [%dst - (offset) - 0x01];
 
 	.text
 	.align	4
diff -urN linux-2.6.8-rc2/arch/sparc64/Kconfig linux-2.6.8-rc3/arch/sparc64/Kconfig
--- linux-2.6.8-rc2/arch/sparc64/Kconfig	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/Kconfig	2004-08-03 15:21:35.375671157 -0700
@@ -139,7 +139,7 @@
 	  fly.  Currently there are only sparc64 drivers for UltraSPARC-III
 	  and UltraSPARC-IIe processors.
 
-	  For details, take a look at linux/Documentation/cpu-freq.
+	  For details, take a look at <file:Documentation/cpu-freq>.
 
 	  If in doubt, say N.
 
@@ -159,7 +159,7 @@
 	help
 	  This adds the CPUFreq driver for UltraSPARC-III processors.
 
-	  For details, take a look at linux/Documentation/cpu-freq.
+	  For details, take a look at <file:Documentation/cpu-freq>.
 
 	  If in doubt, say N.
 
@@ -169,7 +169,7 @@
 	help
 	  This adds the CPUFreq driver for UltraSPARC-IIe processors.
 
-	  For details, take a look at linux/Documentation/cpu-freq.
+	  For details, take a look at <file:Documentation/cpu-freq>.
 
 	  If in doubt, say N.
 
@@ -382,6 +382,7 @@
 
 config SUNOS_EMUL
 	bool "SunOS binary emulation"
+	depends on BINFMT_AOUT32
 	help
 	  This allows you to run most SunOS binaries.  If you want to do this,
 	  say Y here and place appropriate files in /usr/gnemul/sunos. See
@@ -391,7 +392,7 @@
 
 config SOLARIS_EMUL
 	tristate "Solaris binary emulation (EXPERIMENTAL)"
-	depends on EXPERIMENTAL
+	depends on SPARC32_COMPAT && EXPERIMENTAL
 	help
 	  This is experimental code which will enable you to run (many)
 	  Solaris binaries on your SPARC Linux machine.
diff -urN linux-2.6.8-rc2/arch/sparc64/defconfig linux-2.6.8-rc3/arch/sparc64/defconfig
--- linux-2.6.8-rc2/arch/sparc64/defconfig	2004-08-03 15:21:06.355480861 -0700
+++ linux-2.6.8-rc3/arch/sparc64/defconfig	2004-08-03 15:21:35.491675916 -0700
@@ -90,7 +90,6 @@
 # CONFIG_BINFMT_AOUT32 is not set
 CONFIG_BINFMT_ELF=y
 CONFIG_BINFMT_MISC=m
-# CONFIG_SUNOS_EMUL is not set
 CONFIG_SOLARIS_EMUL=m
 
 #
@@ -122,7 +121,6 @@
 # CONFIG_FB_CIRRUS is not set
 CONFIG_FB_PM2=y
 # CONFIG_FB_PM2_FIFO_DISCONNECT is not set
-# CONFIG_FB_CYBER2000 is not set
 # CONFIG_FB_ASILIANT is not set
 # CONFIG_FB_IMSTT is not set
 # CONFIG_FB_BW2 is not set
@@ -180,7 +178,6 @@
 #
 # Serial drivers
 #
-# CONFIG_SERIAL_8250 is not set
 
 #
 # Non-8250 serial port support
@@ -201,8 +198,6 @@
 CONFIG_SUN_MOSTEK_RTC=y
 CONFIG_OBP_FLASH=m
 # CONFIG_SUN_BPP is not set
-# CONFIG_SUN_VIDEOPIX is not set
-# CONFIG_SUN_AURORA is not set
 
 #
 # Memory Technology Devices (MTD)
@@ -344,12 +339,9 @@
 CONFIG_SCSI_SATA_SIS=m
 CONFIG_SCSI_SATA_VIA=m
 CONFIG_SCSI_SATA_VITESSE=m
-# CONFIG_SCSI_BUSLOGIC is not set
 CONFIG_SCSI_DMX3191D=m
-# CONFIG_SCSI_EATA is not set
 CONFIG_SCSI_EATA_PIO=m
 # CONFIG_SCSI_FUTURE_DOMAIN is not set
-# CONFIG_SCSI_GDTH is not set
 CONFIG_SCSI_IPS=m
 CONFIG_SCSI_INIA100=m
 CONFIG_SCSI_PPA=m
@@ -377,7 +369,7 @@
 # CONFIG_SCSI_QLA6312 is not set
 # CONFIG_SCSI_QLA6322 is not set
 CONFIG_SCSI_DC395x=m
-CONFIG_SCSI_DC390T=m
+# CONFIG_SCSI_DC390T is not set
 CONFIG_SCSI_DEBUG=m
 CONFIG_SCSI_SUNESP=y
 
@@ -683,6 +675,9 @@
 # QoS and/or fair queueing
 #
 CONFIG_NET_SCHED=y
+# CONFIG_NET_SCH_CLK_JIFFIES is not set
+# CONFIG_NET_SCH_CLK_GETTIMEOFDAY is not set
+CONFIG_NET_SCH_CLK_CPU=y
 CONFIG_NET_SCH_CBQ=m
 CONFIG_NET_SCH_HTB=m
 CONFIG_NET_SCH_HFSC=m
@@ -915,7 +910,6 @@
 #
 # Wireless 802.11b ISA/PCI cards support
 #
-CONFIG_AIRO=m
 CONFIG_HERMES=m
 CONFIG_PLX_HERMES=m
 CONFIG_TMD_HERMES=m
@@ -1132,12 +1126,15 @@
 #
 CONFIG_I2C_SENSOR=m
 CONFIG_SENSORS_ADM1021=m
+CONFIG_SENSORS_ADM1025=m
+CONFIG_SENSORS_ADM1031=m
 CONFIG_SENSORS_ASB100=m
 CONFIG_SENSORS_DS1621=m
 CONFIG_SENSORS_FSCHER=m
 CONFIG_SENSORS_GL518SM=m
 CONFIG_SENSORS_IT87=m
 CONFIG_SENSORS_LM75=m
+CONFIG_SENSORS_LM77=m
 CONFIG_SENSORS_LM78=m
 CONFIG_SENSORS_LM80=m
 CONFIG_SENSORS_LM83=m
@@ -1240,6 +1237,7 @@
 # CONFIG_BEFS_DEBUG is not set
 CONFIG_BFS_FS=m
 CONFIG_EFS_FS=m
+# CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
 CONFIG_CRAMFS=m
 CONFIG_VXFS_FS=m
 CONFIG_HPFS_FS=m
@@ -1270,6 +1268,7 @@
 # CONFIG_SMB_NLS_DEFAULT is not set
 CONFIG_CIFS=m
 # CONFIG_CIFS_STATS is not set
+# CONFIG_CIFS_XATTR is not set
 CONFIG_CIFS_POSIX=y
 CONFIG_NCP_FS=m
 # CONFIG_NCPFS_PACKET_SIGNING is not set
@@ -1523,11 +1522,6 @@
 CONFIG_SND_SUN_CS4231=m
 
 #
-# Open Sound System
-#
-# CONFIG_SOUND_PRIME is not set
-
-#
 # USB support
 #
 CONFIG_USB=y
@@ -1606,6 +1600,7 @@
 # CONFIG_USB_OV511 is not set
 CONFIG_USB_PWC=m
 # CONFIG_USB_SE401 is not set
+CONFIG_USB_SN9C102=m
 # CONFIG_USB_STV680 is not set
 CONFIG_USB_W9968CF=m
 
diff -urN linux-2.6.8-rc2/arch/sparc64/kernel/binfmt_aout32.c linux-2.6.8-rc3/arch/sparc64/kernel/binfmt_aout32.c
--- linux-2.6.8-rc2/arch/sparc64/kernel/binfmt_aout32.c	2004-08-03 15:21:06.357480943 -0700
+++ linux-2.6.8-rc3/arch/sparc64/kernel/binfmt_aout32.c	2004-08-03 15:21:35.514676860 -0700
@@ -247,10 +247,10 @@
 		loff_t pos = fd_offset;
 		/* Fuck me plenty... */
 		error = do_brk(N_TXTADDR(ex), ex.a_text);
-		bprm->file->f_op->read(bprm->file, (char *) N_TXTADDR(ex),
+		bprm->file->f_op->read(bprm->file, (char __user *)N_TXTADDR(ex),
 			  ex.a_text, &pos);
 		error = do_brk(N_DATADDR(ex), ex.a_data);
-		bprm->file->f_op->read(bprm->file, (char *) N_DATADDR(ex),
+		bprm->file->f_op->read(bprm->file, (char __user *)N_DATADDR(ex),
 			  ex.a_data, &pos);
 		goto beyond_if;
 	}
@@ -259,7 +259,7 @@
 		loff_t pos = fd_offset;
 		do_brk(N_TXTADDR(ex) & PAGE_MASK,
 			ex.a_text+ex.a_data + PAGE_SIZE - 1);
-		bprm->file->f_op->read(bprm->file, (char *) N_TXTADDR(ex),
+		bprm->file->f_op->read(bprm->file, (char __user *)N_TXTADDR(ex),
 			  ex.a_text+ex.a_data, &pos);
 	} else {
 		static unsigned long error_time;
@@ -273,7 +273,8 @@
 		if (!bprm->file->f_op->mmap) {
 			loff_t pos = fd_offset;
 			do_brk(0, ex.a_text+ex.a_data);
-			bprm->file->f_op->read(bprm->file,(char *)N_TXTADDR(ex),
+			bprm->file->f_op->read(bprm->file,
+				  (char __user *)N_TXTADDR(ex),
 				  ex.a_text+ex.a_data, &pos);
 			goto beyond_if;
 		}
diff -urN linux-2.6.8-rc2/arch/sparc64/kernel/entry.S linux-2.6.8-rc3/arch/sparc64/kernel/entry.S
--- linux-2.6.8-rc2/arch/sparc64/kernel/entry.S	2004-08-03 15:21:06.359481025 -0700
+++ linux-2.6.8-rc3/arch/sparc64/kernel/entry.S	2004-08-03 15:21:35.516676942 -0700
@@ -1496,28 +1496,30 @@
 	/* SunOS's execv() call only specifies the argv argument, the
 	 * environment settings are the same as the calling processes.
 	 */
-	.globl	sunos_execv, sys_execve, sys32_execve
+	.globl	sunos_execv
 sys_execve:
 	sethi		%hi(sparc_execve), %g1
 	ba,pt		%xcc, execve_merge
 	 or		%g1, %lo(sparc_execve), %g1
+#ifdef CONFIG_COMPAT
+	.globl	sys_execve
 sunos_execv:
 	stx		%g0, [%sp + PTREGS_OFF + PT_V9_I2]
+	.globl	sys32_execve
 sys32_execve:
 	sethi		%hi(sparc32_execve), %g1
 	or		%g1, %lo(sparc32_execve), %g1
+#endif
 execve_merge:
 	flushw
 	jmpl		%g1, %g0
 	 add		%sp, PTREGS_OFF, %o0
 
 	.globl	sys_pipe, sys_sigpause, sys_nis_syscall
-	.globl	sys_sigsuspend, sys_rt_sigsuspend, sys32_rt_sigsuspend
+	.globl	sys_sigsuspend, sys_rt_sigsuspend
 	.globl	sys_rt_sigreturn
-	.globl	sys32_sigreturn, sys32_rt_sigreturn
-	.globl	sys32_execve, sys_ptrace
-	.globl	sys_sigaltstack, sys32_sigaltstack
-	.globl	sys32_sigstack
+	.globl	sys_ptrace
+	.globl	sys_sigaltstack
 	.align	32
 sys_pipe:	ba,pt		%xcc, sparc_pipe
 		 add		%sp, PTREGS_OFF, %o0
@@ -1528,12 +1530,15 @@
 		 add		%sp, PTREGS_OFF, %o1
 sys_sigaltstack:ba,pt		%xcc, do_sigaltstack
 		 add		%i6, STACK_BIAS, %o2
+#ifdef CONFIG_COMPAT
+	.globl	sys32_sigstack
 sys32_sigstack:	ba,pt		%xcc, do_sys32_sigstack
 		 mov		%i6, %o2
+	.globl	sys32_sigaltstack
 sys32_sigaltstack:
 		ba,pt		%xcc, do_sys32_sigaltstack
 		 mov		%i6, %o2
-
+#endif
 		.align		32
 sys_sigsuspend:	add		%sp, PTREGS_OFF, %o0
 		call		do_sigsuspend
@@ -1544,31 +1549,40 @@
 		call		do_rt_sigsuspend
 		 add		%o7, 1f-.-4, %o7
 		nop
+#ifdef CONFIG_COMPAT
+	.globl	sys32_rt_sigsuspend
 sys32_rt_sigsuspend: /* NOTE: %o0,%o1 have a correct value already */
 		srl		%o0, 0, %o0
 		add		%sp, PTREGS_OFF, %o2
 		call		do_rt_sigsuspend32
 		 add		%o7, 1f-.-4, %o7
+#endif
 		/* NOTE: %o0 has a correct value already */
 sys_sigpause:	add		%sp, PTREGS_OFF, %o1
 		call		do_sigpause
 		 add		%o7, 1f-.-4, %o7
 		nop
+#ifdef CONFIG_COMPAT
+	.globl	sys32_sigreturn
 sys32_sigreturn:
 		add		%sp, PTREGS_OFF, %o0
 		call		do_sigreturn32
 		 add		%o7, 1f-.-4, %o7
 		nop
+#endif
 sys_rt_sigreturn:
 		add		%sp, PTREGS_OFF, %o0
 		call		do_rt_sigreturn
 		 add		%o7, 1f-.-4, %o7
 		nop
+#ifdef CONFIG_COMPAT
+	.globl	sys32_rt_sigreturn
 sys32_rt_sigreturn:
 		add		%sp, PTREGS_OFF, %o0
 		call		do_rt_sigreturn32
 		 add		%o7, 1f-.-4, %o7
 		nop
+#endif
 sys_ptrace:	add		%sp, PTREGS_OFF, %o0
 		call		do_ptrace
 		 add		%o7, 1f-.-4, %o7
diff -urN linux-2.6.8-rc2/arch/sparc64/kernel/ioctl32.c linux-2.6.8-rc3/arch/sparc64/kernel/ioctl32.c
--- linux-2.6.8-rc2/arch/sparc64/kernel/ioctl32.c	2004-06-15 22:19:53.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/kernel/ioctl32.c	2004-08-03 15:21:35.519677065 -0700
@@ -25,7 +25,7 @@
 /* Use this to get at 32-bit user passed pointers. 
  * See sys_sparc32.c for description about it.
  */
-#define A(__x) ((void __user *)(unsigned long)(__x))
+#define A(__x) compat_ptr(__x)
 
 static __inline__ void *alloc_user_space(long len)
 {
@@ -54,39 +54,21 @@
 
 static int fbiogetputcmap(unsigned int fd, unsigned int cmd, unsigned long arg)
 {
-	struct fbcmap f;
+	struct fbcmap32 __user *argp = (void __user *)arg;
+	struct fbcmap __user *p = compat_alloc_user_space(sizeof(*p));
+	u32 addr;
 	int ret;
-	char red[256], green[256], blue[256];
-	u32 r, g, b;
-	mm_segment_t old_fs = get_fs();
 	
-	ret = get_user(f.index, &(((struct fbcmap32 __user *)arg)->index));
-	ret |= __get_user(f.count, &(((struct fbcmap32 __user *)arg)->count));
-	ret |= __get_user(r, &(((struct fbcmap32 __user *)arg)->red));
-	ret |= __get_user(g, &(((struct fbcmap32 __user *)arg)->green));
-	ret |= __get_user(b, &(((struct fbcmap32 __user *)arg)->blue));
+	ret = copy_in_user(p, argp, 2 * sizeof(int));
+	ret |= get_user(addr, &argp->red);
+	ret |= put_user(compat_ptr(addr), &p->red);
+	ret |= get_user(addr, &argp->green);
+	ret |= put_user(compat_ptr(addr), &p->green);
+	ret |= get_user(addr, &argp->blue);
+	ret |= put_user(compat_ptr(addr), &p->blue);
 	if (ret)
 		return -EFAULT;
-	if ((f.index < 0) || (f.index > 255)) return -EINVAL;
-	if (f.index + f.count > 256)
-		f.count = 256 - f.index;
-	if (cmd == FBIOPUTCMAP32) {
-		ret = copy_from_user (red, A(r), f.count);
-		ret |= copy_from_user (green, A(g), f.count);
-		ret |= copy_from_user (blue, A(b), f.count);
-		if (ret)
-			return -EFAULT;
-	}
-	f.red = red; f.green = green; f.blue = blue;
-	set_fs (KERNEL_DS);
-	ret = sys_ioctl (fd, (cmd == FBIOPUTCMAP32) ? FBIOPUTCMAP_SPARC : FBIOGETCMAP_SPARC, (long)&f);
-	set_fs (old_fs);
-	if (!ret && cmd == FBIOGETCMAP32) {
-		ret = copy_to_user (A(r), red, f.count);
-		ret |= copy_to_user (A(g), green, f.count);
-		ret |= copy_to_user (A(b), blue, f.count);
-	}
-	return ret ? -EFAULT : 0;
+	return sys_ioctl(fd, (cmd == FBIOPUTCMAP32) ? FBIOPUTCMAP_SPARC : FBIOGETCMAP_SPARC, (unsigned long)p);
 }
 
 struct fbcursor32 {
@@ -105,52 +87,28 @@
 
 static int fbiogscursor(unsigned int fd, unsigned int cmd, unsigned long arg)
 {
-	struct fbcursor f;
+	struct fbcursor __user *p = compat_alloc_user_space(sizeof(*p));
+	struct fbcursor32 __user *argp =  (void __user *)arg;
+	compat_uptr_t addr;
 	int ret;
-	char red[2], green[2], blue[2];
-	char image[128], mask[128];
-	u32 r, g, b;
-	u32 m, i;
-	mm_segment_t old_fs = get_fs();
 	
-	ret = copy_from_user (&f, (struct fbcursor32 __user *) arg,
+	ret = copy_in_user(p, argp,
 			      2 * sizeof (short) + 2 * sizeof(struct fbcurpos));
-	ret |= __get_user(f.size.x,
-			  &(((struct fbcursor32 __user *)arg)->size.x));
-	ret |= __get_user(f.size.y,
-			  &(((struct fbcursor32 __user *)arg)->size.y));
-	ret |= __get_user(f.cmap.index,
-			  &(((struct fbcursor32 __user *)arg)->cmap.index));
-	ret |= __get_user(f.cmap.count,
-			  &(((struct fbcursor32 __user *)arg)->cmap.count));
-	ret |= __get_user(r, &(((struct fbcursor32 __user *)arg)->cmap.red));
-	ret |= __get_user(g, &(((struct fbcursor32 __user *)arg)->cmap.green));
-	ret |= __get_user(b, &(((struct fbcursor32 __user *)arg)->cmap.blue));
-	ret |= __get_user(m, &(((struct fbcursor32 __user *)arg)->mask));
-	ret |= __get_user(i, &(((struct fbcursor32 __user *)arg)->image));
+	ret |= copy_in_user(&p->size, &argp->size, sizeof(struct fbcurpos));
+	ret |= copy_in_user(&p->cmap, &argp->cmap, 2 * sizeof(int));
+	ret |= get_user(addr, &argp->cmap.red);
+	ret |= put_user(compat_ptr(addr), &p->cmap.red);
+	ret |= get_user(addr, &argp->cmap.green);
+	ret |= put_user(compat_ptr(addr), &p->cmap.green);
+	ret |= get_user(addr, &argp->cmap.blue);
+	ret |= put_user(compat_ptr(addr), &p->cmap.blue);
+	ret |= get_user(addr, &argp->mask);
+	ret |= put_user(compat_ptr(addr), &p->mask);
+	ret |= get_user(addr, &argp->image);
+	ret |= put_user(compat_ptr(addr), &p->image);
 	if (ret)
 		return -EFAULT;
-	if (f.set & FB_CUR_SETCMAP) {
-		if ((uint) f.size.y > 32)
-			return -EINVAL;
-		ret = copy_from_user (mask, A(m), f.size.y * 4);
-		ret |= copy_from_user (image, A(i), f.size.y * 4);
-		if (ret)
-			return -EFAULT;
-		f.image = image; f.mask = mask;
-	}
-	if (f.set & FB_CUR_SETCMAP) {
-		ret = copy_from_user (red, A(r), 2);
-		ret |= copy_from_user (green, A(g), 2);
-		ret |= copy_from_user (blue, A(b), 2);
-		if (ret)
-			return -EFAULT;
-		f.cmap.red = red; f.cmap.green = green; f.cmap.blue = blue;
-	}
-	set_fs (KERNEL_DS);
-	ret = sys_ioctl (fd, FBIOSCURSOR, (long)&f);
-	set_fs (old_fs);
-	return ret;
+	return sys_ioctl (fd, FBIOSCURSOR, (unsigned long)p);
 }
 
 #if defined(CONFIG_DRM) || defined(CONFIG_DRM_MODULE)
@@ -173,72 +131,40 @@
 static int drm32_version(unsigned int fd, unsigned int cmd, unsigned long arg)
 {
 	drm32_version_t __user *uversion = (drm32_version_t __user *)arg;
-	char __user *name_ptr, *date_ptr, *desc_ptr;
-	u32 tmp1, tmp2, tmp3;
-	drm_version_t kversion;
-	mm_segment_t old_fs;
+	drm_version_t __user *p = compat_alloc_user_space(sizeof(*p));
+	compat_uptr_t addr;
+	int n;
 	int ret;
 
-	memset(&kversion, 0, sizeof(kversion));
-	if (get_user(kversion.name_len, &uversion->name_len) ||
-	    get_user(kversion.date_len, &uversion->date_len) ||
-	    get_user(kversion.desc_len, &uversion->desc_len) ||
-	    get_user(tmp1, &uversion->name) ||
-	    get_user(tmp2, &uversion->date) ||
-	    get_user(tmp3, &uversion->desc))
-		return -EFAULT;
-
-	name_ptr = A(tmp1);
-	date_ptr = A(tmp2);
-	desc_ptr = A(tmp3);
-
-	ret = -ENOMEM;
-	if (kversion.name_len && name_ptr) {
-		kversion.name = kmalloc(kversion.name_len, GFP_KERNEL);
-		if (!kversion.name)
-			goto out;
-	}
-	if (kversion.date_len && date_ptr) {
-		kversion.date = kmalloc(kversion.date_len, GFP_KERNEL);
-		if (!kversion.date)
-			goto out;
-	}
-	if (kversion.desc_len && desc_ptr) {
-		kversion.desc = kmalloc(kversion.desc_len, GFP_KERNEL);
-		if (!kversion.desc)
-			goto out;
-	}
+	if (clear_user(p, 3 * sizeof(int)) ||
+	    get_user(n, &uversion->name_len) ||
+	    put_user(n, &p->name_len) ||
+	    get_user(addr, &uversion->name) ||
+	    put_user(compat_ptr(addr), &p->name) ||
+	    get_user(n, &uversion->date_len) ||
+	    put_user(n, &p->date_len) ||
+	    get_user(addr, &uversion->date) ||
+	    put_user(compat_ptr(addr), &p->date) ||
+	    get_user(n, &uversion->desc_len) ||
+	    put_user(n, &p->desc_len) ||
+	    get_user(addr, &uversion->desc) ||
+	    put_user(compat_ptr(addr), &p->desc))
+		return -EFAULT;
 
-        old_fs = get_fs();
-	set_fs(KERNEL_DS);
-        ret = sys_ioctl (fd, DRM_IOCTL_VERSION, (unsigned long)&kversion);
-        set_fs(old_fs);
+        ret = sys_ioctl(fd, DRM_IOCTL_VERSION, (unsigned long)p);
+	if (ret)
+		return ret;
 
-	if (!ret) {
-		if ((kversion.name &&
-		     copy_to_user(name_ptr, kversion.name, kversion.name_len)) ||
-		    (kversion.date &&
-		     copy_to_user(date_ptr, kversion.date, kversion.date_len)) ||
-		    (kversion.desc &&
-		     copy_to_user(desc_ptr, kversion.desc, kversion.desc_len)))
-			ret = -EFAULT;
-		if (put_user(kversion.version_major, &uversion->version_major) ||
-		    put_user(kversion.version_minor, &uversion->version_minor) ||
-		    put_user(kversion.version_patchlevel, &uversion->version_patchlevel) ||
-		    put_user(kversion.name_len, &uversion->name_len) ||
-		    put_user(kversion.date_len, &uversion->date_len) ||
-		    put_user(kversion.desc_len, &uversion->desc_len))
-			ret = -EFAULT;
-	}
+	if (copy_in_user(uversion, p, 3 * sizeof(int)) ||
+	    get_user(n, &p->name_len) ||
+	    put_user(n, &uversion->name_len) ||
+	    get_user(n, &p->date_len) ||
+	    put_user(n, &uversion->date_len) ||
+	    get_user(n, &p->desc_len) ||
+	    put_user(n, &uversion->desc_len))
+		return -EFAULT;
 
-out:
-	if (kversion.name)
-		kfree(kversion.name);
-	if (kversion.date)
-		kfree(kversion.date);
-	if (kversion.desc)
-		kfree(kversion.desc);
-	return ret;
+	return 0;
 }
 
 typedef struct drm32_unique {
@@ -251,53 +177,29 @@
 static int drm32_getsetunique(unsigned int fd, unsigned int cmd, unsigned long arg)
 {
 	drm32_unique_t __user *uarg = (drm32_unique_t __user *)arg;
-	drm_unique_t karg;
-	mm_segment_t old_fs;
-	char __user *uptr;
-	u32 tmp;
+	drm_unique_t __user *p = compat_alloc_user_space(sizeof(*p));
+	compat_uptr_t addr;
+	int n;
 	int ret;
 
-	if (get_user(karg.unique_len, &uarg->unique_len))
+	if (get_user(n, &uarg->unique_len) ||
+	    put_user(n, &p->unique_len) ||
+	    get_user(addr, &uarg->unique) ||
+	    put_user(compat_ptr(addr), &p->unique))
 		return -EFAULT;
-	karg.unique = NULL;
 
-	if (get_user(tmp, &uarg->unique))
-		return -EFAULT;
-
-	uptr = A(tmp);
-
-	if (uptr) {
-		karg.unique = kmalloc(karg.unique_len, GFP_KERNEL);
-		if (!karg.unique)
-			return -ENOMEM;
-		if (cmd == DRM32_IOCTL_SET_UNIQUE &&
-		    copy_from_user(karg.unique, uptr, karg.unique_len)) {
-			kfree(karg.unique);
-			return -EFAULT;
-		}
-	}
-
-	old_fs = get_fs();
-	set_fs(KERNEL_DS);
 	if (cmd == DRM32_IOCTL_GET_UNIQUE)
-		ret = sys_ioctl (fd, DRM_IOCTL_GET_UNIQUE, (unsigned long)&karg);
+		ret = sys_ioctl (fd, DRM_IOCTL_GET_UNIQUE, (unsigned long)p);
 	else
-		ret = sys_ioctl (fd, DRM_IOCTL_SET_UNIQUE, (unsigned long)&karg);
-        set_fs(old_fs);
+		ret = sys_ioctl (fd, DRM_IOCTL_SET_UNIQUE, (unsigned long)p);
 
-	if (!ret) {
-		if (cmd == DRM32_IOCTL_GET_UNIQUE &&
-		    uptr != NULL &&
-		    copy_to_user(uptr, karg.unique, karg.unique_len))
-			ret = -EFAULT;
-		if (put_user(karg.unique_len, &uarg->unique_len))
-			ret = -EFAULT;
-	}
+	if (ret)
+		return ret;
 
-	if (karg.unique != NULL)
-		kfree(karg.unique);
+	if (get_user(n, &p->unique_len) || put_user(n, &uarg->unique_len))
+		return -EFAULT;
 
-	return ret;
+	return 0;
 }
 
 typedef struct drm32_map {
@@ -360,41 +262,23 @@
 static int drm32_info_bufs(unsigned int fd, unsigned int cmd, unsigned long arg)
 {
 	drm32_buf_info_t __user *uarg = (drm32_buf_info_t __user *)arg;
-	drm_buf_desc_t __user *ulist;
-	drm_buf_info_t karg;
-	mm_segment_t old_fs;
-	int orig_count, ret;
-	u32 tmp;
+	drm_buf_info_t __user *p = compat_alloc_user_space(sizeof(*p));
+	compat_uptr_t addr;
+	int n;
+	int ret;
 
-	if (get_user(karg.count, &uarg->count) ||
-	    get_user(tmp, &uarg->list))
+	if (get_user(n, &uarg->count) || put_user(n, &p->count) ||
+	    get_user(addr, &uarg->list) || put_user(compat_ptr(addr), &p->list))
 		return -EFAULT;
 
-	ulist = A(tmp);
-
-	orig_count = karg.count;
+	ret = sys_ioctl(fd, DRM_IOCTL_INFO_BUFS, (unsigned long)p);
+	if (ret)
+		return ret;
 
-	karg.list = kmalloc(karg.count * sizeof(drm_buf_desc_t), GFP_KERNEL);
-	if (!karg.list)
+	if (get_user(n, &p->count) || put_user(n, &uarg->count))
 		return -EFAULT;
 
-	old_fs = get_fs();
-	set_fs(KERNEL_DS);
-	ret = sys_ioctl(fd, DRM_IOCTL_INFO_BUFS, (unsigned long) &karg);
-	set_fs(old_fs);
-
-	if (!ret) {
-		if (karg.count <= orig_count &&
-		    (copy_to_user(ulist, karg.list,
-				  karg.count * sizeof(drm_buf_desc_t))))
-			ret = -EFAULT;
-		if (put_user(karg.count, &uarg->count))
-			ret = -EFAULT;
-	}
-
-	kfree(karg.list);
-
-	return ret;
+	return 0;
 }
 
 typedef struct drm32_buf_free {
@@ -406,35 +290,15 @@
 static int drm32_free_bufs(unsigned int fd, unsigned int cmd, unsigned long arg)
 {
 	drm32_buf_free_t __user *uarg = (drm32_buf_free_t __user *)arg;
-	drm_buf_free_t karg;
-	mm_segment_t old_fs;
-	int __user *ulist;
-	int ret;
-	u32 tmp;
+	drm_buf_free_t __user *p = compat_alloc_user_space(sizeof(*p));
+	compat_uptr_t addr;
+	int n;
 
-	if (get_user(karg.count, &uarg->count) ||
-	    get_user(tmp, &uarg->list))
+	if (get_user(n, &uarg->count) || put_user(n, &p->count) ||
+	    get_user(addr, &uarg->list) || put_user(compat_ptr(addr), &p->list))
 		return -EFAULT;
 
-	ulist = A(tmp);
-
-	karg.list = kmalloc(karg.count * sizeof(int), GFP_KERNEL);
-	if (!karg.list)
-		return -ENOMEM;
-
-	ret = -EFAULT;
-	if (copy_from_user(karg.list, ulist, (karg.count * sizeof(int))))
-		goto out;
-
-	old_fs = get_fs();
-	set_fs(KERNEL_DS);
-	ret = sys_ioctl(fd, DRM_IOCTL_FREE_BUFS, (unsigned long) &karg);
-	set_fs(old_fs);
-
-out:
-	kfree(karg.list);
-
-	return ret;
+	return sys_ioctl(fd, DRM_IOCTL_FREE_BUFS, (unsigned long)p);
 }
 
 typedef struct drm32_buf_pub {
@@ -455,59 +319,61 @@
 {
 	drm32_buf_map_t __user *uarg = (drm32_buf_map_t __user *)arg;
 	drm32_buf_pub_t __user *ulist;
-	drm_buf_map_t karg;
-	mm_segment_t old_fs;
+	drm_buf_map_t __user *arg64;
+	drm_buf_pub_t __user *list;
 	int orig_count, ret, i;
-	u32 tmp1, tmp2;
+	int n;
+	compat_uptr_t addr;
 
-	if (get_user(karg.count, &uarg->count) ||
-	    get_user(tmp1, &uarg->virtual) ||
-	    get_user(tmp2, &uarg->list))
+	if (get_user(orig_count, &uarg->count))
 		return -EFAULT;
 
-	karg.virtual = (void *) (unsigned long) tmp1;
-	ulist = A(tmp2);
-
-	orig_count = karg.count;
-
-	karg.list = kmalloc(karg.count * sizeof(drm_buf_pub_t), GFP_KERNEL);
-	if (!karg.list)
-		return -ENOMEM;
-
-	ret = -EFAULT;
-	for (i = 0; i < karg.count; i++) {
-		if (get_user(karg.list[i].idx, &ulist[i].idx) ||
-		    get_user(karg.list[i].total, &ulist[i].total) ||
-		    get_user(karg.list[i].used, &ulist[i].used) ||
-		    get_user(tmp1, &ulist[i].address))
-			goto out;
-
-		karg.list[i].address = (void *) (unsigned long) tmp1;
+	arg64 = compat_alloc_user_space(sizeof(drm_buf_map_t) +
+				(size_t)orig_count * sizeof(drm_buf_pub_t));
+	list = (void __user *)(arg64 + 1);
+
+	if (put_user(orig_count, &arg64->count) ||
+	    put_user(list, &arg64->list) ||
+	    get_user(addr, &uarg->virtual) ||
+	    put_user(compat_ptr(addr), &arg64->virtual) ||
+	    get_user(addr, &uarg->list))
+		return -EFAULT;
+
+	ulist = compat_ptr(addr);
+
+	for (i = 0; i < orig_count; i++) {
+		if (get_user(n, &ulist[i].idx) ||
+		    put_user(n, &list[i].idx) ||
+		    get_user(n, &ulist[i].total) ||
+		    put_user(n, &list[i].total) ||
+		    get_user(n, &ulist[i].used) ||
+		    put_user(n, &list[i].used) ||
+		    get_user(addr, &ulist[i].address) ||
+		    put_user(compat_ptr(addr), &list[i].address))
+			return -EFAULT;
 	}
 
-	old_fs = get_fs();
-	set_fs(KERNEL_DS);
-	ret = sys_ioctl(fd, DRM_IOCTL_MAP_BUFS, (unsigned long) &karg);
-	set_fs(old_fs);
+	ret = sys_ioctl(fd, DRM_IOCTL_MAP_BUFS, (unsigned long) arg64);
+	if (ret)
+		return ret;
 
-	if (!ret) {
-		for (i = 0; i < orig_count; i++) {
-			tmp1 = (u32) (long) karg.list[i].address;
-			if (put_user(karg.list[i].idx, &ulist[i].idx) ||
-			    put_user(karg.list[i].total, &ulist[i].total) ||
-			    put_user(karg.list[i].used, &ulist[i].used) ||
-			    put_user(tmp1, &ulist[i].address)) {
-				ret = -EFAULT;
-				goto out;
-			}
-		}
-		if (put_user(karg.count, &uarg->count))
-			ret = -EFAULT;
+	for (i = 0; i < orig_count; i++) {
+		void __user *p;
+		if (get_user(n, &list[i].idx) ||
+		    put_user(n, &ulist[i].idx) ||
+		    get_user(n, &list[i].total) ||
+		    put_user(n, &ulist[i].total) ||
+		    get_user(n, &list[i].used) ||
+		    put_user(n, &ulist[i].used) ||
+		    get_user(p, &list[i].address) ||
+		    put_user((unsigned long)p, &ulist[i].address))
+			return -EFAULT;
 	}
 
-out:
-	kfree(karg.list);
-	return ret;
+	if (get_user(n, &arg64->count) || put_user(n, &uarg->count))
+		return -EFAULT;
+
+	return 0;
 }
 
 typedef struct drm32_dma {
@@ -533,105 +399,37 @@
 static int drm32_dma(unsigned int fd, unsigned int cmd, unsigned long arg)
 {
 	drm32_dma_t __user *uarg = (drm32_dma_t __user *) arg;
-	int __user *u_si, *u_ss, *u_ri, *u_rs;
-	drm_dma_t karg;
-	mm_segment_t old_fs;
+	drm_dma_t __user *p = compat_alloc_user_space(sizeof(*p));
+	compat_uptr_t addr;
 	int ret;
-	u32 tmp1, tmp2, tmp3, tmp4;
-
-	karg.send_indices = karg.send_sizes = NULL;
-	karg.request_indices = karg.request_sizes = NULL;
-
-	if (get_user(karg.context, &uarg->context) ||
-	    get_user(karg.send_count, &uarg->send_count) ||
-	    get_user(tmp1, &uarg->send_indices) ||
-	    get_user(tmp2, &uarg->send_sizes) ||
-	    get_user(karg.flags, &uarg->flags) ||
-	    get_user(karg.request_count, &uarg->request_count) ||
-	    get_user(karg.request_size, &uarg->request_size) ||
-	    get_user(tmp3, &uarg->request_indices) ||
-	    get_user(tmp4, &uarg->request_sizes) ||
-	    get_user(karg.granted_count, &uarg->granted_count))
-		return -EFAULT;
-
-	u_si = A(tmp1);
-	u_ss = A(tmp2);
-	u_ri = A(tmp3);
-	u_rs = A(tmp4);
-
-	if (karg.send_count) {
-		karg.send_indices = kmalloc(karg.send_count * sizeof(int), GFP_KERNEL);
-		karg.send_sizes = kmalloc(karg.send_count * sizeof(int), GFP_KERNEL);
-
-		ret = -ENOMEM;
-		if (!karg.send_indices || !karg.send_sizes)
-			goto out;
-
-		ret = -EFAULT;
-		if (copy_from_user(karg.send_indices, u_si,
-				   (karg.send_count * sizeof(int))) ||
-		    copy_from_user(karg.send_sizes, u_ss,
-				   (karg.send_count * sizeof(int))))
-			goto out;
-	}
 
-	if (karg.request_count) {
-		karg.request_indices = kmalloc(karg.request_count * sizeof(int), GFP_KERNEL);
-		karg.request_sizes = kmalloc(karg.request_count * sizeof(int), GFP_KERNEL);
-
-		ret = -ENOMEM;
-		if (!karg.request_indices || !karg.request_sizes)
-			goto out;
-
-		ret = -EFAULT;
-		if (copy_from_user(karg.request_indices, u_ri,
-				   (karg.request_count * sizeof(int))) ||
-		    copy_from_user(karg.request_sizes, u_rs,
-				   (karg.request_count * sizeof(int))))
-			goto out;
-	}
-
-	old_fs = get_fs();
-	set_fs(KERNEL_DS);
-	ret = sys_ioctl(fd, DRM_IOCTL_DMA, (unsigned long) &karg);
-	set_fs(old_fs);
-
-	if (!ret) {
-		if (put_user(karg.context, &uarg->context) ||
-		    put_user(karg.send_count, &uarg->send_count) ||
-		    put_user(karg.flags, &uarg->flags) ||
-		    put_user(karg.request_count, &uarg->request_count) ||
-		    put_user(karg.request_size, &uarg->request_size) ||
-		    put_user(karg.granted_count, &uarg->granted_count))
-			ret = -EFAULT;
+	if (copy_in_user(p, uarg, 2 * sizeof(int)) ||
+	    get_user(addr, &uarg->send_indices) ||
+	    put_user(compat_ptr(addr), &p->send_indices) ||
+	    get_user(addr, &uarg->send_sizes) ||
+	    put_user(compat_ptr(addr), &p->send_sizes) ||
+	    copy_in_user(&p->flags, &uarg->flags, sizeof(drm_dma_flags_t)) ||
+	    copy_in_user(&p->request_count, &uarg->request_count, sizeof(int))||
+	    copy_in_user(&p->request_size, &uarg->request_size, sizeof(int)) ||
+	    get_user(addr, &uarg->request_indices) ||
+	    put_user(compat_ptr(addr), &p->request_indices) ||
+	    get_user(addr, &uarg->request_sizes) ||
+	    put_user(compat_ptr(addr), &p->request_sizes) ||
+	    copy_in_user(&p->granted_count, &uarg->granted_count, sizeof(int)))
+		return -EFAULT;
 
-		if (karg.send_count) {
-			if (copy_to_user(u_si, karg.send_indices,
-					 (karg.send_count * sizeof(int))) ||
-			    copy_to_user(u_ss, karg.send_sizes,
-					 (karg.send_count * sizeof(int))))
-				ret = -EFAULT;
-		}
-		if (karg.request_count) {
-			if (copy_to_user(u_ri, karg.request_indices,
-					 (karg.request_count * sizeof(int))) ||
-			    copy_to_user(u_rs, karg.request_sizes,
-					 (karg.request_count * sizeof(int))))
-				ret = -EFAULT;
-		}
-	}
+	ret = sys_ioctl(fd, DRM_IOCTL_DMA, (unsigned long)p);
+	if (ret)
+		return ret;
 
-out:
-	if (karg.send_indices)
-		kfree(karg.send_indices);
-	if (karg.send_sizes)
-		kfree(karg.send_sizes);
-	if (karg.request_indices)
-		kfree(karg.request_indices);
-	if (karg.request_sizes)
-		kfree(karg.request_sizes);
+	if (copy_in_user(uarg, p, 2 * sizeof(int)) ||
+	    copy_in_user(&uarg->flags, &p->flags, sizeof(drm_dma_flags_t)) ||
+	    copy_in_user(&uarg->request_count, &p->request_count, sizeof(int))||
+	    copy_in_user(&uarg->request_size, &p->request_size, sizeof(int)) ||
+	    copy_in_user(&uarg->granted_count, &p->granted_count, sizeof(int)))
+		return -EFAULT;
 
-	return ret;
+	return 0;
 }
 
 typedef struct drm32_ctx_res {
@@ -643,50 +441,23 @@
 static int drm32_res_ctx(unsigned int fd, unsigned int cmd, unsigned long arg)
 {
 	drm32_ctx_res_t __user *uarg = (drm32_ctx_res_t __user *) arg;
-	drm_ctx_t __user *ulist;
-	drm_ctx_res_t karg;
-	mm_segment_t old_fs;
-	int orig_count, ret;
-	u32 tmp;
+	drm_ctx_res_t __user *p = compat_alloc_user_space(sizeof(*p));
+	compat_uptr_t addr;
+	int ret;
 
-	karg.contexts = NULL;
-	if (get_user(karg.count, &uarg->count) ||
-	    get_user(tmp, &uarg->contexts))
+	if (copy_in_user(p, uarg, sizeof(int)) ||
+	    get_user(addr, &uarg->contexts) ||
+	    put_user(compat_ptr(addr), &p->contexts))
 		return -EFAULT;
 
-	ulist = A(tmp);
-
-	orig_count = karg.count;
-	if (karg.count && ulist) {
-		karg.contexts = kmalloc((karg.count * sizeof(drm_ctx_t)), GFP_KERNEL);
-		if (!karg.contexts)
-			return -ENOMEM;
-		if (copy_from_user(karg.contexts, ulist,
-				   (karg.count * sizeof(drm_ctx_t)))) {
-			kfree(karg.contexts);
-			return -EFAULT;
-		}
-	}
-
-	old_fs = get_fs();
-	set_fs(KERNEL_DS);
-	ret = sys_ioctl(fd, DRM_IOCTL_RES_CTX, (unsigned long) &karg);
-	set_fs(old_fs);
-
-	if (!ret) {
-		if (orig_count) {
-			if (copy_to_user(ulist, karg.contexts,
-					 (orig_count * sizeof(drm_ctx_t))))
-				ret = -EFAULT;
-		}
-		if (put_user(karg.count, &uarg->count))
-			ret = -EFAULT;
-	}
+	ret = sys_ioctl(fd, DRM_IOCTL_RES_CTX, (unsigned long)p);
+	if (ret)
+		return ret;
 
-	if (karg.contexts)
-		kfree(karg.contexts);
+	if (copy_in_user(uarg, p, sizeof(int)))
+		return -EFAULT;
 
-	return ret;
+	return 0;
 }
 
 #endif
diff -urN linux-2.6.8-rc2/arch/sparc64/kernel/process.c linux-2.6.8-rc3/arch/sparc64/kernel/process.c
--- linux-2.6.8-rc2/arch/sparc64/kernel/process.c	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/kernel/process.c	2004-08-03 15:21:35.522677188 -0700
@@ -12,6 +12,7 @@
 
 #include <stdarg.h>
 
+#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/module.h>
 #include <linux/sched.h>
@@ -28,6 +29,7 @@
 #include <linux/config.h>
 #include <linux/reboot.h>
 #include <linux/delay.h>
+#include <linux/compat.h>
 #include <linux/init.h>
 
 #include <asm/oplib.h>
@@ -588,10 +590,13 @@
 
 	clone_flags &= ~CLONE_IDLETASK;
 
+#ifdef CONFIG_COMPAT
 	if (test_thread_flag(TIF_32BIT)) {
 		parent_tid_ptr = compat_ptr(regs->u_regs[UREG_I2]);
 		child_tid_ptr = compat_ptr(regs->u_regs[UREG_I4]);
-	} else {
+	} else
+#endif
+	{
 		parent_tid_ptr = (int __user *) regs->u_regs[UREG_I2];
 		child_tid_ptr = (int __user *) regs->u_regs[UREG_I4];
 	}
diff -urN linux-2.6.8-rc2/arch/sparc64/kernel/sbus.c linux-2.6.8-rc3/arch/sparc64/kernel/sbus.c
--- linux-2.6.8-rc2/arch/sparc64/kernel/sbus.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/kernel/sbus.c	2004-08-03 15:21:35.523677229 -0700
@@ -28,10 +28,10 @@
  *
  * On SYSIO, using an 8K page size we have 1GB of SBUS
  * DMA space mapped.  We divide this space into equally
- * sized clusters.  Currently we allow clusters up to a
- * size of 1MB.  If anything begins to generate DMA
- * mapping requests larger than this we will need to
- * increase things a bit.
+ * sized clusters. We allocate a DMA mapping from the
+ * cluster that matches the order of the allocation, or
+ * if the order is greater than the number of clusters,
+ * we try to allocate from the last cluster.
  */
 
 #define NCLUSTERS	8UL
@@ -134,12 +134,17 @@
 
 static iopte_t *alloc_streaming_cluster(struct sbus_iommu *iommu, unsigned long npages)
 {
-	iopte_t *iopte, *limit, *first;
-	unsigned long cnum, ent, flush_point;
+	iopte_t *iopte, *limit, *first, *cluster;
+	unsigned long cnum, ent, nent, flush_point, found;
 
 	cnum = 0;
+	nent = 1;
 	while ((1UL << cnum) < npages)
 		cnum++;
+	if(cnum >= NCLUSTERS) {
+		nent = 1UL << (cnum - NCLUSTERS);
+		cnum = NCLUSTERS - 1;
+	}
 	iopte  = iommu->page_table + (cnum * CLUSTER_NPAGES);
 
 	if (cnum == 0)
@@ -152,22 +157,31 @@
 	flush_point = iommu->alloc_info[cnum].flush;
 
 	first = iopte;
+	cluster = NULL;
+	found = 0;
 	for (;;) {
 		if (iopte_val(*iopte) == 0UL) {
-			if ((iopte + (1 << cnum)) >= limit)
-				ent = 0;
-			else
-				ent = ent + 1;
-			iommu->alloc_info[cnum].next = ent;
-			if (ent == flush_point)
-				__iommu_flushall(iommu);
-			break;
+			found++;
+			if (!cluster)
+				cluster = iopte;
+		} else {
+			/* Used cluster in the way */
+			cluster = NULL;
+			found = 0;
 		}
+
+		if (found == nent)
+			break;
+
 		iopte += (1 << cnum);
 		ent++;
 		if (iopte >= limit) {
 			iopte = (iommu->page_table + (cnum * CLUSTER_NPAGES));
 			ent = 0;
+
+			/* Multiple cluster allocations must not wrap */
+			cluster = NULL;
+			found = 0;
 		}
 		if (ent == flush_point)
 			__iommu_flushall(iommu);
@@ -175,8 +189,19 @@
 			goto bad;
 	}
 
+	/* ent/iopte points to the last cluster entry we're going to use,
+	 * so save our place for the next allocation.
+	 */
+	if ((iopte + (1 << cnum)) >= limit)
+		ent = 0;
+	else
+		ent = ent + 1;
+	iommu->alloc_info[cnum].next = ent;
+	if (ent == flush_point)
+		__iommu_flushall(iommu);
+
 	/* I've got your streaming cluster right here buddy boy... */
-	return iopte;
+	return cluster;
 
 bad:
 	printk(KERN_EMERG "sbus: alloc_streaming_cluster of npages(%ld) failed!\n",
@@ -186,15 +211,23 @@
 
 static void free_streaming_cluster(struct sbus_iommu *iommu, u32 base, unsigned long npages)
 {
-	unsigned long cnum, ent;
+	unsigned long cnum, ent, nent;
 	iopte_t *iopte;
 
 	cnum = 0;
+	nent = 1;
 	while ((1UL << cnum) < npages)
 		cnum++;
+	if(cnum >= NCLUSTERS) {
+		nent = 1UL << (cnum - NCLUSTERS);
+		cnum = NCLUSTERS - 1;
+	}
 	ent = (base & CLUSTER_MASK) >> (IO_PAGE_SHIFT + cnum);
 	iopte = iommu->page_table + ((base - MAP_BASE) >> IO_PAGE_SHIFT);
-	iopte_val(*iopte) = 0UL;
+	do {
+		iopte_val(*iopte) = 0UL;
+		iopte += 1 << cnum;
+	} while(--nent);
 
 	/* If the global flush might not have caught this entry,
 	 * adjust the flush point such that we will flush before
diff -urN linux-2.6.8-rc2/arch/sparc64/kernel/sparc64_ksyms.c linux-2.6.8-rc3/arch/sparc64/kernel/sparc64_ksyms.c
--- linux-2.6.8-rc2/arch/sparc64/kernel/sparc64_ksyms.c	2004-08-03 15:21:06.366481312 -0700
+++ linux-2.6.8-rc3/arch/sparc64/kernel/sparc64_ksyms.c	2004-08-03 15:21:35.527677393 -0700
@@ -135,6 +135,7 @@
 EXPORT_SYMBOL(__write_unlock);
 EXPORT_SYMBOL(__write_trylock);
 /* Out of line spin-locking implementation. */
+EXPORT_SYMBOL(_raw_spin_lock);
 EXPORT_SYMBOL(_raw_spin_lock_flags);
 #endif
 
@@ -142,8 +143,8 @@
 EXPORT_SYMBOL(synchronize_irq);
 
 #if defined(CONFIG_MCOUNT)
-extern void mcount(void);
-EXPORT_SYMBOL_NOVERS(mcount);
+extern void _mcount(void);
+EXPORT_SYMBOL_NOVERS(_mcount);
 #endif
 
 /* CPU online map and active count.  */
@@ -333,7 +334,6 @@
 #endif
 
 /* Special internal versions of library functions. */
-EXPORT_SYMBOL(__memcpy);
 EXPORT_SYMBOL(__memset);
 EXPORT_SYMBOL(_clear_page);
 EXPORT_SYMBOL(clear_user_page);
@@ -350,9 +350,10 @@
 EXPORT_SYMBOL(csum_partial_copy_sparc64);
 EXPORT_SYMBOL(ip_fast_csum);
 
-/* Moving data to/from userspace. */
+/* Moving data to/from/in userspace. */
 EXPORT_SYMBOL(__copy_to_user);
 EXPORT_SYMBOL(__copy_from_user);
+EXPORT_SYMBOL(__copy_in_user);
 EXPORT_SYMBOL(__strncpy_from_user);
 EXPORT_SYMBOL(__bzero_noasi);
 
diff -urN linux-2.6.8-rc2/arch/sparc64/kernel/sys_sparc32.c linux-2.6.8-rc3/arch/sparc64/kernel/sys_sparc32.c
--- linux-2.6.8-rc2/arch/sparc64/kernel/sys_sparc32.c	2004-08-03 15:21:06.368481394 -0700
+++ linux-2.6.8-rc3/arch/sparc64/kernel/sys_sparc32.c	2004-08-03 15:21:35.551678378 -0700
@@ -867,138 +867,6 @@
 		return sys_ftruncate(fd, (high << 32) | low);
 }
 
-/* readdir & getdents */
-
-#define NAME_OFFSET(de) ((int) ((de)->d_name - (char __user *) (de)))
-#define ROUND_UP(x) (((x)+sizeof(u32)-1) & ~(sizeof(u32)-1))
-
-struct old_linux_dirent32 {
-	u32		d_ino;
-	u32		d_offset;
-	unsigned short	d_namlen;
-	char		d_name[1];
-};
-
-struct readdir_callback32 {
-	struct old_linux_dirent32 __user * dirent;
-	int count;
-};
-
-static int fillonedir(void * __buf, const char * name, int namlen,
-		      loff_t offset, ino_t ino, unsigned int d_type)
-{
-	struct readdir_callback32 * buf = (struct readdir_callback32 *) __buf;
-	struct old_linux_dirent32 __user * dirent;
-
-	if (buf->count)
-		return -EINVAL;
-	buf->count++;
-	dirent = buf->dirent;
-	put_user(ino, &dirent->d_ino);
-	put_user(offset, &dirent->d_offset);
-	put_user(namlen, &dirent->d_namlen);
-	copy_to_user(dirent->d_name, name, namlen);
-	put_user(0, dirent->d_name + namlen);
-	return 0;
-}
-
-asmlinkage long old32_readdir(unsigned int fd, struct old_linux_dirent32 __user *dirent, unsigned int count)
-{
-	int error = -EBADF;
-	struct file * file;
-	struct readdir_callback32 buf;
-
-	file = fget(fd);
-	if (!file)
-		goto out;
-
-	buf.count = 0;
-	buf.dirent = dirent;
-
-	error = vfs_readdir(file, fillonedir, &buf);
-	if (error < 0)
-		goto out_putf;
-	error = buf.count;
-
-out_putf:
-	fput(file);
-out:
-	return error;
-}
-
-struct linux_dirent32 {
-	u32		d_ino;
-	u32		d_off;
-	unsigned short	d_reclen;
-	char		d_name[1];
-};
-
-struct getdents_callback32 {
-	struct linux_dirent32 __user *current_dir;
-	struct linux_dirent32 __user *previous;
-	int count;
-	int error;
-};
-
-static int filldir(void * __buf, const char * name, int namlen, loff_t offset, ino_t ino,
-		   unsigned int d_type)
-{
-	struct linux_dirent32 __user * dirent;
-	struct getdents_callback32 * buf = (struct getdents_callback32 *) __buf;
-	int reclen = ROUND_UP(NAME_OFFSET(dirent) + namlen + 2);
-
-	buf->error = -EINVAL;	/* only used if we fail.. */
-	if (reclen > buf->count)
-		return -EINVAL;
-	dirent = buf->previous;
-	if (dirent)
-		put_user(offset, &dirent->d_off);
-	dirent = buf->current_dir;
-	buf->previous = dirent;
-	put_user(ino, &dirent->d_ino);
-	put_user(reclen, &dirent->d_reclen);
-	copy_to_user(dirent->d_name, name, namlen);
-	put_user(0, dirent->d_name + namlen);
-	put_user(d_type, (char __user *) dirent + reclen - 1);
-	dirent = (void __user *) dirent + reclen;
-	buf->current_dir = dirent;
-	buf->count -= reclen;
-	return 0;
-}
-
-asmlinkage long sys32_getdents(unsigned int fd, struct linux_dirent32 __user *dirent, unsigned int count)
-{
-	struct file * file;
-	struct linux_dirent32 __user *lastdirent;
-	struct getdents_callback32 buf;
-	int error = -EBADF;
-
-	file = fget(fd);
-	if (!file)
-		goto out;
-
-	buf.current_dir = dirent;
-	buf.previous = NULL;
-	buf.count = count;
-	buf.error = 0;
-
-	error = vfs_readdir(file, filldir, &buf);
-	if (error < 0)
-		goto out_putf;
-	lastdirent = buf.previous;
-	error = buf.error;
-	if (lastdirent) {
-		put_user(file->f_pos, &lastdirent->d_off);
-		error = count - buf.count;
-	}
-out_putf:
-	fput(file);
-out:
-	return error;
-}
-
-/* end of readdir & getdents */
-
 int cp_compat_stat(struct kstat *stat, struct compat_stat __user *statbuf)
 {
 	int err;
diff -urN linux-2.6.8-rc2/arch/sparc64/kernel/systbls.S linux-2.6.8-rc3/arch/sparc64/kernel/systbls.S
--- linux-2.6.8-rc2/arch/sparc64/kernel/systbls.S	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/kernel/systbls.S	2004-08-03 15:21:35.553678460 -0700
@@ -15,6 +15,7 @@
 	.text
 	.align	4
 
+#ifdef CONFIG_COMPAT
 	/* First, the 32-bit Linux native syscall table. */
 
 	.globl sys_call_table32
@@ -53,13 +54,13 @@
 	.word compat_sys_fcntl64, sys_ni_syscall, compat_sys_statfs, compat_sys_fstatfs, sys_oldumount
 /*160*/	.word compat_sys_sched_setaffinity, compat_sys_sched_getaffinity, sys32_getdomainname, sys32_setdomainname, sys_nis_syscall
 	.word sys_quotactl, sys_set_tid_address, compat_sys_mount, sys_ustat, sys32_setxattr
-/*170*/	.word sys32_lsetxattr, sys32_fsetxattr, sys_getxattr, sys_lgetxattr, sys32_getdents
+/*170*/	.word sys32_lsetxattr, sys32_fsetxattr, sys_getxattr, sys_lgetxattr, compat_sys_getdents
 	.word sys_setsid, sys_fchdir, sys32_fgetxattr, sys_listxattr, sys_llistxattr
 /*180*/	.word sys32_flistxattr, sys_removexattr, sys_lremovexattr, compat_sys_sigpending, sys_ni_syscall
 	.word sys32_setpgid, sys32_fremovexattr, sys32_tkill, sys32_exit_group, sparc64_newuname
 /*190*/	.word sys32_init_module, sparc64_personality, sys_remap_file_pages, sys32_epoll_create, sys32_epoll_ctl
 	.word sys32_epoll_wait, sys_nis_syscall, sys_getppid, sys32_sigaction, sys_sgetmask
-/*200*/	.word sys32_ssetmask, sys_sigsuspend, compat_sys_newlstat, sys_uselib, old32_readdir
+/*200*/	.word sys32_ssetmask, sys_sigsuspend, compat_sys_newlstat, sys_uselib, compat_old_readdir
 	.word sys32_readahead, sys32_socketcall, sys32_syslog, sys32_lookup_dcookie, sys32_fadvise64
 /*210*/	.word sys32_fadvise64_64, sys32_tgkill, sys32_waitpid, sys_swapoff, sys32_sysinfo
 	.word sys32_ipc, sys32_sigreturn, sys_clone, sys_nis_syscall, sys32_adjtimex
@@ -77,6 +78,8 @@
 	.word sys_mq_timedsend, sys_mq_timedreceive, compat_sys_mq_notify, compat_sys_mq_getsetattr, sys_ni_syscall
 /*280*/	.word sys_ni_syscall, sys_ni_syscall, sys_ni_syscall
 
+#endif /* CONFIG_COMPAT */
+
 	/* Now the 64-bit native Linux syscall table. */
 
 	.align	4
@@ -85,7 +88,7 @@
 sys_call_table:
 /*0*/	.word sys_restart_syscall, sparc_exit, sys_fork, sys_read, sys_write
 /*5*/	.word sys_open, sys_close, sys_wait4, sys_creat, sys_link
-/*10*/  .word sys_unlink, sunos_execv, sys_chdir, sys_chown, sys_mknod
+/*10*/  .word sys_unlink, sys_nis_syscall, sys_chdir, sys_chown, sys_mknod
 /*15*/	.word sys_chmod, sys_lchown, sparc_brk, sys_perfctr, sys_lseek
 /*20*/	.word sys_getpid, sys_capget, sys_capset, sys_setuid, sys_getuid
 /*25*/	.word sys_nis_syscall, sys_ptrace, sys_alarm, sys_sigaltstack, sys_nis_syscall
diff -urN linux-2.6.8-rc2/arch/sparc64/lib/U3copy_from_user.S linux-2.6.8-rc3/arch/sparc64/lib/U3copy_from_user.S
--- linux-2.6.8-rc2/arch/sparc64/lib/U3copy_from_user.S	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/lib/U3copy_from_user.S	2004-08-03 15:21:35.556678583 -0700
@@ -1,20 +1,31 @@
-/* $Id: U3copy_from_user.S,v 1.4 2002/01/15 07:16:26 davem Exp $
- * U3memcpy.S: UltraSparc-III optimized copy from userspace.
+/* U3copy_from_user.S: UltraSparc-III optimized copy from userspace.
  *
- * Copyright (C) 1999, 2000 David S. Miller (davem@redhat.com)
+ * Copyright (C) 1999, 2000, 2004 David S. Miller (davem@redhat.com)
  */
 
-#ifdef __KERNEL__
 #include <asm/visasm.h>
 #include <asm/asi.h>
 #include <asm/dcu.h>
 #include <asm/spitfire.h>
-#undef SMALL_COPY_USES_FPU
+
+#define XCC xcc
+
+#define EXNV_RAW(x,y,a,b)		\
+98:	x,y;				\
+	.section .fixup;		\
+	.align 4;			\
+99:	ba U3cfu_fixup;			\
+	 a, b, %o1;			\
+	.section __ex_table;		\
+	.align 4;			\
+	.word 98b, 99b;			\
+	.text;				\
+	.align 4;
 #define EXNV(x,y,a,b)			\
 98:	x,y;				\
 	.section .fixup;		\
 	.align 4;			\
-99:	VISExitHalf;			\
+99:	add %o1, %o3, %o0;		\
 	ba U3cfu_fixup;			\
 	 a, b, %o1;			\
 	.section __ex_table;		\
@@ -22,6 +33,32 @@
 	.word 98b, 99b;			\
 	.text;				\
 	.align 4;
+#define EXNV4(x,y,a,b)			\
+98:	x,y;				\
+	.section .fixup;		\
+	.align 4;			\
+99:	add %o1, %o3, %o0;		\
+	a, b, %o1;			\
+	ba U3cfu_fixup;			\
+	 add %o1, 4, %o1;		\
+	.section __ex_table;		\
+	.align 4;			\
+	.word 98b, 99b;			\
+	.text;				\
+	.align 4;
+#define EXNV8(x,y,a,b)			\
+98:	x,y;				\
+	.section .fixup;		\
+	.align 4;			\
+99:	add %o1, %o3, %o0;		\
+	a, b, %o1;			\
+	ba U3cfu_fixup;			\
+	 add %o1, 8, %o1;		\
+	.section __ex_table;		\
+	.align 4;			\
+	.word 98b, 99b;			\
+	.text;				\
+	.align 4;
 #define EX(x,y,a,b)			\
 98:	x,y;				\
 	.section .fixup;		\
@@ -77,18 +114,9 @@
 	.word 98b, 99b;			\
 	.text;				\
 	.align 4;
-#else
-#define ASI_BLK_P 0xf0
-#define FPRS_FEF  0x04
-#define VISEntryHalf rd %fprs, %o5; wr %g0, FPRS_FEF, %fprs
-#define VISExitHalf and %o5, FPRS_FEF, %o5; wr %o5, 0x0, %fprs
-#define SMALL_COPY_USES_FPU
-#define EXNV(x,y,a,b)	x,y;
-#define EX(x,y,a,b)	x,y;
-#define EX2(x,y)	x,y;
-#define EX3(x,y)	x,y;
-#define EX4(x,y)	x,y;
-#endif
+
+	.register	%g2,#scratch
+	.register	%g3,#scratch
 
 	/* Special/non-trivial issues of this code:
 	 *
@@ -109,81 +137,55 @@
 	 * of up to 2.4GB per second.
 	 */
 
-	.globl		U3copy_from_user
-U3copy_from_user: /* %o0=dst, %o1=src, %o2=len */
-#ifndef __KERNEL__
-	/* Save away original 'dst' for memcpy return value. */
-	mov		%o0, %g3			! A0	Group
-#endif
-	/* Anything to copy at all? */
-	cmp		%o2, 0				! A1
-	ble,pn		%icc, U3copy_from_user_short_ret! BR
-
-	/* Extremely small copy? */
-	 cmp		%o2, 31				! A0	Group
-	ble,pn		%icc, U3copy_from_user_short	! BR
-
-	/* Large enough to use unrolled prefetch loops? */
-	 cmp		%o2, 0x100			! A1
-	bge,a,pt	%icc, U3copy_from_user_enter	! BR	Group
-	 andcc		%o0, 0x3f, %g2			! A0
-
-	ba,pt		%xcc, U3copy_from_user_toosmall	! BR	Group
-	 andcc		%o0, 0x7, %g2			! A0
-
-	.align		32
-U3copy_from_user_short:
-	/* Copy %o2 bytes from src to dst, one byte at a time. */
-	EXNV(lduba [%o1 + 0x00] %asi, %o3, add %o2, %g0)! MS	Group
-	add		%o1, 0x1, %o1			! A0
-	add		%o0, 0x1, %o0			! A1
-	subcc		%o2, 1, %o2			! A0	Group
-
-	bg,pt		%icc, U3copy_from_user_short	! BR
-	 stb		%o3, [%o0 + -1]			! MS	Group (1-cycle stall)
-
-U3copy_from_user_short_ret:
-#ifdef __KERNEL__
-	retl						! BR	Group (0-4 cycle stall)
-	 clr		%o0				! A0
-#else
-	retl						! BR	Group (0-4 cycle stall)
-	 mov		%g3, %o0			! A0
-#endif
+	.globl	U3copy_from_user
+U3copy_from_user:	/* %o0=dst, %o1=src, %o2=len */
+	cmp		%o2, 0
+	be,pn		%XCC, out
+	 or		%o0, %o1, %o3
+	cmp		%o2, 16
+	bleu,a,pn	%XCC, small_copy
+	 or		%o3, %o2, %o3
+
+	cmp		%o2, 256
+	blu,pt		%XCC, medium_copy
+	 andcc		%o3, 0x7, %g0
 
-	/* Here len >= (6 * 64) and condition codes reflect execution
+	ba,pt		%xcc, enter
+	 andcc		%o0, 0x3f, %g2
+
+	/* Here len >= 256 and condition codes reflect execution
 	 * of "andcc %o0, 0x7, %g2", done by caller.
 	 */
 	.align		64
-U3copy_from_user_enter:
+enter:
 	/* Is 'dst' already aligned on an 64-byte boundary? */
-	be,pt		%xcc, 2f			! BR
+	be,pt		%XCC, 2f
 
 	/* Compute abs((dst & 0x3f) - 0x40) into %g2.  This is the number
 	 * of bytes to copy to make 'dst' 64-byte aligned.  We pre-
 	 * subtract this from 'len'.
 	 */
-	 sub		%g2, 0x40, %g2			! A0	Group
-	sub		%g0, %g2, %g2			! A0	Group
-	sub		%o2, %g2, %o2			! A0	Group
+	 sub		%g2, 0x40, %g2
+	sub		%g0, %g2, %g2
+	sub		%o2, %g2, %o2
 
 	/* Copy %g2 bytes from src to dst, one byte at a time. */
-1:	EXNV(lduba [%o1 + 0x00] %asi, %o3, add %o2, %g2)! MS	(Group)
-	add		%o1, 0x1, %o1			! A1
-	add		%o0, 0x1, %o0			! A0	Group
-	subcc		%g2, 0x1, %g2			! A1
-
-	bg,pt		%icc, 1b			! BR	Group
-	 stb		%o3, [%o0 + -1]			! MS	Group
-
-2:	VISEntryHalf					! MS+MS
-	and		%o1, 0x7, %g1			! A1
-	ba,pt		%xcc, U3copy_from_user_begin		! BR
-	 alignaddr	%o1, %g0, %o1			! MS	      (Break-after)
+1:	EXNV_RAW(lduba [%o1 + 0x00] %asi, %o3, add %o2, %g2)
+	add		%o1, 0x1, %o1
+	add		%o0, 0x1, %o0
+	subcc		%g2, 0x1, %g2
+
+	bg,pt		%XCC, 1b
+	 stb		%o3, [%o0 + -1]
+
+2:	VISEntryHalf
+	and		%o1, 0x7, %g1
+	ba,pt		%xcc, begin
+	 alignaddr	%o1, %g0, %o1
 
 	.align		64
-U3copy_from_user_begin:
-#ifdef __KERNEL__
+begin:
+
 	.globl		U3copy_from_user_nop_1_6
 U3copy_from_user_nop_1_6:
 	ldxa		[%g0] ASI_DCU_CONTROL_REG, %g3
@@ -192,315 +194,225 @@
 	or		%g3, %o3, %o3
 	stxa		%o3, [%g0] ASI_DCU_CONTROL_REG	! Enable P-cache
 	membar		#Sync
-#endif
-	prefetcha	[%o1 + 0x000] %asi, #one_read	! MS	Group1
-	prefetcha	[%o1 + 0x040] %asi, #one_read	! MS	Group2
-	andn		%o2, (0x40 - 1), %o4		! A0
-	prefetcha	[%o1 + 0x080] %asi, #one_read	! MS	Group3
-	cmp		%o4, 0x140			! A0
-	prefetcha	[%o1 + 0x0c0] %asi, #one_read	! MS	Group4
-	EX(ldda [%o1 + 0x000] %asi, %f0, add %o2, %g0)	! MS	Group5 (%f0 results at G8)
-	bge,a,pt	%icc, 1f			! BR
-
-	prefetcha	[%o1 + 0x100] %asi, #one_read	! MS	Group6
-1:	EX(ldda [%o1 + 0x008] %asi, %f2, add %o2, %g0)	! AX	       (%f2 results at G9)
-	cmp		%o4, 0x180			! A1
-	bge,a,pt	%icc, 1f			! BR
-	 prefetcha	[%o1 + 0x140] %asi, #one_read	! MS	Group7
-1:	EX(ldda [%o1 + 0x010] %asi, %f4, add %o2, %g0)	! AX	       (%f4 results at G10)
-	cmp		%o4, 0x1c0			! A1
-	bge,a,pt	%icc, 1f			! BR
-
-	 prefetcha	[%o1 + 0x180] %asi, #one_read	! MS	Group8
-1:	faligndata	%f0, %f2, %f16			! FGA	Group9 (%f16 at G12)
-	EX(ldda [%o1 + 0x018] %asi, %f6, add %o2, %g0)	! AX	       (%f6 results at G12)
-	faligndata	%f2, %f4, %f18			! FGA	Group10 (%f18 results at G13)
-	EX(ldda [%o1 + 0x020] %asi, %f8, add %o2, %g0)	! MS	        (%f8 results at G13)
-	faligndata	%f4, %f6, %f20			! FGA	Group12	(1-cycle stall,%f20 at G15)
-	EX(ldda [%o1 + 0x028] %asi, %f10, add %o2, %g0)	! MS		(%f10 results at G15)
-	faligndata	%f6, %f8, %f22			! FGA	Group13 (%f22 results at G16)
-
-	EX(ldda [%o1 + 0x030] %asi, %f12, add %o2, %g0)	! MS		(%f12 results at G16)
-	faligndata	%f8, %f10, %f24			! FGA	Group15 (1-cycle stall,%f24 at G18)
-	EX(ldda [%o1 + 0x038] %asi, %f14, add %o2, %g0)	! MS		(%f14 results at G18)
-	faligndata	%f10, %f12, %f26		! FGA	Group16 (%f26 results at G19)
-	EX(ldda [%o1 + 0x040] %asi, %f0, add %o2, %g0)	! MS		(%f0 results at G19)
-
-	/* We only use the first loop if len > (7 * 64). */
-	subcc		%o4, 0x1c0, %o4			! A0	Group17
-	bg,pt		%icc, U3copy_from_user_loop1	! BR
-	 add		%o1, 0x40, %o1			! A1
-
-	add		%o4, 0x140, %o4			! A0	Group18
-	ba,pt		%xcc, U3copy_from_user_loop2	! BR
-	 srl		%o4, 6, %o3			! A0	Group19
-	nop
-	nop
-	nop
-	nop
-	nop
-
-	nop
-	nop
-
-	/* This loop performs the copy and queues new prefetches.
-	 * We drop into the second loop when len <= (5 * 64).  Note
-	 * that this (5 * 64) factor has been subtracted from len
-	 * already.
-	 */
-U3copy_from_user_loop1:
-	EX2(ldda [%o1 + 0x008] %asi, %f2)		! MS	Group2	(%f2 results at G5)
-	faligndata	%f12, %f14, %f28		! FGA		(%f28 results at G5)
-	EX2(ldda [%o1 + 0x010] %asi, %f4)		! MS	Group3	(%f4 results at G6)
-	faligndata	%f14, %f0, %f30			! FGA	Group4	(1-cycle stall, %f30 at G7)
-	stda		%f16, [%o0] ASI_BLK_P		! MS
-	EX2(ldda [%o1 + 0x018] %asi, %f6)		! AX		(%f6 results at G7)
-
-	faligndata	%f0, %f2, %f16			! FGA	Group12 (7-cycle stall)
-	EX2(ldda [%o1 + 0x020] %asi, %f8)		! MS	        (%f8 results at G15)
-	faligndata	%f2, %f4, %f18			! FGA	Group13	(%f18 results at G16)
-	EX2(ldda [%o1 + 0x028] %asi, %f10)		! MS		(%f10 results at G16)
-	faligndata	%f4, %f6, %f20			! FGA	Group14	(%f20 results at G17)
-	EX2(ldda [%o1 + 0x030] %asi, %f12)		! MS		(%f12 results at G17)
-	faligndata	%f6, %f8, %f22			! FGA	Group15	(%f22 results at G18)
-	EX2(ldda [%o1 + 0x038] %asi, %f14)		! MS		(%f14 results at G18)
-
-	faligndata	%f8, %f10, %f24			! FGA	Group16	(%f24 results at G19)
-	EX2(ldda [%o1 + 0x040] %asi, %f0)		! AX		(%f0 results at G19)
-	prefetcha	[%o1 + 0x180] %asi, #one_read	! MS
-	faligndata	%f10, %f12, %f26		! FGA	Group17	(%f26 results at G20)
-	subcc		%o4, 0x40, %o4			! A0
-	add		%o1, 0x40, %o1			! A1
-	bg,pt		%xcc, U3copy_from_user_loop1	! BR
-	 add		%o0, 0x40, %o0			! A0	Group18
-
-U3copy_from_user_loop2_enter:
-	mov		5, %o3				! A1
-
-	/* This loop performs on the copy, no new prefetches are
-	 * queued.  We do things this way so that we do not perform
-	 * any spurious prefetches past the end of the src buffer.
-	 */
-U3copy_from_user_loop2:
-	EX3(ldda [%o1 + 0x008] %asi, %f2)		! MS
-	faligndata	%f12, %f14, %f28		! FGA	Group2
-	EX3(ldda [%o1 + 0x010] %asi, %f4)		! MS
-	faligndata	%f14, %f0, %f30			! FGA	Group4	(1-cycle stall)
-	stda		%f16, [%o0] ASI_BLK_P		! MS
-	EX3(ldda [%o1 + 0x018] %asi, %f6)		! AX
-	faligndata	%f0, %f2, %f16			! FGA	Group12 (7-cycle stall)
-
-	EX3(ldda [%o1 + 0x020] %asi, %f8)		! MS
-	faligndata	%f2, %f4, %f18			! FGA	Group13
-	EX3(ldda [%o1 + 0x028] %asi, %f10)		! MS
-	faligndata	%f4, %f6, %f20			! FGA	Group14
-	EX3(ldda [%o1 + 0x030] %asi, %f12)		! MS
-	faligndata	%f6, %f8, %f22			! FGA	Group15
-	EX3(ldda [%o1 + 0x038] %asi, %f14)		! MS
-	faligndata	%f8, %f10, %f24			! FGA	Group16
-
-	EX3(ldda [%o1 + 0x040] %asi, %f0)		! AX
-	faligndata	%f10, %f12, %f26		! FGA	Group17
-	subcc		%o3, 0x01, %o3			! A0
-	add		%o1, 0x40, %o1			! A1
-	bg,pt		%xcc, U3copy_from_user_loop2	! BR
-	 add		%o0, 0x40, %o0			! A0	Group18
+
+	prefetcha	[%o1 + 0x000] %asi, #one_read
+	prefetcha	[%o1 + 0x040] %asi, #one_read
+	andn		%o2, (0x40 - 1), %o4
+	prefetcha	[%o1 + 0x080] %asi, #one_read
+	prefetcha	[%o1 + 0x0c0] %asi, #one_read
+	EX(ldda [%o1 + 0x000] %asi, %f0, add %o2, %g0)
+	prefetcha	[%o1 + 0x100] %asi, #one_read
+	EX(ldda [%o1 + 0x008] %asi, %f2, add %o2, %g0)
+	prefetcha	[%o1 + 0x140] %asi, #one_read
+	EX(ldda [%o1 + 0x010] %asi, %f4, add %o2, %g0)
+	prefetcha	[%o1 + 0x180] %asi, #one_read
+	faligndata	%f0, %f2, %f16
+	EX(ldda [%o1 + 0x018] %asi, %f6, add %o2, %g0)
+	faligndata	%f2, %f4, %f18
+	EX(ldda [%o1 + 0x020] %asi, %f8, add %o2, %g0)
+	faligndata	%f4, %f6, %f20
+	EX(ldda [%o1 + 0x028] %asi, %f10, add %o2, %g0)
+	faligndata	%f6, %f8, %f22
+
+	EX(ldda [%o1 + 0x030] %asi, %f12, add %o2, %g0)
+	faligndata	%f8, %f10, %f24
+	EX(ldda [%o1 + 0x038] %asi, %f14, add %o2, %g0)
+	faligndata	%f10, %f12, %f26
+	EX(ldda [%o1 + 0x040] %asi, %f0, add %o2, %g0)
+
+	sub		%o4, 0x80, %o4
+	add		%o1, 0x40, %o1
+	ba,pt		%xcc, loop
+	 srl		%o4, 6, %o3
+
+	.align		64
+loop:
+	EX3(ldda [%o1 + 0x008] %asi, %f2)
+	faligndata	%f12, %f14, %f28
+	EX3(ldda [%o1 + 0x010] %asi, %f4)
+	faligndata	%f14, %f0, %f30
+	stda		%f16, [%o0] ASI_BLK_P
+	EX3(ldda [%o1 + 0x018] %asi, %f6)
+	faligndata	%f0, %f2, %f16
+
+	EX3(ldda [%o1 + 0x020] %asi, %f8)
+	faligndata	%f2, %f4, %f18
+	EX3(ldda [%o1 + 0x028] %asi, %f10)
+	faligndata	%f4, %f6, %f20
+	EX3(ldda [%o1 + 0x030] %asi, %f12)
+	faligndata	%f6, %f8, %f22
+	EX3(ldda [%o1 + 0x038] %asi, %f14)
+	faligndata	%f8, %f10, %f24
+
+	EX3(ldda [%o1 + 0x040] %asi, %f0)
+	prefetcha	[%o1 + 0x180] %asi, #one_read
+	faligndata	%f10, %f12, %f26
+	subcc		%o3, 0x01, %o3
+	add		%o1, 0x40, %o1
+	bg,pt		%XCC, loop
+	 add		%o0, 0x40, %o0
 
 	/* Finally we copy the last full 64-byte block. */
-U3copy_from_user_loopfini:
-	EX3(ldda [%o1 + 0x008] %asi, %f2)		! MS
-	faligndata	%f12, %f14, %f28		! FGA
-	EX3(ldda [%o1 + 0x010] %asi, %f4)		! MS	Group19
-	faligndata	%f14, %f0, %f30			! FGA
-	stda		%f16, [%o0] ASI_BLK_P		! MS	Group20
-	EX3(ldda [%o1 + 0x018] %asi, %f6)		! AX
-	faligndata	%f0, %f2, %f16			! FGA	Group11 (7-cycle stall)
-	EX3(ldda [%o1 + 0x020] %asi, %f8)		! MS
-	faligndata	%f2, %f4, %f18			! FGA	Group12
-	EX3(ldda [%o1 + 0x028] %asi, %f10)		! MS
-	faligndata	%f4, %f6, %f20			! FGA	Group13
-	EX3(ldda [%o1 + 0x030] %asi, %f12)		! MS
-	faligndata	%f6, %f8, %f22			! FGA	Group14
-	EX3(ldda [%o1 + 0x038] %asi, %f14)		! MS
-	faligndata	%f8, %f10, %f24			! FGA	Group15
-	cmp		%g1, 0				! A0
-	be,pt		%icc, 1f			! BR
-	 add		%o0, 0x40, %o0			! A1
-	EX4(ldda [%o1 + 0x040] %asi, %f0)		! MS
-1:	faligndata	%f10, %f12, %f26		! FGA	Group16
-	faligndata	%f12, %f14, %f28		! FGA	Group17
-	faligndata	%f14, %f0, %f30			! FGA	Group18
-	stda		%f16, [%o0] ASI_BLK_P		! MS
-	add		%o0, 0x40, %o0			! A0
-	add		%o1, 0x40, %o1			! A1
-#ifdef __KERNEL__
+loopfini:
+	EX3(ldda [%o1 + 0x008] %asi, %f2)
+	faligndata	%f12, %f14, %f28
+	EX3(ldda [%o1 + 0x010] %asi, %f4)
+	faligndata	%f14, %f0, %f30
+	stda		%f16, [%o0] ASI_BLK_P
+	EX3(ldda [%o1 + 0x018] %asi, %f6)
+	faligndata	%f0, %f2, %f16
+	EX3(ldda [%o1 + 0x020] %asi, %f8)
+	faligndata	%f2, %f4, %f18
+	EX3(ldda [%o1 + 0x028] %asi, %f10)
+	faligndata	%f4, %f6, %f20
+	EX3(ldda [%o1 + 0x030] %asi, %f12)
+	faligndata	%f6, %f8, %f22
+	EX3(ldda [%o1 + 0x038] %asi, %f14)
+	faligndata	%f8, %f10, %f24
+	cmp		%g1, 0
+	be,pt		%XCC, 1f
+	 add		%o0, 0x40, %o0
+	EX4(ldda [%o1 + 0x040] %asi, %f0)
+1:	faligndata	%f10, %f12, %f26
+	faligndata	%f12, %f14, %f28
+	faligndata	%f14, %f0, %f30
+	stda		%f16, [%o0] ASI_BLK_P
+	add		%o0, 0x40, %o0
+	add		%o1, 0x40, %o1
+
 	.globl		U3copy_from_user_nop_2_3
 U3copy_from_user_nop_2_3:
 	mov		PRIMARY_CONTEXT, %o3
 	stxa		%g0, [%o3] ASI_DMMU		! Flush P-cache
 	stxa		%g3, [%g0] ASI_DCU_CONTROL_REG	! Disable P-cache
-#endif
-	membar		#Sync				! MS	Group26 (7-cycle stall)
+
+	membar		#Sync
 
 	/* Now we copy the (len modulo 64) bytes at the end.
 	 * Note how we borrow the %f0 loaded above.
 	 *
 	 * Also notice how this code is careful not to perform a
-	 * load past the end of the src buffer just like similar
-	 * code found in U3copy_from_user_toosmall processing.
+	 * load past the end of the src buffer.
 	 */
-U3copy_from_user_loopend:
-	and		%o2, 0x3f, %o2			! A0	Group
-	andcc		%o2, 0x38, %g2			! A0	Group
-	be,pn		%icc, U3copy_from_user_endcruft	! BR
-	 subcc		%g2, 0x8, %g2			! A1
-	be,pn		%icc, U3copy_from_user_endcruft	! BR	Group
-	 cmp		%g1, 0				! A0
-
-	be,a,pt		%icc, 1f			! BR	Group
-	 EX(ldda [%o1 + 0x00] %asi, %f0, add %o2, %g0)	! MS
-
-1:	EX(ldda [%o1 + 0x08] %asi, %f2, add %o2, %g0)	! MS	Group
-	add		%o1, 0x8, %o1			! A0
-	sub		%o2, 0x8, %o2			! A1
-	subcc		%g2, 0x8, %g2			! A0	Group
-	faligndata	%f0, %f2, %f8			! FGA	Group
-	std		%f8, [%o0 + 0x00]		! MS	(XXX does it stall here? XXX)
-	be,pn		%icc, U3copy_from_user_endcruft	! BR
-	 add		%o0, 0x8, %o0			! A0
-	EX(ldda [%o1 + 0x08] %asi, %f0, add %o2, %g0)	! MS	Group
-	add		%o1, 0x8, %o1			! A0
-	sub		%o2, 0x8, %o2			! A1
-	subcc		%g2, 0x8, %g2			! A0	Group
-	faligndata	%f2, %f0, %f8			! FGA
-	std		%f8, [%o0 + 0x00]		! MS	(XXX does it stall here? XXX)
-	bne,pn		%icc, 1b			! BR
-	 add		%o0, 0x8, %o0			! A0	Group
+loopend:
+	and		%o2, 0x3f, %o2
+	andcc		%o2, 0x38, %g2
+	be,pn		%XCC, endcruft
+	 subcc		%g2, 0x8, %g2
+	be,pn		%XCC, endcruft
+	 cmp		%g1, 0
+
+	be,a,pt		%XCC, 1f
+	 EX(ldda [%o1 + 0x00] %asi, %f0, add %o2, %g0)
+
+1:	EX(ldda [%o1 + 0x08] %asi, %f2, add %o2, %g0)
+	add		%o1, 0x8, %o1
+	sub		%o2, 0x8, %o2
+	subcc		%g2, 0x8, %g2
+	faligndata	%f0, %f2, %f8
+	std		%f8, [%o0 + 0x00]
+	be,pn		%XCC, endcruft
+	 add		%o0, 0x8, %o0
+	EX(ldda [%o1 + 0x08] %asi, %f0, add %o2, %g0)
+	add		%o1, 0x8, %o1
+	sub		%o2, 0x8, %o2
+	subcc		%g2, 0x8, %g2
+	faligndata	%f2, %f0, %f8
+	std		%f8, [%o0 + 0x00]
+	bne,pn		%XCC, 1b
+	 add		%o0, 0x8, %o0
 
 	/* If anything is left, we copy it one byte at a time.
 	 * Note that %g1 is (src & 0x3) saved above before the
 	 * alignaddr was performed.
 	 */
-U3copy_from_user_endcruft:
+endcruft:
 	cmp		%o2, 0
 	add		%o1, %g1, %o1
 	VISExitHalf
-	be,pn		%icc, U3copy_from_user_short_ret
-	 nop
-	ba,a,pt		%xcc, U3copy_from_user_short
+	be,pn		%XCC, out
+	 sub		%o0, %o1, %o3
 
-	/* If we get here, then 32 <= len < (6 * 64) */
-U3copy_from_user_toosmall:
-
-#ifdef SMALL_COPY_USES_FPU
-
-	/* Is 'dst' already aligned on an 8-byte boundary? */
-	be,pt		%xcc, 2f			! BR	Group
-
-	/* Compute abs((dst & 7) - 8) into %g2.  This is the number
-	 * of bytes to copy to make 'dst' 8-byte aligned.  We pre-
-	 * subtract this from 'len'.
-	 */
-	 sub		%g2, 0x8, %g2			! A0
-	sub		%g0, %g2, %g2			! A0	Group (reg-dep)
-	sub		%o2, %g2, %o2			! A0	Group (reg-dep)
-
-	/* Copy %g2 bytes from src to dst, one byte at a time. */
-1:	EXNV(lduba [%o1 + 0x00] %asi, %o3, add %o2, %g2)! MS	(Group) (%o3 in 3 cycles)
-	add		%o1, 0x1, %o1			! A1
-	add		%o0, 0x1, %o0			! A0	Group
-	subcc		%g2, 0x1, %g2			! A1
-
-	bg,pt		%icc, 1b			! BR	Group
-	 stb		%o3, [%o0 + -1]			! MS	Group
-
-2:	VISEntryHalf					! MS+MS
-
-	/* Compute (len - (len % 8)) into %g2.  This is guaranteed
-	 * to be nonzero.
-	 */
-	andn		%o2, 0x7, %g2			! A0	Group
-
-	/* You may read this and believe that it allows reading
-	 * one 8-byte longword past the end of src.  It actually
-	 * does not, as %g2 is subtracted as loads are done from
-	 * src, so we always stop before running off the end.
-	 * Also, we are guaranteed to have at least 0x10 bytes
-	 * to move here.
-	 */
-	sub		%g2, 0x8, %g2			! A0	Group (reg-dep)
-	alignaddr	%o1, %g0, %g1			! MS	      (Break-after)
-	EX(ldda [%g1 + 0x00] %asi, %f0, add %o2, %g0)	! MS	Group (1-cycle stall)
-	add		%g1, 0x8, %g1			! A0
-
-1:	EX(ldda [%g1 + 0x00] %asi, %f2, add %o2, %g0)	! MS	Group
-	add		%g1, 0x8, %g1			! A0
-	sub		%o2, 0x8, %o2			! A1
-	subcc		%g2, 0x8, %g2			! A0	Group
-
-	faligndata	%f0, %f2, %f8			! FGA	Group (1-cycle stall)
-	std		%f8, [%o0 + 0x00]		! MS	Group (2-cycle stall)
-	add		%o1, 0x8, %o1			! A0
-	be,pn		%icc, 2f			! BR
-
-	 add		%o0, 0x8, %o0			! A1
-	EX(ldda [%g1 + 0x00] %asi, %f0, add %o2, %g0)	! MS	Group
-	add		%g1, 0x8, %g1			! A0
-	sub		%o2, 0x8, %o2			! A1
-
-	subcc		%g2, 0x8, %g2			! A0	Group
-	faligndata	%f2, %f0, %f8			! FGA	Group (1-cycle stall)
-	std		%f8, [%o0 + 0x00]		! MS	Group (2-cycle stall)
-	add		%o1, 0x8, %o1			! A0
-
-	bne,pn		%icc, 1b			! BR
-	 add		%o0, 0x8, %o0			! A1
-
-	/* Nothing left to copy? */
-2:	cmp		%o2, 0				! A0	Group
-	VISExitHalf					! A0+MS
-	be,pn		%icc, U3copy_from_user_short_ret! BR	Group
-	 nop						! A0
-	ba,a,pt		%xcc, U3copy_from_user_short	! BR	Group
-
-#else /* !(SMALL_COPY_USES_FPU) */
-
-	xor		%o1, %o0, %g2
-	andcc		%g2, 0x7, %g0
-	bne,pn		%icc, U3copy_from_user_short
-	 andcc		%o1, 0x7, %g2
+	andcc		%g1, 0x7, %g0
+	bne,pn		%icc, small_copy_unaligned
+	 andcc		%o2, 0x8, %g0
+	be,pt		%icc, 1f
+	 nop
+	EXNV(ldxa [%o1] %asi, %o5, add %o2, %g0)
+	stx		%o5, [%o1 + %o3]
+	add		%o1, 0x8, %o1
 
-	be,pt		%xcc, 2f
-	 sub		%g2, 0x8, %g2
-	sub		%g0, %g2, %g2
-	sub		%o2, %g2, %o2
+1:	andcc		%o2, 0x4, %g0
+	be,pt		%icc, 1f
+	 nop
+	EXNV(lduwa [%o1] %asi, %o5, and %o2, 0x7)
+	stw		%o5, [%o1 + %o3]
+	add		%o1, 0x4, %o1
 
-1:	EXNV(lduba [%o1 + 0x00] %asi, %o3, add %o2, %g2)
-	add		%o1, 0x1, %o1
-	add		%o0, 0x1, %o0
-	subcc		%g2, 0x1, %g2
-	bg,pt		%icc, 1b
-	 stb		%o3, [%o0 + -1]
+1:	andcc		%o2, 0x2, %g0
+	be,pt		%icc, 1f
+	 nop
+	EXNV(lduha [%o1] %asi, %o5, and %o2, 0x3)
+	sth		%o5, [%o1 + %o3]
+	add		%o1, 0x2, %o1
 
-2:	andn		%o2, 0x7, %g2
-	sub		%o2, %g2, %o2
+1:	andcc		%o2, 0x1, %g0
+	be,pt		%icc, out
+	 nop
+	EXNV(lduba [%o1] %asi, %o5, and %o2, 0x1)
+	ba,pt		%xcc, out
+	 stb		%o5, [%o1 + %o3]
+
+medium_copy: /* 16 < len <= 64 */
+	bne,pn		%XCC, small_copy_unaligned
+	 sub		%o0, %o1, %o3
+
+medium_copy_aligned:
+	andn		%o2, 0x7, %o4
+	and		%o2, 0x7, %o2
+1:	subcc		%o4, 0x8, %o4
+	EXNV8(ldxa [%o1] %asi, %o5, add %o2, %o4)
+	stx		%o5, [%o1 + %o3]
+	bgu,pt		%XCC, 1b
+	 add		%o1, 0x8, %o1
+	andcc		%o2, 0x4, %g0
+	be,pt		%XCC, 1f
+	 nop
+	sub		%o2, 0x4, %o2
+	EXNV4(lduwa [%o1] %asi, %o5, add %o2, %g0)
+	stw		%o5, [%o1 + %o3]
+	add		%o1, 0x4, %o1
+1:	cmp		%o2, 0
+	be,pt		%XCC, out
+	 nop
+	ba,pt		%xcc, small_copy_unaligned
+	 nop
 
-3:	EXNV(ldxa [%o1 + 0x00] %asi, %o3, add %o2, %g2)
-	add		%o1, 0x8, %o1
-	add		%o0, 0x8, %o0
-	subcc		%g2, 0x8, %g2
-	bg,pt		%icc, 3b
-	 stx		%o3, [%o0 + -8]
+small_copy: /* 0 < len <= 16 */
+	andcc		%o3, 0x3, %g0
+	bne,pn		%XCC, small_copy_unaligned
+	 sub		%o0, %o1, %o3
+
+small_copy_aligned:
+	subcc		%o2, 4, %o2
+	EXNV(lduwa [%o1] %asi, %g1, add %o2, %g0)
+	stw		%g1, [%o1 + %o3]
+	bgu,pt		%XCC, small_copy_aligned
+	 add		%o1, 4, %o1
 
-	cmp		%o2, 0
-	bne,pn		%icc, U3copy_from_user_short
-	 nop
-	ba,a,pt		%xcc, U3copy_from_user_short_ret
+out:	retl
+	 clr		%o0
 
-#endif /* !(SMALL_COPY_USES_FPU) */
+	.align	32
+small_copy_unaligned:
+	subcc		%o2, 1, %o2
+	EXNV(lduba [%o1] %asi, %g1, add %o2, %g0)
+	stb		%g1, [%o1 + %o3]
+	bgu,pt		%XCC, small_copy_unaligned
+	 add		%o1, 1, %o1
+	retl
+	 clr		%o0
 
-#ifdef __KERNEL__
-	.globl		U3cfu_fixup
 U3cfu_fixup:
 	/* Since this is copy_from_user(), zero out the rest of the
 	 * kernel buffer.
@@ -516,4 +428,3 @@
 
 2:	retl
 	 mov		%o1, %o0
-#endif
diff -urN linux-2.6.8-rc2/arch/sparc64/lib/U3copy_in_user.S linux-2.6.8-rc3/arch/sparc64/lib/U3copy_in_user.S
--- linux-2.6.8-rc2/arch/sparc64/lib/U3copy_in_user.S	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/lib/U3copy_in_user.S	2004-08-03 15:21:35.558678665 -0700
@@ -1,13 +1,15 @@
-/* $Id: U3copy_in_user.S,v 1.4 2001/03/21 05:58:47 davem Exp $
- * U3memcpy.S: UltraSparc-III optimized copy within userspace.
+/* U3copy_in_user.S: UltraSparc-III optimized memcpy.
  *
- * Copyright (C) 1999, 2000 David S. Miller (davem@redhat.com)
+ * Copyright (C) 1999, 2000, 2004 David S. Miller (davem@redhat.com)
  */
 
-#ifdef __KERNEL__
 #include <asm/visasm.h>
 #include <asm/asi.h>
-#undef SMALL_COPY_USES_FPU
+#include <asm/dcu.h>
+#include <asm/spitfire.h>
+
+#define XCC xcc
+
 #define EXNV(x,y,a,b)	\
 98:	x,y;				\
 	.section .fixup;		\
@@ -19,7 +21,7 @@
 	.word 98b, 99b;			\
 	.text;				\
 	.align 4;
-#define EXNV2(x,y,a,b)	\
+#define EXNV1(x,y,a,b)			\
 98:	x,y;				\
 	.section .fixup;		\
 	.align 4;			\
@@ -31,501 +33,108 @@
 	.word 98b, 99b;			\
 	.text;				\
 	.align 4;
-#define EXNV3(x,y,a,b)	\
+#define EXNV4(x,y,a,b)			\
 98:	x,y;				\
 	.section .fixup;		\
 	.align 4;			\
 99:	a, b, %o0;			\
 	retl;				\
-	 add %o0, 8, %o0;		\
-	.section __ex_table;		\
-	.align 4;			\
-	.word 98b, 99b;			\
-	.text;				\
-	.align 4;
-#define EX(x,y,a,b)			\
-98:	x,y;				\
-	.section .fixup;		\
-	.align 4;			\
-99:	VISExitHalf;			\
-	retl;				\
-	 a, b, %o0;			\
-	.section __ex_table;		\
-	.align 4;			\
-	.word 98b, 99b;			\
-	.text;				\
-	.align 4;
-#define EXBLK1(x,y)			\
-98:	x,y;				\
-	.section .fixup;		\
-	.align 4;			\
-99:	VISExitHalf;			\
-	add %o4, 0x1c0, %o1;		\
-	and %o2, (0x40 - 1), %o2;	\
-	retl;				\
-	 add %o1, %o2, %o0;		\
-	.section __ex_table;		\
-	.align 4;			\
-	.word 98b, 99b;			\
-	.text;				\
-	.align 4;
-#define EXBLK2(x,y)			\
-98:	x,y;				\
-	.section .fixup;		\
-	.align 4;			\
-99:	VISExitHalf;			\
-	sll %o3, 6, %o3;		\
-	and %o2, (0x40 - 1), %o2;	\
-	add %o3, 0x80, %o1;		\
-	retl;				\
-	 add %o1, %o2, %o0;		\
-	.section __ex_table;		\
-	.align 4;			\
-	.word 98b, 99b;			\
-	.text;				\
-	.align 4;
-#define EXBLK3(x,y)			\
-98:	x,y;				\
-	.section .fixup;		\
-	.align 4;			\
-99:	VISExitHalf;			\
-	and %o2, (0x40 - 1), %o2;	\
-	retl;				\
-	 add %o2, 0x80, %o0;		\
+	 add %o0, 4, %o0;		\
 	.section __ex_table;		\
 	.align 4;			\
 	.word 98b, 99b;			\
 	.text;				\
 	.align 4;
-#define EXBLK4(x,y)			\
+#define EXNV8(x,y,a,b)			\
 98:	x,y;				\
 	.section .fixup;		\
 	.align 4;			\
-99:	VISExitHalf;			\
-	and %o2, (0x40 - 1), %o2;	\
+99:	a, b, %o0;			\
 	retl;				\
-	 add %o2, 0x40, %o0;		\
+	 add %o0, 8, %o0;		\
 	.section __ex_table;		\
 	.align 4;			\
 	.word 98b, 99b;			\
 	.text;				\
 	.align 4;
-#else
-#define ASI_AIUS 0x80
-#define ASI_BLK_AIUS 0xf0
-#define FPRS_FEF  0x04
-#define VISEntryHalf rd %fprs, %o5; wr %g0, FPRS_FEF, %fprs
-#define VISExitHalf and %o5, FPRS_FEF, %o5; wr %o5, 0x0, %fprs
-#define SMALL_COPY_USES_FPU
-#define EXNV(x,y,a,b)	x,y;
-#define EXNV2(x,y,a,b)	x,y;
-#define EXNV3(x,y,a,b)	x,y;
-#define EX(x,y,a,b)	x,y;
-#define EXBLK1(x,y)	x,y;
-#define EXBLK2(x,y)	x,y;
-#define EXBLK3(x,y)	x,y;
-#define EXBLK4(x,y)	x,y;
-#endif
-
-	/* Special/non-trivial issues of this code:
-	 *
-	 * 1) %o5 is preserved from VISEntryHalf to VISExitHalf
-	 * 2) Only low 32 FPU registers are used so that only the
-	 *    lower half of the FPU register set is dirtied by this
-	 *    code.  This is especially important in the kernel.
-	 * 3) This code never prefetches cachelines past the end
-	 *    of the source buffer.
-	 *
-	 *    XXX Actually, Cheetah can buffer up to 8 concurrent
-	 *    XXX prefetches, revisit this...
-	 */
+
+	.register	%g2,#scratch
+	.register	%g3,#scratch
 
 	.text
 	.align	32
 
-	/* The cheetah's flexible spine, oversized liver, enlarged heart,
-	 * slender muscular body, and claws make it the swiftest hunter
-	 * in Africa and the fastest animal on land.  Can reach speeds
-	 * of up to 2.4GB per second.
+	/* Don't try to get too fancy here, just nice and
+	 * simple.  This is predominantly used for well aligned
+	 * small copies in the compat layer.  It is also used
+	 * to copy register windows around during thread cloning.
 	 */
 
-	.globl		U3copy_in_user
-U3copy_in_user: /* %o0=dst, %o1=src, %o2=len */
+	.globl	U3copy_in_user
+U3copy_in_user:	/* %o0=dst, %o1=src, %o2=len */
 	/* Writing to %asi is _expensive_ so we hardcode it.
 	 * Reading %asi to check for KERNEL_DS is comparatively
 	 * cheap.
 	 */
-	rd		%asi, %g1			! MS	Group	(4 cycles)
-	cmp		%g1, ASI_AIUS			! A0	Group
-	bne		U3memcpy			! BR
-	 nop						! A1
-#ifndef __KERNEL__
-	/* Save away original 'dst' for memcpy return value. */
-	mov		%o0, %g3			! A0	Group
-#endif
-	/* Anything to copy at all? */
-	cmp		%o2, 0				! A1
-	ble,pn		%icc, U3copy_in_user_short_ret	! BR
-
-	/* Extremely small copy? */
-	 cmp		%o2, 31				! A0	Group
-	ble,pn		%icc, U3copy_in_user_short	! BR
-
-	/* Large enough to use unrolled prefetch loops? */
-	 cmp		%o2, 0x100			! A1
-	bge,a,pt	%icc, U3copy_in_user_enter	! BR	Group
-	 andcc		%o0, 0x3f, %g2			! A0
-
-	ba,pt		%xcc, U3copy_in_user_toosmall	! BR	Group
-	 andcc		%o0, 0x7, %g2			! A0
-
-	.align		32
-U3copy_in_user_short:
-	/* Copy %o2 bytes from src to dst, one byte at a time. */
-	EXNV(lduba [%o1 + 0x00] %asi, %o3, add %o2, %g0)! MS	Group
-	add		%o1, 0x1, %o1			! A0
-	add		%o0, 0x1, %o0			! A1
-	subcc		%o2, 1, %o2			! A0	Group
-
-	bg,pt		%icc, U3copy_in_user_short	! BR
-	 EXNV(stba %o3, [%o0 + -1] %asi, add %o2, 1)	! MS	Group (1-cycle stall)
-
-U3copy_in_user_short_ret:
-#ifdef __KERNEL__
-	retl						! BR	Group (0-4 cycle stall)
-	 clr		%o0				! A0
-#else
-	retl						! BR	Group (0-4 cycle stall)
-	 mov		%g3, %o0			! A0
-#endif
+	rd		%asi, %g1
+	cmp		%g1, ASI_AIUS
+	bne,pn		%icc, U3memcpy_user_stub
+	 nop
 
-	/* Here len >= (6 * 64) and condition codes reflect execution
-	 * of "andcc %o0, 0x7, %g2", done by caller.
-	 */
-	.align		64
-U3copy_in_user_enter:
-	/* Is 'dst' already aligned on an 64-byte boundary? */
-	be,pt		%xcc, 2f			! BR
-
-	/* Compute abs((dst & 0x3f) - 0x40) into %g2.  This is the number
-	 * of bytes to copy to make 'dst' 64-byte aligned.  We pre-
-	 * subtract this from 'len'.
-	 */
-	 sub		%g2, 0x40, %g2			! A0	Group
-	sub		%g0, %g2, %g2			! A0	Group
-	sub		%o2, %g2, %o2			! A0	Group
-
-	/* Copy %g2 bytes from src to dst, one byte at a time. */
-1:	EXNV(lduba [%o1 + 0x00] %asi, %o3, add %o2, %g2)! MS	(Group)
-	add		%o1, 0x1, %o1			! A1
-	add		%o0, 0x1, %o0			! A0	Group
-	subcc		%g2, 0x1, %g2			! A1
-
-	bg,pt		%icc, 1b			! BR	Group
-	 EXNV2(stba %o3, [%o0 + -1] %asi, add %o2, %g2)	! MS	Group
-
-2:	VISEntryHalf					! MS+MS
-	and		%o1, 0x7, %g1			! A1
-	ba,pt		%xcc, U3copy_in_user_begin	! BR
-	 alignaddr	%o1, %g0, %o1			! MS	      (Break-after)
-
-	.align		64
-U3copy_in_user_begin:
-	prefetcha	[%o1 + 0x000] %asi, #one_read	! MS	Group1
-	prefetcha	[%o1 + 0x040] %asi, #one_read	! MS	Group2
-	andn		%o2, (0x40 - 1), %o4		! A0
-	prefetcha	[%o1 + 0x080] %asi, #one_read	! MS	Group3
-	cmp		%o4, 0x140			! A0
-	prefetcha	[%o1 + 0x0c0] %asi, #one_read	! MS	Group4
-	EX(ldda [%o1 + 0x000] %asi, %f0, add %o2, %g0)	! MS	Group5 (%f0 results at G8)
-	bge,a,pt	%icc, 1f			! BR
-
-	 prefetcha	[%o1 + 0x100] %asi, #one_read	! MS	Group6
-1:	EX(ldda [%o1 + 0x008] %asi, %f2, add %o2, %g0)	! AX	       (%f2 results at G9)
-	cmp		%o4, 0x180			! A1
-	bge,a,pt	%icc, 1f			! BR
-	 prefetcha	[%o1 + 0x140] %asi, #one_read	! MS	Group7
-1:	EX(ldda [%o1 + 0x010] %asi, %f4, add %o2, %g0)	! AX	       (%f4 results at G10)
-	cmp		%o4, 0x1c0			! A1
-	bge,a,pt	%icc, 1f			! BR
-
-	 prefetcha	[%o1 + 0x180] %asi, #one_read	! MS	Group8
-1:	faligndata	%f0, %f2, %f16			! FGA	Group9 (%f16 at G12)
-	EX(ldda [%o1 + 0x018] %asi, %f6, add %o2, %g0)	! AX	       (%f6 results at G12)
-	faligndata	%f2, %f4, %f18			! FGA	Group10 (%f18 results at G13)
-	EX(ldda [%o1 + 0x020] %asi, %f8, add %o2, %g0)	! MS	        (%f8 results at G13)
-	faligndata	%f4, %f6, %f20			! FGA	Group12	(1-cycle stall,%f20 at G15)
-	EX(ldda [%o1 + 0x028] %asi, %f10, add %o2, %g0)	! MS		(%f10 results at G15)
-	faligndata	%f6, %f8, %f22			! FGA	Group13 (%f22 results at G16)
-	
-	EX(ldda [%o1 + 0x030] %asi, %f12, add %o2, %g0)	! MS		(%f12 results at G16)
-	faligndata	%f8, %f10, %f24			! FGA	Group15 (1-cycle stall,%f24 at G18)
-	EX(ldda [%o1 + 0x038] %asi, %f14, add %o2, %g0)	! MS		(%f14 results at G18)
-	faligndata	%f10, %f12, %f26		! FGA	Group16 (%f26 results at G19)
-	EX(ldda [%o1 + 0x040] %asi, %f0, add %o2, %g0)	! MS		(%f0 results at G19)
-
-	/* We only use the first loop if len > (7 * 64). */
-	subcc		%o4, 0x1c0, %o4			! A0	Group17
-	bg,pt		%icc, U3copy_in_user_loop1	! BR
-	 add		%o1, 0x40, %o1			! A1
-
-	add		%o4, 0x140, %o4			! A0	Group18
-	ba,pt		%xcc, U3copy_in_user_loop2	! BR
-	 srl		%o4, 6, %o3			! A0	Group19
-	nop
-	nop
-	nop
-	nop
-	nop
-
-	nop
-	nop
-
-	/* This loop performs the copy and queues new prefetches.
-	 * We drop into the second loop when len <= (5 * 64).  Note
-	 * that this (5 * 64) factor has been subtracted from len
-	 * already.
-	 */
-U3copy_in_user_loop1:
-	EXBLK1(ldda [%o1 + 0x008] %asi, %f2)		! MS	Group2	(%f2 results at G5)
-	faligndata	%f12, %f14, %f28		! FGA		(%f28 results at G5)
-	EXBLK1(ldda [%o1 + 0x010] %asi, %f4)		! MS	Group3	(%f4 results at G6)
-	faligndata	%f14, %f0, %f30			! FGA	Group4	(1-cycle stall, %f30 at G7)
-	EXBLK1(stda %f16, [%o0] ASI_BLK_AIUS)		! MS
-	EXBLK1(ldda [%o1 + 0x018] %asi, %f6)		! AX		(%f6 results at G7)
-
-	faligndata	%f0, %f2, %f16			! FGA	Group12 (7-cycle stall)
-	EXBLK1(ldda [%o1 + 0x020] %asi, %f8)		! MS	        (%f8 results at G15)
-	faligndata	%f2, %f4, %f18			! FGA	Group13	(%f18 results at G16)
-	EXBLK1(ldda [%o1 + 0x028] %asi, %f10)		! MS		(%f10 results at G16)
-	faligndata	%f4, %f6, %f20			! FGA	Group14	(%f20 results at G17)
-	EXBLK1(ldda [%o1 + 0x030] %asi, %f12)		! MS		(%f12 results at G17)
-	faligndata	%f6, %f8, %f22			! FGA	Group15	(%f22 results at G18)
-	EXBLK1(ldda [%o1 + 0x038] %asi, %f14)		! MS		(%f14 results at G18)
-
-	faligndata	%f8, %f10, %f24			! FGA	Group16	(%f24 results at G19)
-	EXBLK1(ldda [%o1 + 0x040] %asi, %f0)		! AX		(%f0 results at G19)
-	prefetcha	[%o1 + 0x180] %asi, #one_read	! MS
-	faligndata	%f10, %f12, %f26		! FGA	Group17	(%f26 results at G20)
-	subcc		%o4, 0x40, %o4			! A0
-	add		%o1, 0x40, %o1			! A1
-	bg,pt		%xcc, U3copy_in_user_loop1		! BR
-	 add		%o0, 0x40, %o0			! A0	Group18
-
-U3copy_in_user_loop2_enter:
-	mov		5, %o3				! A1
-
-	/* This loop performs on the copy, no new prefetches are
-	 * queued.  We do things this way so that we do not perform
-	 * any spurious prefetches past the end of the src buffer.
-	 */
-U3copy_in_user_loop2:
-	EXBLK2(ldda [%o1 + 0x008] %asi, %f2)		! MS
-	faligndata	%f12, %f14, %f28		! FGA	Group2
-	EXBLK2(ldda [%o1 + 0x010] %asi, %f4)		! MS
-	faligndata	%f14, %f0, %f30			! FGA	Group4	(1-cycle stall)
-	EXBLK2(stda %f16, [%o0] ASI_BLK_AIUS)		! MS
-	EXBLK2(ldda [%o1 + 0x018] %asi, %f6)		! AX
-	faligndata	%f0, %f2, %f16			! FGA	Group12 (7-cycle stall)
-
-	EXBLK2(ldda [%o1 + 0x020] %asi, %f8)		! MS
-	faligndata	%f2, %f4, %f18			! FGA	Group13
-	EXBLK2(ldda [%o1 + 0x028] %asi, %f10)		! MS
-	faligndata	%f4, %f6, %f20			! FGA	Group14
-	EXBLK2(ldda [%o1 + 0x030] %asi, %f12)		! MS
-	faligndata	%f6, %f8, %f22			! FGA	Group15
-	EXBLK2(ldda [%o1 + 0x038] %asi, %f14)		! MS
-	faligndata	%f8, %f10, %f24			! FGA	Group16
-
-	EXBLK2(ldda [%o1 + 0x040] %asi, %f0)		! AX
-	faligndata	%f10, %f12, %f26		! FGA	Group17
-	subcc		%o3, 0x01, %o3			! A0
-	add		%o1, 0x40, %o1			! A1
-	bg,pt		%xcc, U3copy_in_user_loop2	! BR
-	 add		%o0, 0x40, %o0			! A0	Group18
-
-	/* Finally we copy the last full 64-byte block. */
-U3copy_in_user_loopfini:
-	EXBLK3(ldda [%o1 + 0x008] %asi, %f2)		! MS
-	faligndata	%f12, %f14, %f28		! FGA
-	EXBLK3(ldda [%o1 + 0x010] %asi, %f4)		! MS	Group19
-	faligndata	%f14, %f0, %f30			! FGA
-	EXBLK3(stda %f16, [%o0] ASI_BLK_AIUS)		! MS	Group20
-	EXBLK4(ldda [%o1 + 0x018] %asi, %f6)		! AX
-	faligndata	%f0, %f2, %f16			! FGA	Group11 (7-cycle stall)
-	EXBLK4(ldda [%o1 + 0x020] %asi, %f8)		! MS
-	faligndata	%f2, %f4, %f18			! FGA	Group12
-	EXBLK4(ldda [%o1 + 0x028] %asi, %f10)		! MS
-	faligndata	%f4, %f6, %f20			! FGA	Group13
-	EXBLK4(ldda [%o1 + 0x030] %asi, %f12)		! MS
-	faligndata	%f6, %f8, %f22			! FGA	Group14
-	EXBLK4(ldda [%o1 + 0x038] %asi, %f14)		! MS
-	faligndata	%f8, %f10, %f24			! FGA	Group15
-	cmp		%g1, 0				! A0
-	be,pt		%icc, 1f			! BR
-	 add		%o0, 0x40, %o0			! A1
-	EXBLK4(ldda [%o1 + 0x040] %asi, %f0)		! MS
-1:	faligndata	%f10, %f12, %f26		! FGA	Group16
-	faligndata	%f12, %f14, %f28		! FGA	Group17
-	faligndata	%f14, %f0, %f30			! FGA	Group18
-	EXBLK4(stda %f16, [%o0] ASI_BLK_AIUS)		! MS
-	add		%o0, 0x40, %o0			! A0
-	add		%o1, 0x40, %o1			! A1
-	membar		#Sync				! MS	Group26 (7-cycle stall)
-
-	/* Now we copy the (len modulo 64) bytes at the end.
-	 * Note how we borrow the %f0 loaded above.
-	 *
-	 * Also notice how this code is careful not to perform a
-	 * load past the end of the src buffer just like similar
-	 * code found in U3copy_in_user_toosmall processing.
-	 */
-U3copy_in_user_loopend:
-	and		%o2, 0x3f, %o2			! A0	Group
-	andcc		%o2, 0x38, %g2			! A0	Group
-	be,pn		%icc, U3copy_in_user_endcruft	! BR
-	 subcc		%g2, 0x8, %g2			! A1
-	be,pn		%icc, U3copy_in_user_endcruft	! BR	Group
-	 cmp		%g1, 0				! A0
-
-	be,a,pt		%icc, 1f			! BR	Group
-	 EX(ldda [%o1 + 0x00] %asi, %f0, add %o2, %g0)	! MS
-
-1:	EX(ldda [%o1 + 0x08] %asi, %f2, add %o2, %g0)	! MS	Group
-	add		%o1, 0x8, %o1			! A0
-	sub		%o2, 0x8, %o2			! A1
-	subcc		%g2, 0x8, %g2			! A0	Group
-	faligndata	%f0, %f2, %f8			! FGA	Group
-	EX(stda %f8, [%o0 + 0x00] %asi, add %o2, 0x8)	! MS	(XXX does it stall here? XXX)
-	be,pn		%icc, U3copy_in_user_endcruft	! BR
-	 add		%o0, 0x8, %o0			! A0
-	EX(ldda [%o1 + 0x08] %asi, %f0, add %o2, %g0)	! MS	Group
-	add		%o1, 0x8, %o1			! A0
-	sub		%o2, 0x8, %o2			! A1
-	subcc		%g2, 0x8, %g2			! A0	Group
-	faligndata	%f2, %f0, %f8			! FGA
-	EX(stda %f8, [%o0 + 0x00] %asi, add %o2, 0x8)	! MS	(XXX does it stall here? XXX)
-	bne,pn		%icc, 1b			! BR
-	 add		%o0, 0x8, %o0			! A0	Group
-
-	/* If anything is left, we copy it one byte at a time.
-	 * Note that %g1 is (src & 0x3) saved above before the
-	 * alignaddr was performed.
-	 */
-U3copy_in_user_endcruft:
 	cmp		%o2, 0
-	add		%o1, %g1, %o1
-	VISExitHalf
-	be,pn		%icc, U3copy_in_user_short_ret
+	be,pn		%XCC, out
+	 or		%o0, %o1, %o3
+	cmp		%o2, 16
+	bleu,a,pn	%XCC, small_copy
+	 or		%o3, %o2, %o3
+
+medium_copy: /* 16 < len <= 64 */
+	andcc		%o3, 0x7, %g0
+	bne,pn		%XCC, small_copy_unaligned
+	 sub		%o0, %o1, %o3
+
+medium_copy_aligned:
+	andn		%o2, 0x7, %o4
+	and		%o2, 0x7, %o2
+1:	subcc		%o4, 0x8, %o4
+	EXNV8(ldxa [%o1] %asi, %o5, add %o4, %o2)
+	EXNV8(stxa %o5, [%o1 + %o3] ASI_AIUS, add %o4, %o2)
+	bgu,pt		%XCC, 1b
+	 add		%o1, 0x8, %o1
+	andcc		%o2, 0x4, %g0
+	be,pt		%XCC, 1f
+	 nop
+	sub		%o2, 0x4, %o2
+	EXNV4(lduwa [%o1] %asi, %o5, add %o4, %o2)
+	EXNV4(stwa %o5, [%o1 + %o3] ASI_AIUS, add %o4, %o2)
+	add		%o1, 0x4, %o1
+1:	cmp		%o2, 0
+	be,pt		%XCC, out
+	 nop
+	ba,pt		%xcc, small_copy_unaligned
 	 nop
-	ba,a,pt		%xcc, U3copy_in_user_short
-
-	/* If we get here, then 32 <= len < (6 * 64) */
-U3copy_in_user_toosmall:
-
-#ifdef SMALL_COPY_USES_FPU
-
-	/* Is 'dst' already aligned on an 8-byte boundary? */
-	be,pt		%xcc, 2f			! BR	Group
-
-	/* Compute abs((dst & 7) - 8) into %g2.  This is the number
-	 * of bytes to copy to make 'dst' 8-byte aligned.  We pre-
-	 * subtract this from 'len'.
-	 */
-	 sub		%g2, 0x8, %g2			! A0
-	sub		%g0, %g2, %g2			! A0	Group (reg-dep)
-	sub		%o2, %g2, %o2			! A0	Group (reg-dep)
-
-	/* Copy %g2 bytes from src to dst, one byte at a time. */
-1:	EXNV2(lduba [%o1 + 0x00] %asi, %o3, add %o2, %g2)! MS	(Group) (%o3 in 3 cycles)
-	add		%o1, 0x1, %o1			! A1
-	add		%o0, 0x1, %o0			! A0	Group
-	subcc		%g2, 0x1, %g2			! A1
-
-	bg,pt		%icc, 1b			! BR	Group
-	 EXNV2(stba %o3, [%o0 + -1] %asi, add %o2, %g2)	! MS	Group
-
-2:	VISEntryHalf					! MS+MS
-
-	/* Compute (len - (len % 8)) into %g2.  This is guaranteed
-	 * to be nonzero.
-	 */
-	andn		%o2, 0x7, %g2			! A0	Group
 
-	/* You may read this and believe that it allows reading
-	 * one 8-byte longword past the end of src.  It actually
-	 * does not, as %g2 is subtracted as loads are done from
-	 * src, so we always stop before running off the end.
-	 * Also, we are guaranteed to have at least 0x10 bytes
-	 * to move here.
-	 */
-	sub		%g2, 0x8, %g2			! A0	Group (reg-dep)
-	alignaddr	%o1, %g0, %g1			! MS	      (Break-after)
-	EX(ldda [%g1 + 0x00] %asi, %f0, add %o2, %g0)	! MS	Group (1-cycle stall)
-	add		%g1, 0x8, %g1			! A0
-
-1:	EX(ldda [%g1 + 0x00] %asi, %f2, add %o2, %g0)	! MS	Group
-	add		%g1, 0x8, %g1			! A0
-	sub		%o2, 0x8, %o2			! A1
-	subcc		%g2, 0x8, %g2			! A0	Group
-
-	faligndata	%f0, %f2, %f8			! FGA	Group (1-cycle stall)
-	EX(stda %f8, [%o0 + 0x00] %asi, add %o2, 0x8)	! MS	Group (2-cycle stall)
-	add		%o1, 0x8, %o1			! A0
-	be,pn		%icc, 2f			! BR
-
-	 add		%o0, 0x8, %o0			! A1
-	EX(ldda [%g1 + 0x00] %asi, %f0, add %o2, %g0)	! MS	Group
-	add		%g1, 0x8, %g1			! A0
-	sub		%o2, 0x8, %o2			! A1
-
-	subcc		%g2, 0x8, %g2			! A0	Group
-	faligndata	%f2, %f0, %f8			! FGA	Group (1-cycle stall)
-	EX(stda %f8, [%o0 + 0x00] %asi, add %o2, 0x8)	! MS	Group (2-cycle stall)
-	add		%o1, 0x8, %o1			! A0
-
-	bne,pn		%icc, 1b			! BR
-	 add		%o0, 0x8, %o0			! A1
-
-	/* Nothing left to copy? */
-2:	cmp		%o2, 0				! A0	Group
-	VISExitHalf					! A0+MS
-	be,pn		%icc, U3copy_in_user_short_ret	! BR	Group
-	 nop						! A0
-	ba,a,pt		%xcc, U3copy_in_user_short	! BR	Group
-
-#else /* !(SMALL_COPY_USES_FPU) */
-
-	xor		%o1, %o0, %g2
-	andcc		%g2, 0x7, %g0
-	bne,pn		%icc, U3copy_in_user_short
-	 andcc		%o1, 0x7, %g2
-
-	be,pt		%xcc, 2f
-	 sub		%g2, 0x8, %g2
-	sub		%g0, %g2, %g2
-	sub		%o2, %g2, %o2
-
-1:	EXNV2(lduba [%o1 + 0x00] %asi, %o3, add %o2, %g2)
-	add		%o1, 0x1, %o1
-	add		%o0, 0x1, %o0
-	subcc		%g2, 0x1, %g2
-	bg,pt		%icc, 1b
-	 EXNV2(stba %o3, [%o0 + -1] %asi, add %o2, %g2)
-
-2:	andn		%o2, 0x7, %g2
-	sub		%o2, %g2, %o2
-
-3:	EXNV3(ldxa [%o1 + 0x00] %asi, %o3, add %o2, %g2)
-	add		%o1, 0x8, %o1
-	add		%o0, 0x8, %o0
-	subcc		%g2, 0x8, %g2
-	bg,pt		%icc, 3b
-	 EXNV3(stxa %o3, [%o0 + -8] %asi, add %o2, %g2)
+small_copy: /* 0 < len <= 16 */
+	andcc		%o3, 0x3, %g0
+	bne,pn		%XCC, small_copy_unaligned
+	 sub		%o0, %o1, %o3
+
+small_copy_aligned:
+	subcc		%o2, 4, %o2
+	EXNV4(lduwa [%o1] %asi, %g1, add %o2, %g0)
+	EXNV4(stwa %g1, [%o1 + %o3] ASI_AIUS, add %o2, %g0)
+	bgu,pt		%XCC, small_copy_aligned
+	 add		%o1, 4, %o1
 
-	cmp		%o2, 0
-	bne,pn		%icc, U3copy_in_user_short
-	 nop
-	ba,a,pt		%xcc, U3copy_in_user_short_ret
+out:	retl
+	 clr		%o0
 
-#endif /* !(SMALL_COPY_USES_FPU) */
+	.align	32
+small_copy_unaligned:
+	subcc		%o2, 1, %o2
+	EXNV1(lduba [%o1] %asi, %g1, add %o2, %g0)
+	EXNV1(stba %g1, [%o1 + %o3] ASI_AIUS, add %o2, %g0)
+	bgu,pt		%XCC, small_copy_unaligned
+	 add		%o1, 1, %o1
+	retl
+	 clr		%o0
diff -urN linux-2.6.8-rc2/arch/sparc64/lib/U3copy_to_user.S linux-2.6.8-rc3/arch/sparc64/lib/U3copy_to_user.S
--- linux-2.6.8-rc2/arch/sparc64/lib/U3copy_to_user.S	2004-06-15 22:18:37.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/lib/U3copy_to_user.S	2004-08-03 15:21:35.559678706 -0700
@@ -1,15 +1,15 @@
-/* $Id: U3copy_to_user.S,v 1.3 2000/11/01 09:29:19 davem Exp $
- * U3memcpy.S: UltraSparc-III optimized copy to userspace.
+/* U3copy_to_user.S: UltraSparc-III optimized memcpy.
  *
- * Copyright (C) 1999, 2000 David S. Miller (davem@redhat.com)
+ * Copyright (C) 1999, 2000, 2004 David S. Miller (davem@redhat.com)
  */
 
-#ifdef __KERNEL__
 #include <asm/visasm.h>
 #include <asm/asi.h>
 #include <asm/dcu.h>
 #include <asm/spitfire.h>
-#undef SMALL_COPY_USES_FPU
+
+#define XCC xcc
+
 #define EXNV(x,y,a,b)	\
 98:	x,y;				\
 	.section .fixup;		\
@@ -39,6 +39,18 @@
 	.align 4;			\
 99:	a, b, %o0;			\
 	retl;				\
+	 add %o0, 4, %o0;		\
+	.section __ex_table;		\
+	.align 4;			\
+	.word 98b, 99b;			\
+	.text;				\
+	.align 4;
+#define EXNV4(x,y,a,b)	\
+98:	x,y;				\
+	.section .fixup;		\
+	.align 4;			\
+99:	a, b, %o0;			\
+	retl;				\
 	 add %o0, 8, %o0;		\
 	.section __ex_table;		\
 	.align 4;			\
@@ -112,22 +124,9 @@
 	.word 98b, 99b;			\
 	.text;				\
 	.align 4;
-#else
-#define ASI_AIUS 0x80
-#define ASI_BLK_AIUS 0xf0
-#define FPRS_FEF  0x04
-#define VISEntryHalf rd %fprs, %o5; wr %g0, FPRS_FEF, %fprs
-#define VISExitHalf and %o5, FPRS_FEF, %o5; wr %o5, 0x0, %fprs
-#define SMALL_COPY_USES_FPU
-#define EXNV(x,y,a,b)	x,y;
-#define EXNV2(x,y,a,b)	x,y;
-#define EXNV3(x,y,a,b)	x,y;
-#define EX(x,y,a,b)	x,y;
-#define EXBLK1(x,y)	x,y;
-#define EXBLK2(x,y)	x,y;
-#define EXBLK3(x,y)	x,y;
-#define EXBLK4(x,y)	x,y;
-#endif
+
+	.register	%g2,#scratch
+	.register	%g3,#scratch
 
 	/* Special/non-trivial issues of this code:
 	 *
@@ -148,89 +147,64 @@
 	 * of up to 2.4GB per second.
 	 */
 
-	.globl		U3copy_to_user
-U3copy_to_user: /* %o0=dst, %o1=src, %o2=len */
+	.globl	U3copy_to_user
+U3copy_to_user:	/* %o0=dst, %o1=src, %o2=len */
 	/* Writing to %asi is _expensive_ so we hardcode it.
 	 * Reading %asi to check for KERNEL_DS is comparatively
 	 * cheap.
 	 */
-	rd		%asi, %g1			! MS	Group	(4 cycles)
-	cmp		%g1, ASI_AIUS			! A0	Group
-	bne		U3memcpy			! BR
-	 nop						! A1
-#ifndef __KERNEL__
-	/* Save away original 'dst' for memcpy return value. */
-	mov		%o0, %g3			! A0	Group
-#endif
-	/* Anything to copy at all? */
-	cmp		%o2, 0				! A1
-	ble,pn		%icc, U3copy_to_user_short_ret	! BR
-
-	/* Extremely small copy? */
-	 cmp		%o2, 31				! A0	Group
-	ble,pn		%icc, U3copy_to_user_short	! BR
-
-	/* Large enough to use unrolled prefetch loops? */
-	 cmp		%o2, 0x100			! A1
-	bge,a,pt	%icc, U3copy_to_user_enter	! BR	Group
-	 andcc		%o0, 0x3f, %g2			! A0
-
-	ba,pt		%xcc, U3copy_to_user_toosmall	! BR	Group
-	 andcc		%o0, 0x7, %g2			! A0
-
-	.align		32
-U3copy_to_user_short:
-	/* Copy %o2 bytes from src to dst, one byte at a time. */
-	ldub		[%o1 + 0x00], %o3		! MS	Group
-	add		%o1, 0x1, %o1			! A0
-	add		%o0, 0x1, %o0			! A1
-	subcc		%o2, 1, %o2			! A0	Group
-
-	bg,pt		%icc, U3copy_to_user_short	! BR
-	 EXNV(stba %o3, [%o0 + -1] %asi, add %o2, 1)	! MS	Group (1-cycle stall)
-
-U3copy_to_user_short_ret:
-#ifdef __KERNEL__
-	retl						! BR	Group (0-4 cycle stall)
-	 clr		%o0				! A0
-#else
-	retl						! BR	Group (0-4 cycle stall)
-	 mov		%g3, %o0			! A0
-#endif
+	rd		%asi, %g1
+	cmp		%g1, ASI_AIUS
+	bne,pn		%icc, U3memcpy_user_stub
+	 nop
 
-	/* Here len >= (6 * 64) and condition codes reflect execution
+	cmp		%o2, 0
+	be,pn		%XCC, out
+	 or		%o0, %o1, %o3
+	cmp		%o2, 16
+	bleu,a,pn	%XCC, small_copy
+	 or		%o3, %o2, %o3
+
+	cmp		%o2, 256
+	blu,pt		%XCC, medium_copy
+	 andcc		%o3, 0x7, %g0
+
+	ba,pt		%xcc, enter
+	 andcc		%o0, 0x3f, %g2
+
+	/* Here len >= 256 and condition codes reflect execution
 	 * of "andcc %o0, 0x7, %g2", done by caller.
 	 */
 	.align		64
-U3copy_to_user_enter:
+enter:
 	/* Is 'dst' already aligned on an 64-byte boundary? */
-	be,pt		%xcc, 2f			! BR
+	be,pt		%XCC, 2f
 
 	/* Compute abs((dst & 0x3f) - 0x40) into %g2.  This is the number
 	 * of bytes to copy to make 'dst' 64-byte aligned.  We pre-
 	 * subtract this from 'len'.
 	 */
-	 sub		%g2, 0x40, %g2			! A0	Group
-	sub		%g0, %g2, %g2			! A0	Group
-	sub		%o2, %g2, %o2			! A0	Group
+	 sub		%g2, 0x40, %g2
+	sub		%g0, %g2, %g2
+	sub		%o2, %g2, %o2
 
 	/* Copy %g2 bytes from src to dst, one byte at a time. */
-1:	ldub		[%o1 + 0x00], %o3		! MS	(Group)
-	add		%o1, 0x1, %o1			! A1
-	add		%o0, 0x1, %o0			! A0	Group
-	subcc		%g2, 0x1, %g2			! A1
-
-	bg,pt		%icc, 1b			! BR	Group
-	 EXNV2(stba %o3, [%o0 + -1] %asi, add %o2, %g2)	! MS	Group
-
-2:	VISEntryHalf					! MS+MS
-	and		%o1, 0x7, %g1			! A1
-	ba,pt		%xcc, U3copy_to_user_begin	! BR
-	 alignaddr	%o1, %g0, %o1			! MS	      (Break-after)
+1:	ldub		[%o1 + 0x00], %o3
+	add		%o1, 0x1, %o1
+	add		%o0, 0x1, %o0
+	subcc		%g2, 0x1, %g2
+
+	bg,pt		%XCC, 1b
+	 EXNV2(stba %o3, [%o0 + -1] %asi, add %o2, %g2)
+
+2:	VISEntryHalf
+	and		%o1, 0x7, %g1
+	ba,pt		%xcc, begin
+	 alignaddr	%o1, %g0, %o1
 
 	.align		64
-U3copy_to_user_begin:
-#ifdef __KERNEL__
+begin:
+
 	.globl		U3copy_to_user_nop_1_6
 U3copy_to_user_nop_1_6:
 	ldxa		[%g0] ASI_DCU_CONTROL_REG, %g3
@@ -239,309 +213,221 @@
 	or		%g3, %o3, %o3
 	stxa		%o3, [%g0] ASI_DCU_CONTROL_REG	! Enable P-cache
 	membar		#Sync
-#endif
-	prefetch	[%o1 + 0x000], #one_read	! MS	Group1
-	prefetch	[%o1 + 0x040], #one_read	! MS	Group2
-	andn		%o2, (0x40 - 1), %o4		! A0
-	prefetch	[%o1 + 0x080], #one_read	! MS	Group3
-	cmp		%o4, 0x140			! A0
-	prefetch	[%o1 + 0x0c0], #one_read	! MS	Group4
-	ldd		[%o1 + 0x000], %f0		! MS	Group5 (%f0 results at G8)
-	bge,a,pt	%icc, 1f			! BR
-
-	 prefetch	[%o1 + 0x100], #one_read	! MS	Group6
-1:	ldd		[%o1 + 0x008], %f2		! AX	       (%f2 results at G9)
-	cmp		%o4, 0x180			! A1
-	bge,a,pt	%icc, 1f			! BR
-	 prefetch	[%o1 + 0x140], #one_read	! MS	Group7
-1:	ldd		[%o1 + 0x010], %f4		! AX	       (%f4 results at G10)
-	cmp		%o4, 0x1c0			! A1
-	bge,a,pt	%icc, 1f			! BR
-
-	 prefetch	[%o1 + 0x180], #one_read	! MS	Group8
-1:	faligndata	%f0, %f2, %f16			! FGA	Group9 (%f16 at G12)
-	ldd		[%o1 + 0x018], %f6		! AX	       (%f6 results at G12)
-	faligndata	%f2, %f4, %f18			! FGA	Group10 (%f18 results at G13)
-	ldd		[%o1 + 0x020], %f8		! MS	        (%f8 results at G13)
-	faligndata	%f4, %f6, %f20			! FGA	Group12	(1-cycle stall,%f20 at G15)
-	ldd		[%o1 + 0x028], %f10		! MS		(%f10 results at G15)
-	faligndata	%f6, %f8, %f22			! FGA	Group13 (%f22 results at G16)
-	
-	ldd		[%o1 + 0x030], %f12		! MS		(%f12 results at G16)
-	faligndata	%f8, %f10, %f24			! FGA	Group15 (1-cycle stall,%f24 at G18)
-	ldd		[%o1 + 0x038], %f14		! MS		(%f14 results at G18)
-	faligndata	%f10, %f12, %f26		! FGA	Group16 (%f26 results at G19)
-	ldd		[%o1 + 0x040], %f0		! MS		(%f0 results at G19)
-
-	/* We only use the first loop if len > (7 * 64). */
-	subcc		%o4, 0x1c0, %o4			! A0	Group17
-	bg,pt		%icc, U3copy_to_user_loop1	! BR
-	 add		%o1, 0x40, %o1			! A1
-
-	add		%o4, 0x140, %o4			! A0	Group18
-	ba,pt		%xcc, U3copy_to_user_loop2	! BR
-	 srl		%o4, 6, %o3			! A0	Group19
-	nop
-	nop
-	nop
-	nop
-	nop
-
-	nop
-	nop
-
-	/* This loop performs the copy and queues new prefetches.
-	 * We drop into the second loop when len <= (5 * 64).  Note
-	 * that this (5 * 64) factor has been subtracted from len
-	 * already.
-	 */
-U3copy_to_user_loop1:
-	ldd		[%o1 + 0x008], %f2		! MS	Group2	(%f2 results at G5)
-	faligndata	%f12, %f14, %f28		! FGA		(%f28 results at G5)
-	ldd		[%o1 + 0x010], %f4		! MS	Group3	(%f4 results at G6)
-	faligndata	%f14, %f0, %f30			! FGA	Group4	(1-cycle stall, %f30 at G7)
-	EXBLK1(stda %f16, [%o0] ASI_BLK_AIUS)		! MS
-	ldd		[%o1 + 0x018], %f6		! AX		(%f6 results at G7)
-
-	faligndata	%f0, %f2, %f16			! FGA	Group12 (7-cycle stall)
-	ldd		[%o1 + 0x020], %f8		! MS	        (%f8 results at G15)
-	faligndata	%f2, %f4, %f18			! FGA	Group13	(%f18 results at G16)
-	ldd		[%o1 + 0x028], %f10		! MS		(%f10 results at G16)
-	faligndata	%f4, %f6, %f20			! FGA	Group14	(%f20 results at G17)
-	ldd		[%o1 + 0x030], %f12		! MS		(%f12 results at G17)
-	faligndata	%f6, %f8, %f22			! FGA	Group15	(%f22 results at G18)
-	ldd		[%o1 + 0x038], %f14		! MS		(%f14 results at G18)
-
-	faligndata	%f8, %f10, %f24			! FGA	Group16	(%f24 results at G19)
-	ldd		[%o1 + 0x040], %f0		! AX		(%f0 results at G19)
-	prefetch	[%o1 + 0x180], #one_read	! MS
-	faligndata	%f10, %f12, %f26		! FGA	Group17	(%f26 results at G20)
-	subcc		%o4, 0x40, %o4			! A0
-	add		%o1, 0x40, %o1			! A1
-	bg,pt		%xcc, U3copy_to_user_loop1		! BR
-	 add		%o0, 0x40, %o0			! A0	Group18
-
-U3copy_to_user_loop2_enter:
-	mov		5, %o3				! A1
-
-	/* This loop performs on the copy, no new prefetches are
-	 * queued.  We do things this way so that we do not perform
-	 * any spurious prefetches past the end of the src buffer.
-	 */
-U3copy_to_user_loop2:
-	ldd		[%o1 + 0x008], %f2		! MS
-	faligndata	%f12, %f14, %f28		! FGA	Group2
-	ldd		[%o1 + 0x010], %f4		! MS
-	faligndata	%f14, %f0, %f30			! FGA	Group4	(1-cycle stall)
-	EXBLK2(stda %f16, [%o0] ASI_BLK_AIUS)		! MS
-	ldd		[%o1 + 0x018], %f6		! AX
-	faligndata	%f0, %f2, %f16			! FGA	Group12 (7-cycle stall)
-
-	ldd		[%o1 + 0x020], %f8		! MS
-	faligndata	%f2, %f4, %f18			! FGA	Group13
-	ldd		[%o1 + 0x028], %f10		! MS
-	faligndata	%f4, %f6, %f20			! FGA	Group14
-	ldd		[%o1 + 0x030], %f12		! MS
-	faligndata	%f6, %f8, %f22			! FGA	Group15
-	ldd		[%o1 + 0x038], %f14		! MS
-	faligndata	%f8, %f10, %f24			! FGA	Group16
-
-	ldd		[%o1 + 0x040], %f0		! AX
-	faligndata	%f10, %f12, %f26		! FGA	Group17
-	subcc		%o3, 0x01, %o3			! A0
-	add		%o1, 0x40, %o1			! A1
-	bg,pt		%xcc, U3copy_to_user_loop2	! BR
-	 add		%o0, 0x40, %o0			! A0	Group18
+
+	prefetch	[%o1 + 0x000], #one_read
+	prefetch	[%o1 + 0x040], #one_read
+	andn		%o2, (0x40 - 1), %o4
+	prefetch	[%o1 + 0x080], #one_read
+	prefetch	[%o1 + 0x0c0], #one_read
+	ldd		[%o1 + 0x000], %f0
+	prefetch	[%o1 + 0x100], #one_read
+	ldd		[%o1 + 0x008], %f2
+	prefetch	[%o1 + 0x140], #one_read
+	ldd		[%o1 + 0x010], %f4
+	prefetch	[%o1 + 0x180], #one_read
+	faligndata	%f0, %f2, %f16
+	ldd		[%o1 + 0x018], %f6
+	faligndata	%f2, %f4, %f18
+	ldd		[%o1 + 0x020], %f8
+	faligndata	%f4, %f6, %f20
+	ldd		[%o1 + 0x028], %f10
+	faligndata	%f6, %f8, %f22
+
+	ldd		[%o1 + 0x030], %f12
+	faligndata	%f8, %f10, %f24
+	ldd		[%o1 + 0x038], %f14
+	faligndata	%f10, %f12, %f26
+	ldd		[%o1 + 0x040], %f0
+
+	sub		%o4, 0x80, %o4
+	add		%o1, 0x40, %o1
+	ba,pt		%xcc, loop
+	 srl		%o4, 6, %o3
+
+	.align		64
+loop:
+	ldd		[%o1 + 0x008], %f2
+	faligndata	%f12, %f14, %f28
+	ldd		[%o1 + 0x010], %f4
+	faligndata	%f14, %f0, %f30
+	EXBLK2(stda %f16, [%o0] ASI_BLK_AIUS)
+	ldd		[%o1 + 0x018], %f6
+	faligndata	%f0, %f2, %f16
+
+	ldd		[%o1 + 0x020], %f8
+	faligndata	%f2, %f4, %f18
+	ldd		[%o1 + 0x028], %f10
+	faligndata	%f4, %f6, %f20
+	ldd		[%o1 + 0x030], %f12
+	faligndata	%f6, %f8, %f22
+	ldd		[%o1 + 0x038], %f14
+	faligndata	%f8, %f10, %f24
+
+	ldd		[%o1 + 0x040], %f0
+	prefetch	[%o1 + 0x180], #one_read
+	faligndata	%f10, %f12, %f26
+	subcc		%o3, 0x01, %o3
+	add		%o1, 0x40, %o1
+	bg,pt		%XCC, loop
+	 add		%o0, 0x40, %o0
 
 	/* Finally we copy the last full 64-byte block. */
-U3copy_to_user_loopfini:
-	ldd		[%o1 + 0x008], %f2		! MS
-	faligndata	%f12, %f14, %f28		! FGA
-	ldd		[%o1 + 0x010], %f4		! MS	Group19
-	faligndata	%f14, %f0, %f30			! FGA
-	EXBLK3(stda %f16, [%o0] ASI_BLK_AIUS)		! MS	Group20
-	ldd		[%o1 + 0x018], %f6		! AX
-	faligndata	%f0, %f2, %f16			! FGA	Group11 (7-cycle stall)
-	ldd		[%o1 + 0x020], %f8		! MS
-	faligndata	%f2, %f4, %f18			! FGA	Group12
-	ldd		[%o1 + 0x028], %f10		! MS
-	faligndata	%f4, %f6, %f20			! FGA	Group13
-	ldd		[%o1 + 0x030], %f12		! MS
-	faligndata	%f6, %f8, %f22			! FGA	Group14
-	ldd		[%o1 + 0x038], %f14		! MS
-	faligndata	%f8, %f10, %f24			! FGA	Group15
-	cmp		%g1, 0				! A0
-	be,pt		%icc, 1f			! BR
-	 add		%o0, 0x40, %o0			! A1
-	ldd		[%o1 + 0x040], %f0		! MS
-1:	faligndata	%f10, %f12, %f26		! FGA	Group16
-	faligndata	%f12, %f14, %f28		! FGA	Group17
-	faligndata	%f14, %f0, %f30			! FGA	Group18
-	EXBLK4(stda %f16, [%o0] ASI_BLK_AIUS)		! MS
-	add		%o0, 0x40, %o0			! A0
-	add		%o1, 0x40, %o1			! A1
-#ifdef __KERNEL__
+loopfini:
+	ldd		[%o1 + 0x008], %f2
+	faligndata	%f12, %f14, %f28
+	ldd		[%o1 + 0x010], %f4
+	faligndata	%f14, %f0, %f30
+	EXBLK3(stda %f16, [%o0] ASI_BLK_AIUS)
+	ldd		[%o1 + 0x018], %f6
+	faligndata	%f0, %f2, %f16
+	ldd		[%o1 + 0x020], %f8
+	faligndata	%f2, %f4, %f18
+	ldd		[%o1 + 0x028], %f10
+	faligndata	%f4, %f6, %f20
+	ldd		[%o1 + 0x030], %f12
+	faligndata	%f6, %f8, %f22
+	ldd		[%o1 + 0x038], %f14
+	faligndata	%f8, %f10, %f24
+	cmp		%g1, 0
+	be,pt		%XCC, 1f
+	 add		%o0, 0x40, %o0
+	ldd		[%o1 + 0x040], %f0
+1:	faligndata	%f10, %f12, %f26
+	faligndata	%f12, %f14, %f28
+	faligndata	%f14, %f0, %f30
+	EXBLK4(stda %f16, [%o0] ASI_BLK_AIUS)
+	add		%o0, 0x40, %o0
+	add		%o1, 0x40, %o1
+
 	.globl		U3copy_to_user_nop_2_3
 U3copy_to_user_nop_2_3:
 	mov		PRIMARY_CONTEXT, %o3
 	stxa		%g0, [%o3] ASI_DMMU		! Flush P-cache
 	stxa		%g3, [%g0] ASI_DCU_CONTROL_REG	! Disable P-cache
-#endif
-	membar		#Sync				! MS	Group26 (7-cycle stall)
+
+	membar		#Sync
 
 	/* Now we copy the (len modulo 64) bytes at the end.
 	 * Note how we borrow the %f0 loaded above.
 	 *
 	 * Also notice how this code is careful not to perform a
-	 * load past the end of the src buffer just like similar
-	 * code found in U3copy_to_user_toosmall processing.
+	 * load past the end of the src buffer.
 	 */
-U3copy_to_user_loopend:
-	and		%o2, 0x3f, %o2			! A0	Group
-	andcc		%o2, 0x38, %g2			! A0	Group
-	be,pn		%icc, U3copy_to_user_endcruft	! BR
-	 subcc		%g2, 0x8, %g2			! A1
-	be,pn		%icc, U3copy_to_user_endcruft	! BR	Group
-	 cmp		%g1, 0				! A0
-
-	be,a,pt		%icc, 1f			! BR	Group
-	 ldd		[%o1 + 0x00], %f0		! MS
-
-1:	ldd		[%o1 + 0x08], %f2		! MS	Group
-	add		%o1, 0x8, %o1			! A0
-	sub		%o2, 0x8, %o2			! A1
-	subcc		%g2, 0x8, %g2			! A0	Group
-	faligndata	%f0, %f2, %f8			! FGA	Group
-	EX(stda %f8, [%o0 + 0x00] %asi, add %o2, 0x8)	! MS	(XXX does it stall here? XXX)
-	be,pn		%icc, U3copy_to_user_endcruft	! BR
-	 add		%o0, 0x8, %o0			! A0
-	ldd		[%o1 + 0x08], %f0		! MS	Group
-	add		%o1, 0x8, %o1			! A0
-	sub		%o2, 0x8, %o2			! A1
-	subcc		%g2, 0x8, %g2			! A0	Group
-	faligndata	%f2, %f0, %f8			! FGA
-	EX(stda %f8, [%o0 + 0x00] %asi, add %o2, 0x8)	! MS	(XXX does it stall here? XXX)
-	bne,pn		%icc, 1b			! BR
-	 add		%o0, 0x8, %o0			! A0	Group
+loopend:
+	and		%o2, 0x3f, %o2
+	andcc		%o2, 0x38, %g2
+	be,pn		%XCC, endcruft
+	 subcc		%g2, 0x8, %g2
+	be,pn		%XCC, endcruft
+	 cmp		%g1, 0
+
+	be,a,pt		%XCC, 1f
+	 ldd		[%o1 + 0x00], %f0
+
+1:	ldd		[%o1 + 0x08], %f2
+	add		%o1, 0x8, %o1
+	sub		%o2, 0x8, %o2
+	subcc		%g2, 0x8, %g2
+	faligndata	%f0, %f2, %f8
+	EX(stda %f8, [%o0 + 0x00] %asi, add %o2, 0x8)
+	be,pn		%XCC, endcruft
+	 add		%o0, 0x8, %o0
+	ldd		[%o1 + 0x08], %f0
+	add		%o1, 0x8, %o1
+	sub		%o2, 0x8, %o2
+	subcc		%g2, 0x8, %g2
+	faligndata	%f2, %f0, %f8
+	EX(stda %f8, [%o0 + 0x00] %asi, add %o2, 0x8)
+	bne,pn		%XCC, 1b
+	 add		%o0, 0x8, %o0
 
 	/* If anything is left, we copy it one byte at a time.
 	 * Note that %g1 is (src & 0x3) saved above before the
 	 * alignaddr was performed.
 	 */
-U3copy_to_user_endcruft:
+endcruft:
 	cmp		%o2, 0
 	add		%o1, %g1, %o1
 	VISExitHalf
-	be,pn		%icc, U3copy_to_user_short_ret
-	 nop
-	ba,a,pt		%xcc, U3copy_to_user_short
-
-	/* If we get here, then 32 <= len < (6 * 64) */
-U3copy_to_user_toosmall:
-
-#ifdef SMALL_COPY_USES_FPU
-
-	/* Is 'dst' already aligned on an 8-byte boundary? */
-	be,pt		%xcc, 2f			! BR	Group
-
-	/* Compute abs((dst & 7) - 8) into %g2.  This is the number
-	 * of bytes to copy to make 'dst' 8-byte aligned.  We pre-
-	 * subtract this from 'len'.
-	 */
-	 sub		%g2, 0x8, %g2			! A0
-	sub		%g0, %g2, %g2			! A0	Group (reg-dep)
-	sub		%o2, %g2, %o2			! A0	Group (reg-dep)
+	be,pn		%XCC, out
+	 sub		%o0, %o1, %o3
 
-	/* Copy %g2 bytes from src to dst, one byte at a time. */
-1:	ldub		[%o1 + 0x00], %o3		! MS	(Group) (%o3 in 3 cycles)
-	add		%o1, 0x1, %o1			! A1
-	add		%o0, 0x1, %o0			! A0	Group
-	subcc		%g2, 0x1, %g2			! A1
-
-	bg,pt		%icc, 1b			! BR	Group
-	 EXNV2(stba %o3, [%o0 + -1] %asi, add %o2, %g2)	! MS	Group
-
-2:	VISEntryHalf					! MS+MS
-
-	/* Compute (len - (len % 8)) into %g2.  This is guaranteed
-	 * to be nonzero.
-	 */
-	andn		%o2, 0x7, %g2			! A0	Group
-
-	/* You may read this and believe that it allows reading
-	 * one 8-byte longword past the end of src.  It actually
-	 * does not, as %g2 is subtracted as loads are done from
-	 * src, so we always stop before running off the end.
-	 * Also, we are guaranteed to have at least 0x10 bytes
-	 * to move here.
-	 */
-	sub		%g2, 0x8, %g2			! A0	Group (reg-dep)
-	alignaddr	%o1, %g0, %g1			! MS	      (Break-after)
-	ldd		[%g1 + 0x00], %f0		! MS	Group (1-cycle stall)
-	add		%g1, 0x8, %g1			! A0
-
-1:	ldd		[%g1 + 0x00], %f2		! MS	Group
-	add		%g1, 0x8, %g1			! A0
-	sub		%o2, 0x8, %o2			! A1
-	subcc		%g2, 0x8, %g2			! A0	Group
-
-	faligndata	%f0, %f2, %f8			! FGA	Group (1-cycle stall)
-	EX(stda %f8, [%o0 + 0x00] %asi, add %o2, 0x8)	! MS	Group (2-cycle stall)
-	add		%o1, 0x8, %o1			! A0
-	be,pn		%icc, 2f			! BR
-
-	 add		%o0, 0x8, %o0			! A1
-	ldd		[%g1 + 0x00], %f0		! MS	Group
-	add		%g1, 0x8, %g1			! A0
-	sub		%o2, 0x8, %o2			! A1
-
-	subcc		%g2, 0x8, %g2			! A0	Group
-	faligndata	%f2, %f0, %f8			! FGA	Group (1-cycle stall)
-	EX(stda %f8, [%o0 + 0x00] %asi, add %o2, 0x8)	! MS	Group (2-cycle stall)
-	add		%o1, 0x8, %o1			! A0
-
-	bne,pn		%icc, 1b			! BR
-	 add		%o0, 0x8, %o0			! A1
-
-	/* Nothing left to copy? */
-2:	cmp		%o2, 0				! A0	Group
-	VISExitHalf					! A0+MS
-	be,pn		%icc, U3copy_to_user_short_ret	! BR	Group
-	 nop						! A0
-	ba,a,pt		%xcc, U3copy_to_user_short	! BR	Group
-
-#else /* !(SMALL_COPY_USES_FPU) */
-
-	xor		%o1, %o0, %g2
-	andcc		%g2, 0x7, %g0
-	bne,pn		%icc, U3copy_to_user_short
-	 andcc		%o1, 0x7, %g2
+	andcc		%g1, 0x7, %g0
+	bne,pn		%icc, small_copy_unaligned
+	 andcc		%o2, 0x8, %g0
+	be,pt		%icc, 1f
+	 nop
+	ldx		[%o1], %o5
+	EXNV(stxa %o5, [%o1 + %o3] ASI_AIUS, add %o2, %g0)
+	add		%o1, 0x8, %o1
 
-	be,pt		%xcc, 2f
-	 sub		%g2, 0x8, %g2
-	sub		%g0, %g2, %g2
-	sub		%o2, %g2, %o2
+1:	andcc		%o2, 0x4, %g0
+	be,pt		%icc, 1f
+	 nop
+	lduw		[%o1], %o5
+	EXNV(stwa %o5, [%o1 + %o3] ASI_AIUS, and %o2, 0x7)
+	add		%o1, 0x4, %o1
 
-1:	ldub		[%o1 + 0x00], %o3
-	add		%o1, 0x1, %o1
-	add		%o0, 0x1, %o0
-	subcc		%g2, 0x1, %g2
-	bg,pt		%icc, 1b
-	 EXNV2(stba %o3, [%o0 + -1] %asi, add %o2, %g2)
+1:	andcc		%o2, 0x2, %g0
+	be,pt		%icc, 1f
+	 nop
+	lduh		[%o1], %o5
+	EXNV(stha %o5, [%o1 + %o3] ASI_AIUS, and %o2, 0x3)
+	add		%o1, 0x2, %o1
 
-2:	andn		%o2, 0x7, %g2
-	sub		%o2, %g2, %o2
+1:	andcc		%o2, 0x1, %g0
+	be,pt		%icc, out
+	 nop
+	ldub		[%o1], %o5
+	ba,pt		%xcc, out
+	 EXNV(stba %o5, [%o1 + %o3] ASI_AIUS, and %o2, 0x1)
+
+medium_copy: /* 16 < len <= 64 */
+	bne,pn		%XCC, small_copy_unaligned
+	 sub		%o0, %o1, %o3
+
+medium_copy_aligned:
+	andn		%o2, 0x7, %o4
+	and		%o2, 0x7, %o2
+1:	subcc		%o4, 0x8, %o4
+	ldx		[%o1], %o5
+	EXNV4(stxa %o5, [%o1 + %o3] ASI_AIUS, add %o2, %o4)
+	bgu,pt		%XCC, 1b
+	 add		%o1, 0x8, %o1
+	andcc		%o2, 0x4, %g0
+	be,pt		%XCC, 1f
+	 nop
+	sub		%o2, 0x4, %o2
+	lduw		[%o1], %o5
+	EXNV3(stwa %o5, [%o1 + %o3] ASI_AIUS, add %o2, %g0)
+	add		%o1, 0x4, %o1
+1:	cmp		%o2, 0
+	be,pt		%XCC, out
+	 nop
+	ba,pt		%xcc, small_copy_unaligned
+	 nop
 
-3:	ldx		[%o1 + 0x00], %o3
-	add		%o1, 0x8, %o1
-	add		%o0, 0x8, %o0
-	subcc		%g2, 0x8, %g2
-	bg,pt		%icc, 3b
-	 EXNV3(stxa %o3, [%o0 + -8] %asi, add %o2, %g2)
+small_copy: /* 0 < len <= 16 */
+	andcc		%o3, 0x3, %g0
+	bne,pn		%XCC, small_copy_unaligned
+	 sub		%o0, %o1, %o3
+
+small_copy_aligned:
+	subcc		%o2, 4, %o2
+	lduw		[%o1], %g1
+	EXNV3(stwa %g1, [%o1 + %o3] ASI_AIUS, add %o2, %g0)
+	bgu,pt		%XCC, small_copy_aligned
+	 add		%o1, 4, %o1
 
-	cmp		%o2, 0
-	bne,pn		%icc, U3copy_to_user_short
-	 nop
-	ba,a,pt		%xcc, U3copy_to_user_short_ret
+out:	retl
+	 clr		%o0
 
-#endif /* !(SMALL_COPY_USES_FPU) */
+	.align	32
+small_copy_unaligned:
+	subcc		%o2, 1, %o2
+	ldub		[%o1], %g1
+	EXNV2(stba %g1, [%o1 + %o3] ASI_AIUS, add %o2, %g0)
+	bgu,pt		%XCC, small_copy_unaligned
+	 add		%o1, 1, %o1
+	retl
+	 clr		%o0
diff -urN linux-2.6.8-rc2/arch/sparc64/lib/U3memcpy.S linux-2.6.8-rc3/arch/sparc64/lib/U3memcpy.S
--- linux-2.6.8-rc2/arch/sparc64/lib/U3memcpy.S	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/lib/U3memcpy.S	2004-08-03 15:21:35.602680470 -0700
@@ -1,7 +1,6 @@
-/* $Id: U3memcpy.S,v 1.2 2000/11/01 09:29:19 davem Exp $
- * U3memcpy.S: UltraSparc-III optimized memcpy.
+/* U3memcpy.S: UltraSparc-III optimized memcpy.
  *
- * Copyright (C) 1999, 2000 David S. Miller (davem@redhat.com)
+ * Copyright (C) 1999, 2000, 2004 David S. Miller (davem@redhat.com)
  */
 
 #ifdef __KERNEL__
@@ -9,15 +8,20 @@
 #include <asm/asi.h>
 #include <asm/dcu.h>
 #include <asm/spitfire.h>
-#undef SMALL_COPY_USES_FPU
 #else
 #define ASI_BLK_P 0xf0
 #define FPRS_FEF  0x04
 #define VISEntryHalf rd %fprs, %o5; wr %g0, FPRS_FEF, %fprs
 #define VISExitHalf and %o5, FPRS_FEF, %o5; wr %o5, 0x0, %fprs
-#define SMALL_COPY_USES_FPU
 #endif
 
+#ifndef XCC
+#define XCC xcc
+#endif
+
+	.register	%g2,#scratch
+	.register	%g3,#scratch
+
 	/* Special/non-trivial issues of this code:
 	 *
 	 * 1) %o5 is preserved from VISEntryHalf to VISExitHalf
@@ -37,80 +41,55 @@
 	 * of up to 2.4GB per second.
 	 */
 
-	.globl		U3memcpy
-U3memcpy: /* %o0=dst, %o1=src, %o2=len */
-#ifndef __KERNEL__
-	/* Save away original 'dst' for memcpy return value. */
-	mov		%o0, %g3			! A0	Group
-#endif
-	/* Anything to copy at all? */
-	cmp		%o2, 0				! A1
-	ble,pn		%icc, U3memcpy_short_ret	! BR
-
-	/* Extremely small copy? */
-	 cmp		%o2, 31				! A0	Group
-	ble,pn		%icc, U3memcpy_short		! BR
-
-	/* Large enough to use unrolled prefetch loops? */
-	 cmp		%o2, 0x100			! A1
-	bge,a,pt	%icc, U3memcpy_enter		! BR	Group
-	 andcc		%o0, 0x3f, %g2			! A0
-
-	ba,pt		%xcc, U3memcpy_toosmall		! BR	Group
-	 andcc		%o0, 0x7, %g2			! A0
-
-	.align		32
-U3memcpy_short:
-	/* Copy %o2 bytes from src to dst, one byte at a time. */
-	ldub		[%o1 + 0x00], %o3		! MS	Group
-	add		%o1, 0x1, %o1			! A0
-	add		%o0, 0x1, %o0			! A1
-	subcc		%o2, 1, %o2			! A0	Group
-
-	bg,pt		%icc, U3memcpy_short		! BR
-	 stb		%o3, [%o0 + -1]			! MS	Group (1-cycle stall)
+	.globl	U3memcpy
+U3memcpy:	/* %o0=dst, %o1=src, %o2=len */
+	mov		%o0, %g5
+	cmp		%o2, 0
+	be,pn		%XCC, out
+	 or		%o0, %o1, %o3
+	cmp		%o2, 16
+	bleu,a,pn	%XCC, small_copy
+	 or		%o3, %o2, %o3
+
+	cmp		%o2, 256
+	blu,pt		%XCC, medium_copy
+	 andcc		%o3, 0x7, %g0
 
-U3memcpy_short_ret:
-#ifdef __KERNEL__
-	retl						! BR	Group (0-4 cycle stall)
-	 clr		%o0				! A0
-#else
-	retl						! BR	Group (0-4 cycle stall)
-	 mov		%g3, %o0			! A0
-#endif
+	ba,pt		%xcc, enter
+	 andcc		%o0, 0x3f, %g2
 
-	/* Here len >= (6 * 64) and condition codes reflect execution
+	/* Here len >= 256 and condition codes reflect execution
 	 * of "andcc %o0, 0x7, %g2", done by caller.
 	 */
 	.align		64
-U3memcpy_enter:
+enter:
 	/* Is 'dst' already aligned on an 64-byte boundary? */
-	be,pt		%xcc, 2f			! BR
+	be,pt		%XCC, 2f
 
 	/* Compute abs((dst & 0x3f) - 0x40) into %g2.  This is the number
 	 * of bytes to copy to make 'dst' 64-byte aligned.  We pre-
 	 * subtract this from 'len'.
 	 */
-	 sub		%g2, 0x40, %g2			! A0	Group
-	sub		%g0, %g2, %g2			! A0	Group
-	sub		%o2, %g2, %o2			! A0	Group
+	 sub		%g2, 0x40, %g2
+	sub		%g0, %g2, %g2
+	sub		%o2, %g2, %o2
 
 	/* Copy %g2 bytes from src to dst, one byte at a time. */
-1:	ldub		[%o1 + 0x00], %o3		! MS	(Group)
-	add		%o1, 0x1, %o1			! A1
-	add		%o0, 0x1, %o0			! A0	Group
-	subcc		%g2, 0x1, %g2			! A1
-
-	bg,pt		%icc, 1b			! BR	Group
-	 stb		%o3, [%o0 + -1]			! MS	Group
-
-2:	VISEntryHalf					! MS+MS
-	and		%o1, 0x7, %g1			! A1
-	ba,pt		%xcc, U3memcpy_begin		! BR
-	 alignaddr	%o1, %g0, %o1			! MS	      (Break-after)
+1:	ldub		[%o1 + 0x00], %o3
+	add		%o1, 0x1, %o1
+	add		%o0, 0x1, %o0
+	subcc		%g2, 0x1, %g2
+
+	bg,pt		%XCC, 1b
+	 stb		%o3, [%o0 + -1]
+
+2:	VISEntryHalf
+	and		%o1, 0x7, %g1
+	ba,pt		%xcc, begin
+	 alignaddr	%o1, %g0, %o1
 
 	.align		64
-U3memcpy_begin:
+begin:
 #ifdef __KERNEL__
 	.globl		U3memcpy_nop_1_6
 U3memcpy_nop_1_6:
@@ -121,146 +100,90 @@
 	stxa		%o3, [%g0] ASI_DCU_CONTROL_REG	! Enable P-cache
 	membar		#Sync
 #endif
-	prefetch	[%o1 + 0x000], #one_read	! MS	Group1
-	prefetch	[%o1 + 0x040], #one_read	! MS	Group2
-	andn		%o2, (0x40 - 1), %o4		! A0
-	prefetch	[%o1 + 0x080], #one_read	! MS	Group3
-	cmp		%o4, 0x140			! A0
-	prefetch	[%o1 + 0x0c0], #one_read	! MS	Group4
-	ldd		[%o1 + 0x000], %f0		! MS	Group5 (%f0 results at G8)
-	bge,a,pt	%icc, 1f			! BR
-
-	 prefetch	[%o1 + 0x100], #one_read	! MS	Group6
-1:	ldd		[%o1 + 0x008], %f2		! AX	       (%f2 results at G9)
-	cmp		%o4, 0x180			! A1
-	bge,a,pt	%icc, 1f			! BR
-	 prefetch	[%o1 + 0x140], #one_read	! MS	Group7
-1:	ldd		[%o1 + 0x010], %f4		! AX	       (%f4 results at G10)
-	cmp		%o4, 0x1c0			! A1
-	bge,a,pt	%icc, 1f			! BR
-
-	 prefetch	[%o1 + 0x180], #one_read	! MS	Group8
-1:	faligndata	%f0, %f2, %f16			! FGA	Group9 (%f16 at G12)
-	ldd		[%o1 + 0x018], %f6		! AX	       (%f6 results at G12)
-	faligndata	%f2, %f4, %f18			! FGA	Group10 (%f18 results at G13)
-	ldd		[%o1 + 0x020], %f8		! MS	        (%f8 results at G13)
-	faligndata	%f4, %f6, %f20			! FGA	Group12	(1-cycle stall,%f20 at G15)
-	ldd		[%o1 + 0x028], %f10		! MS		(%f10 results at G15)
-	faligndata	%f6, %f8, %f22			! FGA	Group13 (%f22 results at G16)
-
-	ldd		[%o1 + 0x030], %f12		! MS		(%f12 results at G16)
-	faligndata	%f8, %f10, %f24			! FGA	Group15 (1-cycle stall,%f24 at G18)
-	ldd		[%o1 + 0x038], %f14		! MS		(%f14 results at G18)
-	faligndata	%f10, %f12, %f26		! FGA	Group16 (%f26 results at G19)
-	ldd		[%o1 + 0x040], %f0		! MS		(%f0 results at G19)
-
-	/* We only use the first loop if len > (7 * 64). */
-	subcc		%o4, 0x1c0, %o4			! A0	Group17
-	bg,pt		%icc, U3memcpy_loop1		! BR
-	 add		%o1, 0x40, %o1			! A1
-
-	add		%o4, 0x140, %o4			! A0	Group18
-	ba,pt		%xcc, U3memcpy_loop2		! BR
-	 srl		%o4, 6, %o3			! A0	Group19
-	nop
-	nop
-	nop
-	nop
-	nop
-
-	nop
-	nop
-
-	/* This loop performs the copy and queues new prefetches.
-	 * We drop into the second loop when len <= (5 * 64).  Note
-	 * that this (5 * 64) factor has been subtracted from len
-	 * already.
-	 */
-U3memcpy_loop1:
-	ldd		[%o1 + 0x008], %f2		! MS	Group2	(%f2 results at G5)
-	faligndata	%f12, %f14, %f28		! FGA		(%f28 results at G5)
-	ldd		[%o1 + 0x010], %f4		! MS	Group3	(%f4 results at G6)
-	faligndata	%f14, %f0, %f30			! FGA	Group4	(1-cycle stall, %f30 at G7)
-	stda		%f16, [%o0] ASI_BLK_P		! MS
-	ldd		[%o1 + 0x018], %f6		! AX		(%f6 results at G7)
-
-	faligndata	%f0, %f2, %f16			! FGA	Group12 (7-cycle stall)
-	ldd		[%o1 + 0x020], %f8		! MS	        (%f8 results at G15)
-	faligndata	%f2, %f4, %f18			! FGA	Group13	(%f18 results at G16)
-	ldd		[%o1 + 0x028], %f10		! MS		(%f10 results at G16)
-	faligndata	%f4, %f6, %f20			! FGA	Group14	(%f20 results at G17)
-	ldd		[%o1 + 0x030], %f12		! MS		(%f12 results at G17)
-	faligndata	%f6, %f8, %f22			! FGA	Group15	(%f22 results at G18)
-	ldd		[%o1 + 0x038], %f14		! MS		(%f14 results at G18)
-
-	faligndata	%f8, %f10, %f24			! FGA	Group16	(%f24 results at G19)
-	ldd		[%o1 + 0x040], %f0		! AX		(%f0 results at G19)
-	prefetch	[%o1 + 0x180], #one_read	! MS
-	faligndata	%f10, %f12, %f26		! FGA	Group17	(%f26 results at G20)
-	subcc		%o4, 0x40, %o4			! A0
-	add		%o1, 0x40, %o1			! A1
-	bg,pt		%xcc, U3memcpy_loop1		! BR
-	 add		%o0, 0x40, %o0			! A0	Group18
-
-U3memcpy_loop2_enter:
-	mov		5, %o3				! A1
-
-	/* This loop performs on the copy, no new prefetches are
-	 * queued.  We do things this way so that we do not perform
-	 * any spurious prefetches past the end of the src buffer.
-	 */
-U3memcpy_loop2:
-	ldd		[%o1 + 0x008], %f2		! MS
-	faligndata	%f12, %f14, %f28		! FGA	Group2
-	ldd		[%o1 + 0x010], %f4		! MS
-	faligndata	%f14, %f0, %f30			! FGA	Group4	(1-cycle stall)
-	stda		%f16, [%o0] ASI_BLK_P		! MS
-	ldd		[%o1 + 0x018], %f6		! AX
-	faligndata	%f0, %f2, %f16			! FGA	Group12 (7-cycle stall)
-
-	ldd		[%o1 + 0x020], %f8		! MS
-	faligndata	%f2, %f4, %f18			! FGA	Group13
-	ldd		[%o1 + 0x028], %f10		! MS
-	faligndata	%f4, %f6, %f20			! FGA	Group14
-	ldd		[%o1 + 0x030], %f12		! MS
-	faligndata	%f6, %f8, %f22			! FGA	Group15
-	ldd		[%o1 + 0x038], %f14		! MS
-	faligndata	%f8, %f10, %f24			! FGA	Group16
-
-	ldd		[%o1 + 0x040], %f0		! AX
-	faligndata	%f10, %f12, %f26		! FGA	Group17
-	subcc		%o3, 0x01, %o3			! A0
-	add		%o1, 0x40, %o1			! A1
-	bg,pt		%xcc, U3memcpy_loop2		! BR
-	 add		%o0, 0x40, %o0			! A0	Group18
+	prefetch	[%o1 + 0x000], #one_read
+	prefetch	[%o1 + 0x040], #one_read
+	andn		%o2, (0x40 - 1), %o4
+	prefetch	[%o1 + 0x080], #one_read
+	prefetch	[%o1 + 0x0c0], #one_read
+	ldd		[%o1 + 0x000], %f0
+	prefetch	[%o1 + 0x100], #one_read
+	ldd		[%o1 + 0x008], %f2
+	prefetch	[%o1 + 0x140], #one_read
+	ldd		[%o1 + 0x010], %f4
+	prefetch	[%o1 + 0x180], #one_read
+	faligndata	%f0, %f2, %f16
+	ldd		[%o1 + 0x018], %f6
+	faligndata	%f2, %f4, %f18
+	ldd		[%o1 + 0x020], %f8
+	faligndata	%f4, %f6, %f20
+	ldd		[%o1 + 0x028], %f10
+	faligndata	%f6, %f8, %f22
+
+	ldd		[%o1 + 0x030], %f12
+	faligndata	%f8, %f10, %f24
+	ldd		[%o1 + 0x038], %f14
+	faligndata	%f10, %f12, %f26
+	ldd		[%o1 + 0x040], %f0
+
+	sub		%o4, 0x80, %o4
+	add		%o1, 0x40, %o1
+	ba,pt		%xcc, loop
+	 srl		%o4, 6, %o3
+
+	.align		64
+loop:
+	ldd		[%o1 + 0x008], %f2
+	faligndata	%f12, %f14, %f28
+	ldd		[%o1 + 0x010], %f4
+	faligndata	%f14, %f0, %f30
+	stda		%f16, [%o0] ASI_BLK_P
+	ldd		[%o1 + 0x018], %f6
+	faligndata	%f0, %f2, %f16
+
+	ldd		[%o1 + 0x020], %f8
+	faligndata	%f2, %f4, %f18
+	ldd		[%o1 + 0x028], %f10
+	faligndata	%f4, %f6, %f20
+	ldd		[%o1 + 0x030], %f12
+	faligndata	%f6, %f8, %f22
+	ldd		[%o1 + 0x038], %f14
+	faligndata	%f8, %f10, %f24
+
+	ldd		[%o1 + 0x040], %f0
+	prefetch	[%o1 + 0x180], #one_read
+	faligndata	%f10, %f12, %f26
+	subcc		%o3, 0x01, %o3
+	add		%o1, 0x40, %o1
+	bg,pt		%XCC, loop
+	 add		%o0, 0x40, %o0
 
 	/* Finally we copy the last full 64-byte block. */
-U3memcpy_loopfini:
-	ldd		[%o1 + 0x008], %f2		! MS
-	faligndata	%f12, %f14, %f28		! FGA
-	ldd		[%o1 + 0x010], %f4		! MS	Group19
-	faligndata	%f14, %f0, %f30			! FGA
-	stda		%f16, [%o0] ASI_BLK_P		! MS	Group20
-	ldd		[%o1 + 0x018], %f6		! AX
-	faligndata	%f0, %f2, %f16			! FGA	Group11 (7-cycle stall)
-	ldd		[%o1 + 0x020], %f8		! MS
-	faligndata	%f2, %f4, %f18			! FGA	Group12
-	ldd		[%o1 + 0x028], %f10		! MS
-	faligndata	%f4, %f6, %f20			! FGA	Group13
-	ldd		[%o1 + 0x030], %f12		! MS
-	faligndata	%f6, %f8, %f22			! FGA	Group14
-	ldd		[%o1 + 0x038], %f14		! MS
-	faligndata	%f8, %f10, %f24			! FGA	Group15
-	cmp		%g1, 0				! A0
-	be,pt		%icc, 1f			! BR
-	 add		%o0, 0x40, %o0			! A1
-	ldd		[%o1 + 0x040], %f0		! MS
-1:	faligndata	%f10, %f12, %f26		! FGA	Group16
-	faligndata	%f12, %f14, %f28		! FGA	Group17
-	faligndata	%f14, %f0, %f30			! FGA	Group18
-	stda		%f16, [%o0] ASI_BLK_P		! MS
-	add		%o0, 0x40, %o0			! A0
-	add		%o1, 0x40, %o1			! A1
+loopfini:
+	ldd		[%o1 + 0x008], %f2
+	faligndata	%f12, %f14, %f28
+	ldd		[%o1 + 0x010], %f4
+	faligndata	%f14, %f0, %f30
+	stda		%f16, [%o0] ASI_BLK_P
+	ldd		[%o1 + 0x018], %f6
+	faligndata	%f0, %f2, %f16
+	ldd		[%o1 + 0x020], %f8
+	faligndata	%f2, %f4, %f18
+	ldd		[%o1 + 0x028], %f10
+	faligndata	%f4, %f6, %f20
+	ldd		[%o1 + 0x030], %f12
+	faligndata	%f6, %f8, %f22
+	ldd		[%o1 + 0x038], %f14
+	faligndata	%f8, %f10, %f24
+	cmp		%g1, 0
+	be,pt		%XCC, 1f
+	 add		%o0, 0x40, %o0
+	ldd		[%o1 + 0x040], %f0
+1:	faligndata	%f10, %f12, %f26
+	faligndata	%f12, %f14, %f28
+	faligndata	%f14, %f0, %f30
+	stda		%f16, [%o0] ASI_BLK_P
+	add		%o0, 0x40, %o0
+	add		%o1, 0x40, %o1
 #ifdef __KERNEL__
 	.globl		U3memcpy_nop_2_3
 U3memcpy_nop_2_3:
@@ -268,161 +191,143 @@
 	stxa		%g0, [%o3] ASI_DMMU		! Flush P-cache
 	stxa		%g3, [%g0] ASI_DCU_CONTROL_REG	! Disable P-cache
 #endif
-	membar		#Sync				! MS	Group26 (7-cycle stall)
+	membar		#Sync
 
 	/* Now we copy the (len modulo 64) bytes at the end.
 	 * Note how we borrow the %f0 loaded above.
 	 *
 	 * Also notice how this code is careful not to perform a
-	 * load past the end of the src buffer just like similar
-	 * code found in U3memcpy_toosmall processing.
+	 * load past the end of the src buffer.
 	 */
-U3memcpy_loopend:
-	and		%o2, 0x3f, %o2			! A0	Group
-	andcc		%o2, 0x38, %g2			! A0	Group
-	be,pn		%icc, U3memcpy_endcruft		! BR
-	 subcc		%g2, 0x8, %g2			! A1
-	be,pn		%icc, U3memcpy_endcruft		! BR	Group
-	 cmp		%g1, 0				! A0
-
-	be,a,pt		%icc, 1f			! BR	Group
-	 ldd		[%o1 + 0x00], %f0		! MS
-
-1:	ldd		[%o1 + 0x08], %f2		! MS	Group
-	add		%o1, 0x8, %o1			! A0
-	sub		%o2, 0x8, %o2			! A1
-	subcc		%g2, 0x8, %g2			! A0	Group
-	faligndata	%f0, %f2, %f8			! FGA	Group
-	std		%f8, [%o0 + 0x00]		! MS	(XXX does it stall here? XXX)
-	be,pn		%icc, U3memcpy_endcruft		! BR
-	 add		%o0, 0x8, %o0			! A0
-	ldd		[%o1 + 0x08], %f0		! MS	Group
-	add		%o1, 0x8, %o1			! A0
-	sub		%o2, 0x8, %o2			! A1
-	subcc		%g2, 0x8, %g2			! A0	Group
-	faligndata	%f2, %f0, %f8			! FGA
-	std		%f8, [%o0 + 0x00]		! MS	(XXX does it stall here? XXX)
-	bne,pn		%icc, 1b			! BR
-	 add		%o0, 0x8, %o0			! A0	Group
+loopend:
+	and		%o2, 0x3f, %o2
+	andcc		%o2, 0x38, %g2
+	be,pn		%XCC, endcruft
+	 subcc		%g2, 0x8, %g2
+	be,pn		%XCC, endcruft
+	 cmp		%g1, 0
+
+	be,a,pt		%XCC, 1f
+	 ldd		[%o1 + 0x00], %f0
+
+1:	ldd		[%o1 + 0x08], %f2
+	add		%o1, 0x8, %o1
+	sub		%o2, 0x8, %o2
+	subcc		%g2, 0x8, %g2
+	faligndata	%f0, %f2, %f8
+	std		%f8, [%o0 + 0x00]
+	be,pn		%XCC, endcruft
+	 add		%o0, 0x8, %o0
+	ldd		[%o1 + 0x08], %f0
+	add		%o1, 0x8, %o1
+	sub		%o2, 0x8, %o2
+	subcc		%g2, 0x8, %g2
+	faligndata	%f2, %f0, %f8
+	std		%f8, [%o0 + 0x00]
+	bne,pn		%XCC, 1b
+	 add		%o0, 0x8, %o0
 
 	/* If anything is left, we copy it one byte at a time.
 	 * Note that %g1 is (src & 0x3) saved above before the
 	 * alignaddr was performed.
 	 */
-U3memcpy_endcruft:
+endcruft:
 	cmp		%o2, 0
 	add		%o1, %g1, %o1
 	VISExitHalf
-	be,pn		%icc, U3memcpy_short_ret
-	 nop
-	ba,a,pt		%xcc, U3memcpy_short
-
-	/* If we get here, then 32 <= len < (6 * 64) */
-U3memcpy_toosmall:
-
-#ifdef SMALL_COPY_USES_FPU
+	be,pn		%XCC, out
+	 sub		%o0, %o1, %o3
 
-	/* Is 'dst' already aligned on an 8-byte boundary? */
-	be,pt		%xcc, 2f			! BR	Group
-
-	/* Compute abs((dst & 7) - 8) into %g2.  This is the number
-	 * of bytes to copy to make 'dst' 8-byte aligned.  We pre-
-	 * subtract this from 'len'.
-	 */
-	 sub		%g2, 0x8, %g2			! A0
-	sub		%g0, %g2, %g2			! A0	Group (reg-dep)
-	sub		%o2, %g2, %o2			! A0	Group (reg-dep)
-
-	/* Copy %g2 bytes from src to dst, one byte at a time. */
-1:	ldub		[%o1 + 0x00], %o3		! MS	(Group) (%o3 in 3 cycles)
-	add		%o1, 0x1, %o1			! A1
-	add		%o0, 0x1, %o0			! A0	Group
-	subcc		%g2, 0x1, %g2			! A1
-
-	bg,pt		%icc, 1b			! BR	Group
-	 stb		%o3, [%o0 + -1]			! MS	Group
-
-2:	VISEntryHalf					! MS+MS
-
-	/* Compute (len - (len % 8)) into %g2.  This is guaranteed
-	 * to be nonzero.
-	 */
-	andn		%o2, 0x7, %g2			! A0	Group
-
-	/* You may read this and believe that it allows reading
-	 * one 8-byte longword past the end of src.  It actually
-	 * does not, as %g2 is subtracted as loads are done from
-	 * src, so we always stop before running off the end.
-	 * Also, we are guaranteed to have at least 0x10 bytes
-	 * to move here.
-	 */
-	sub		%g2, 0x8, %g2			! A0	Group (reg-dep)
-	alignaddr	%o1, %g0, %g1			! MS	      (Break-after)
-	ldd		[%g1 + 0x00], %f0		! MS	Group (1-cycle stall)
-	add		%g1, 0x8, %g1			! A0
-
-1:	ldd		[%g1 + 0x00], %f2		! MS	Group
-	add		%g1, 0x8, %g1			! A0
-	sub		%o2, 0x8, %o2			! A1
-	subcc		%g2, 0x8, %g2			! A0	Group
-
-	faligndata	%f0, %f2, %f8			! FGA	Group (1-cycle stall)
-	std		%f8, [%o0 + 0x00]		! MS	Group (2-cycle stall)
-	add		%o1, 0x8, %o1			! A0
-	be,pn		%icc, 2f			! BR
-
-	 add		%o0, 0x8, %o0			! A1
-	ldd		[%g1 + 0x00], %f0		! MS	Group
-	add		%g1, 0x8, %g1			! A0
-	sub		%o2, 0x8, %o2			! A1
-
-	subcc		%g2, 0x8, %g2			! A0	Group
-	faligndata	%f2, %f0, %f8			! FGA	Group (1-cycle stall)
-	std		%f8, [%o0 + 0x00]		! MS	Group (2-cycle stall)
-	add		%o1, 0x8, %o1			! A0
-
-	bne,pn		%icc, 1b			! BR
-	 add		%o0, 0x8, %o0			! A1
-
-	/* Nothing left to copy? */
-2:	cmp		%o2, 0				! A0	Group
-	VISExitHalf					! A0+MS
-	be,pn		%icc, U3memcpy_short_ret	! BR	Group
-	 nop						! A0
-	ba,a,pt		%xcc, U3memcpy_short		! BR	Group
-
-#else /* !(SMALL_COPY_USES_FPU) */
-
-	xor		%o1, %o0, %g2
-	andcc		%g2, 0x7, %g0
-	bne,pn		%icc, U3memcpy_short
-	 andcc		%o1, 0x7, %g2
+	andcc		%g1, 0x7, %g0
+	bne,pn		%icc, small_copy_unaligned
+	 andcc		%o2, 0x8, %g0
+	be,pt		%icc, 1f
+	 nop
+	ldx		[%o1], %o5
+	stx		%o5, [%o1 + %o3]
+	add		%o1, 0x8, %o1
 
-	be,pt		%xcc, 2f
-	 sub		%g2, 0x8, %g2
-	sub		%g0, %g2, %g2
-	sub		%o2, %g2, %o2
+1:	andcc		%o2, 0x4, %g0
+	be,pt		%icc, 1f
+	 nop
+	lduw		[%o1], %o5
+	stw		%o5, [%o1 + %o3]
+	add		%o1, 0x4, %o1
 
-1:	ldub		[%o1 + 0x00], %o3
-	add		%o1, 0x1, %o1
-	add		%o0, 0x1, %o0
-	subcc		%g2, 0x1, %g2
-	bg,pt		%icc, 1b
-	 stb		%o3, [%o0 + -1]
+1:	andcc		%o2, 0x2, %g0
+	be,pt		%icc, 1f
+	 nop
+	lduh		[%o1], %o5
+	sth		%o5, [%o1 + %o3]
+	add		%o1, 0x2, %o1
 
-2:	andn		%o2, 0x7, %g2
-	sub		%o2, %g2, %o2
+1:	andcc		%o2, 0x1, %g0
+	be,pt		%icc, out
+	 nop
+	ldub		[%o1], %o5
+	ba,pt		%xcc, out
+	 stb		%o5, [%o1 + %o3]
+
+medium_copy: /* 16 < len <= 64 */
+	bne,pn		%XCC, small_copy_unaligned
+	 sub		%o0, %o1, %o3
+
+medium_copy_aligned:
+	andn		%o2, 0x7, %o4
+	and		%o2, 0x7, %o2
+1:	subcc		%o4, 0x8, %o4
+	ldx		[%o1], %o5
+	stx		%o5, [%o1 + %o3]
+	bgu,pt		%XCC, 1b
+	 add		%o1, 0x8, %o1
+	andcc		%o2, 0x4, %g0
+	be,pt		%XCC, 1f
+	 nop
+	sub		%o2, 0x4, %o2
+	lduw		[%o1], %o5
+	stw		%o5, [%o1 + %o3]
+	add		%o1, 0x4, %o1
+1:	cmp		%o2, 0
+	be,pt		%XCC, out
+	 nop
+	ba,pt		%xcc, small_copy_unaligned
+	 nop
 
-3:	ldx		[%o1 + 0x00], %o3
-	add		%o1, 0x8, %o1
-	add		%o0, 0x8, %o0
-	subcc		%g2, 0x8, %g2
-	bg,pt		%icc, 3b
-	 stx		%o3, [%o0 + -8]
+small_copy: /* 0 < len <= 16 */
+	andcc		%o3, 0x3, %g0
+	bne,pn		%XCC, small_copy_unaligned
+	 sub		%o0, %o1, %o3
+
+small_copy_aligned:
+	subcc		%o2, 4, %o2
+	lduw		[%o1], %g1
+	stw		%g1, [%o1 + %o3]
+	bgu,pt		%XCC, small_copy_aligned
+	 add		%o1, 4, %o1
 
-	cmp		%o2, 0
-	bne,pn		%icc, U3memcpy_short
-	 nop
-	ba,a,pt		%xcc, U3memcpy_short_ret
+out:	retl
+	 mov		%g5, %o0
 
-#endif /* !(SMALL_COPY_USES_FPU) */
+	.align	32
+small_copy_unaligned:
+	subcc		%o2, 1, %o2
+	ldub		[%o1], %g1
+	stb		%g1, [%o1 + %o3]
+	bgu,pt		%XCC, small_copy_unaligned
+	 add		%o1, 1, %o1
+	retl
+	 mov		%g5, %o0
+
+	/* Act like copy_{to,in}_user(), ie. return zero instead
+	 * of original destination pointer.  This is invoked when
+	 * copy_{to,in}_user() finds that %asi is kernel space.
+	 */
+	.globl	U3memcpy_user_stub
+U3memcpy_user_stub:
+	save		%sp, -192, %sp
+	mov		%i0, %o0
+	mov		%i1, %o1
+	call		U3memcpy
+	 mov		%i2, %o2
+	ret
+	 restore	%g0, %g0, %o0
diff -urN linux-2.6.8-rc2/arch/sparc64/lib/VIScopy.S linux-2.6.8-rc3/arch/sparc64/lib/VIScopy.S
--- linux-2.6.8-rc2/arch/sparc64/lib/VIScopy.S	2004-06-15 22:18:58.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/lib/VIScopy.S	2004-08-03 15:21:35.603680511 -0700
@@ -306,11 +306,7 @@
 		.globl			__memcpy_begin
 __memcpy_begin:
 
-		.globl			__memcpy
-		.type			__memcpy,@function
-
 memcpy_private:
-__memcpy:
 memcpy:		mov		ASI_P, asi_src			! IEU0	Group
 		brnz,pt		%o2, __memcpy_entry		! CTI
 		 mov		ASI_P, asi_dest			! IEU1
diff -urN linux-2.6.8-rc2/arch/sparc64/lib/splock.S linux-2.6.8-rc3/arch/sparc64/lib/splock.S
--- linux-2.6.8-rc2/arch/sparc64/lib/splock.S	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/lib/splock.S	2004-08-03 15:21:35.604680552 -0700
@@ -6,6 +6,18 @@
 	.text
 	.align	64
 
+	.globl		_raw_spin_lock
+_raw_spin_lock:		/* %o0 = lock_ptr */
+1:	ldstub		[%o0], %g7
+	brnz,pn		%g7, 2f
+	 membar		#StoreLoad | #StoreStore
+	retl
+	 nop
+2:	ldub		[%o0], %g7
+	brnz,pt		%g7, 2b
+	 membar		#LoadLoad
+	ba,a,pt		%xcc, 1b
+
 	.globl	_raw_spin_lock_flags
 _raw_spin_lock_flags:	/* %o0 = lock_ptr, %o1 = irq_flags */
 1:	ldstub		[%o0], %g7
diff -urN linux-2.6.8-rc2/arch/sparc64/solaris/conv.h linux-2.6.8-rc3/arch/sparc64/solaris/conv.h
--- linux-2.6.8-rc2/arch/sparc64/solaris/conv.h	2004-06-15 22:18:56.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/solaris/conv.h	2004-08-03 15:21:35.782687854 -0700
@@ -17,7 +17,7 @@
 	__asm__ ("srl	%0, 0, %0"	\
 		 : "=r" (__ret)		\
 		 : "0" (__x));		\
-	__ret;				\
+	(void __user *)__ret;		\
 })
 
 extern unsigned sys_call_table[];
diff -urN linux-2.6.8-rc2/arch/sparc64/solaris/fs.c linux-2.6.8-rc3/arch/sparc64/solaris/fs.c
--- linux-2.6.8-rc2/arch/sparc64/solaris/fs.c	2004-06-15 22:19:02.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/solaris/fs.c	2004-08-03 15:21:35.783687895 -0700
@@ -79,7 +79,7 @@
 
 #define UFSMAGIC (((unsigned)'u'<<24)||((unsigned)'f'<<16)||((unsigned)'s'<<8))
 
-static inline int putstat(struct sol_stat *ubuf, struct kstat *kbuf)
+static inline int putstat(struct sol_stat __user *ubuf, struct kstat *kbuf)
 {
 	if (kbuf->size > MAX_NON_LFS ||
 	    !sysv_valid_dev(kbuf->dev) ||
@@ -101,12 +101,12 @@
 	    __put_user (kbuf->ctime.tv_nsec, &ubuf->st_ctime.tv_nsec)	||
 	    __put_user (kbuf->blksize, &ubuf->st_blksize)	||
 	    __put_user (kbuf->blocks, &ubuf->st_blocks)	||
-	    __put_user (UFSMAGIC, (unsigned *)ubuf->st_fstype))
+	    __put_user (UFSMAGIC, (unsigned __user *)ubuf->st_fstype))
 		return -EFAULT;
 	return 0;
 }
 
-static inline int putstat64(struct sol_stat64 *ubuf, struct kstat *kbuf)
+static inline int putstat64(struct sol_stat64 __user *ubuf, struct kstat *kbuf)
 {
 	if (!sysv_valid_dev(kbuf->dev) || !sysv_valid_dev(kbuf->rdev))
 		return -EOVERFLOW;
@@ -126,27 +126,17 @@
 	    __put_user (kbuf->ctime.tv_nsec, &ubuf->st_ctime.tv_nsec)	||
 	    __put_user (kbuf->blksize, &ubuf->st_blksize)	||
 	    __put_user (kbuf->blocks, &ubuf->st_blocks)	||
-	    __put_user (UFSMAGIC, (unsigned *)ubuf->st_fstype))
+	    __put_user (UFSMAGIC, (unsigned __user *)ubuf->st_fstype))
 		return -EFAULT;
 	return 0;
 }
 
 asmlinkage int solaris_stat(u32 filename, u32 statbuf)
 {
-	int ret;
 	struct kstat s;
-	char *filenam;
-	mm_segment_t old_fs = get_fs();
-	
-	filenam = getname ((char *)A(filename));
-	ret = PTR_ERR(filenam);
-	if (!IS_ERR(filenam)) {
-		set_fs (KERNEL_DS);
-		ret = vfs_stat(filenam, &s);
-		set_fs (old_fs);
-		putname (filenam);
-		return putstat((struct sol_stat *)A(statbuf), &s);
-	}
+	int ret = vfs_stat(A(filename), &s);
+	if (!ret)
+		return putstat(A(statbuf), &s);
 	return ret;
 }
 
@@ -158,39 +148,19 @@
 
 asmlinkage int solaris_stat64(u32 filename, u32 statbuf)
 {
-	int ret;
 	struct kstat s;
-	char *filenam;
-	mm_segment_t old_fs = get_fs();
-	
-	filenam = getname ((char *)A(filename));
-	ret = PTR_ERR(filenam);
-	if (!IS_ERR(filenam)) {
-		set_fs (KERNEL_DS);
-		ret = vfs_stat(filenam, &s);
-		set_fs (old_fs);
-		putname (filenam);
-		return putstat64((struct sol_stat64 *)A(statbuf), &s);
-	}
+	int ret = vfs_stat(A(filename), &s);
+	if (!ret)
+		return putstat64(A(statbuf), &s);
 	return ret;
 }
 
 asmlinkage int solaris_lstat(u32 filename, u32 statbuf)
 {
-	int ret;
 	struct kstat s;
-	char *filenam;
-	mm_segment_t old_fs = get_fs();
-	
-	filenam = getname ((char *)A(filename));
-	ret = PTR_ERR(filenam);
-	if (!IS_ERR(filenam)) {
-		set_fs (KERNEL_DS);
-		ret = vfs_lstat(filenam, &s);
-		set_fs (old_fs);
-		putname (filenam);
-		return putstat((struct sol_stat *)A(statbuf), &s);
-	}
+	int ret = vfs_lstat(A(filename), &s);
+	if (!ret)
+		return putstat(A(statbuf), &s);
 	return ret;
 }
 
@@ -201,30 +171,19 @@
 
 asmlinkage int solaris_lstat64(u32 filename, u32 statbuf)
 {
-	int ret;
 	struct kstat s;
-	char *filenam;
-	mm_segment_t old_fs = get_fs();
-	
-	filenam = getname ((char *)A(filename));
-	ret = PTR_ERR(filenam);
-	if (!IS_ERR(filenam)) {
-		set_fs (KERNEL_DS);
-		ret = vfs_lstat(filenam, &s);
-		set_fs (old_fs);
-		putname (filenam);
-		return putstat64((struct sol_stat64 *)A(statbuf), &s);
-	}
+	int ret = vfs_lstat(A(filename), &s);
+	if (!ret)
+		return putstat64(A(statbuf), &s);
 	return ret;
 }
 
 asmlinkage int solaris_fstat(unsigned int fd, u32 statbuf)
 {
-	int ret;
 	struct kstat s;
-	ret = vfs_fstat(fd, &s);
+	int ret = vfs_fstat(fd, &s);
 	if (!ret)
-		return putstat((struct sol_stat *)A(statbuf), &s);
+		return putstat(A(statbuf), &s);
 	return ret;
 }
 
@@ -235,27 +194,24 @@
 
 asmlinkage int solaris_fstat64(unsigned int fd, u32 statbuf)
 {
-	int ret;
 	struct kstat s;
-	
-	ret = vfs_fstat(fd, &s);
+	int ret = vfs_fstat(fd, &s);
 	if (!ret)
-		return putstat64((struct sol_stat64 *)A(statbuf), &s);
+		return putstat64(A(statbuf), &s);
 	return ret;
 }
 
 asmlinkage int solaris_mknod(u32 path, u32 mode, s32 dev)
 {
-	int (*sys_mknod)(const char *,int,unsigned) = 
-		(int (*)(const char *,int,unsigned))SYS(mknod);
+	int (*sys_mknod)(const char __user *,int,unsigned) = 
+		(int (*)(const char __user *,int,unsigned))SYS(mknod);
 	int major = sysv_major(dev);
 	int minor = sysv_minor(dev);
 
 	/* minor is guaranteed to be OK for MKDEV, major might be not */
 	if (major > 0xfff)
 		return -EINVAL;
-	return sys_mknod((const char *)A(path), mode,
-				new_encode_dev(MKDEV(major,minor)));
+	return sys_mknod(A(path), mode, new_encode_dev(MKDEV(major,minor)));
 }
 
 asmlinkage int solaris_xmknod(int vers, u32 path, u32 mode, s32 dev)
@@ -263,10 +219,10 @@
 	return solaris_mknod(path, mode, dev);
 }
 
-asmlinkage int solaris_getdents64(unsigned int fd, void *dirent, unsigned int count)
+asmlinkage int solaris_getdents64(unsigned int fd, void __user *dirent, unsigned int count)
 {
-	int (*sys_getdents)(unsigned int, void *, unsigned int) =
-		(int (*)(unsigned int, void *, unsigned int))SYS(getdents);
+	int (*sys_getdents)(unsigned int, void __user *, unsigned int) =
+		(int (*)(unsigned int, void __user *, unsigned int))SYS(getdents);
 		
 	return sys_getdents(fd, dirent, count);
 }
@@ -290,14 +246,15 @@
 	int ret;
 	struct statfs s;
 	mm_segment_t old_fs = get_fs();
-	int (*sys_statfs)(const char *,struct statfs *) = 
-		(int (*)(const char *,struct statfs *))SYS(statfs);
-	struct sol_statfs *ss = (struct sol_statfs *)A(buf);
+	int (*sys_statfs)(const char __user *,struct statfs __user *) = 
+		(int (*)(const char __user *,struct statfs __user *))SYS(statfs);
+	struct sol_statfs __user *ss = A(buf);
 	
 	if (len != sizeof(struct sol_statfs)) return -EINVAL;
 	if (!fstype) {
+		/* FIXME: mixing userland and kernel pointers */
 		set_fs (KERNEL_DS);
-		ret = sys_statfs((const char *)A(path), &s);
+		ret = sys_statfs(A(path), &s);
 		set_fs (old_fs);
 		if (!ret) {
 			if (put_user (s.f_type, &ss->f_type)		||
@@ -332,9 +289,9 @@
 	int ret;
 	struct statfs s;
 	mm_segment_t old_fs = get_fs();
-	int (*sys_fstatfs)(unsigned,struct statfs *) = 
-		(int (*)(unsigned,struct statfs *))SYS(fstatfs);
-	struct sol_statfs *ss = (struct sol_statfs *)A(buf);
+	int (*sys_fstatfs)(unsigned,struct statfs __user *) = 
+		(int (*)(unsigned,struct statfs __user *))SYS(fstatfs);
+	struct sol_statfs __user *ss = A(buf);
 	
 	if (len != sizeof(struct sol_statfs)) return -EINVAL;
 	if (!fstype) {
@@ -396,7 +353,7 @@
 {
 	struct kstatfs s;
 	int error;
-	struct sol_statvfs *ss = (struct sol_statvfs *)A(buf);
+	struct sol_statvfs __user *ss = A(buf);
 
 	error = vfs_statfs(mnt->mnt_sb, &s);
 	if (!error) {
@@ -419,7 +376,7 @@
 		    __put_user (s.f_ffree, &ss->f_favail)	||
 		    __put_user (sysv_encode_dev(inode->i_sb->s_dev), &ss->f_fsid) ||
 		    __copy_to_user (ss->f_basetype,p,j)		||
-		    __put_user (0, (char *)&ss->f_basetype[j])	||
+		    __put_user (0, (char __user *)&ss->f_basetype[j])	||
 		    __put_user (s.f_namelen, &ss->f_namemax)	||
 		    __put_user (i, &ss->f_flag)			||		    
 		    __clear_user (&ss->f_fstr, 32))
@@ -432,7 +389,7 @@
 {
 	struct kstatfs s;
 	int error;
-	struct sol_statvfs64 *ss = (struct sol_statvfs64 *)A(buf);
+	struct sol_statvfs64 __user *ss = A(buf);
 			
 	error = vfs_statfs(mnt->mnt_sb, &s);
 	if (!error) {
@@ -455,7 +412,7 @@
 		    __put_user (s.f_ffree, &ss->f_favail)	||
 		    __put_user (sysv_encode_dev(inode->i_sb->s_dev), &ss->f_fsid) ||
 		    __copy_to_user (ss->f_basetype,p,j)		||
-		    __put_user (0, (char *)&ss->f_basetype[j])	||
+		    __put_user (0, (char __user *)&ss->f_basetype[j])	||
 		    __put_user (s.f_namelen, &ss->f_namemax)	||
 		    __put_user (i, &ss->f_flag)			||		    
 		    __clear_user (&ss->f_fstr, 32))
@@ -469,7 +426,7 @@
 	struct nameidata nd;
 	int error;
 
-	error = user_path_walk((const char *)A(path),&nd);
+	error = user_path_walk(A(path),&nd);
 	if (!error) {
 		struct inode * inode = nd.dentry->d_inode;
 		error = report_statvfs(nd.mnt, inode, buf);
@@ -499,7 +456,7 @@
 	int error;
 
 	lock_kernel();
-	error = user_path_walk((const char *)A(path), &nd);
+	error = user_path_walk(A(path), &nd);
 	if (!error) {
 		struct inode * inode = nd.dentry->d_inode;
 		error = report_statvfs64(nd.mnt, inode, buf);
@@ -594,6 +551,7 @@
 	case SOL_F_SETLKW:
 		{
 			struct flock f;
+			struct sol_flock __user *p = A(arg);
 			mm_segment_t old_fs = get_fs();
 
 			switch (cmd) {
@@ -602,23 +560,23 @@
 			case SOL_F_SETLKW: cmd = F_SETLKW; break;
 			}
 
-			if (get_user (f.l_type, &((struct sol_flock *)A(arg))->l_type) ||
-			    __get_user (f.l_whence, &((struct sol_flock *)A(arg))->l_whence) ||
-			    __get_user (f.l_start, &((struct sol_flock *)A(arg))->l_start) ||
-			    __get_user (f.l_len, &((struct sol_flock *)A(arg))->l_len) ||
-			    __get_user (f.l_pid, &((struct sol_flock *)A(arg))->l_sysid))
+			if (get_user (f.l_type, &p->l_type) ||
+			    __get_user (f.l_whence, &p->l_whence) ||
+			    __get_user (f.l_start, &p->l_start) ||
+			    __get_user (f.l_len, &p->l_len) ||
+			    __get_user (f.l_pid, &p->l_sysid))
 				return -EFAULT;
 
 			set_fs(KERNEL_DS);
 			ret = sys_fcntl(fd, cmd, (unsigned long)&f);
 			set_fs(old_fs);
 
-			if (__put_user (f.l_type, &((struct sol_flock *)A(arg))->l_type) ||
-			    __put_user (f.l_whence, &((struct sol_flock *)A(arg))->l_whence) ||
-			    __put_user (f.l_start, &((struct sol_flock *)A(arg))->l_start) ||
-			    __put_user (f.l_len, &((struct sol_flock *)A(arg))->l_len) ||
-			    __put_user (f.l_pid, &((struct sol_flock *)A(arg))->l_pid) ||
-			    __put_user (0, &((struct sol_flock *)A(arg))->l_sysid))
+			if (__put_user (f.l_type, &p->l_type) ||
+			    __put_user (f.l_whence, &p->l_whence) ||
+			    __put_user (f.l_start, &p->l_start) ||
+			    __put_user (f.l_len, &p->l_len) ||
+			    __put_user (f.l_pid, &p->l_pid) ||
+			    __put_user (0, &p->l_sysid))
 				return -EFAULT;
 
 			return ret;
@@ -629,7 +587,7 @@
 		    int (*sys_newftruncate)(unsigned int, unsigned long)=
 			    (int (*)(unsigned int, unsigned long))SYS(ftruncate);
 
-		    if (get_user(length, &((struct sol_flock*)A(arg))->l_start))
+		    if (get_user(length, &((struct sol_flock __user *)A(arg))->l_start))
 			    return -EFAULT;
 
 		    return sys_newftruncate(fd, length);
@@ -677,18 +635,18 @@
 	return -ENOSYS;
 }
 
-asmlinkage int solaris_pread(unsigned int fd, char *buf, u32 count, u32 pos)
+asmlinkage int solaris_pread(unsigned int fd, char __user *buf, u32 count, u32 pos)
 {
-	ssize_t (*sys_pread64)(unsigned int, char *, size_t, loff_t) =
-		(ssize_t (*)(unsigned int, char *, size_t, loff_t))SYS(pread64);
+	ssize_t (*sys_pread64)(unsigned int, char __user *, size_t, loff_t) =
+		(ssize_t (*)(unsigned int, char __user *, size_t, loff_t))SYS(pread64);
 
 	return sys_pread64(fd, buf, count, (loff_t)pos);
 }
 
-asmlinkage int solaris_pwrite(unsigned int fd, char *buf, u32 count, u32 pos)
+asmlinkage int solaris_pwrite(unsigned int fd, char __user *buf, u32 count, u32 pos)
 {
-	ssize_t (*sys_pwrite64)(unsigned int, char *, size_t, loff_t) =
-		(ssize_t (*)(unsigned int, char *, size_t, loff_t))SYS(pwrite64);
+	ssize_t (*sys_pwrite64)(unsigned int, char __user *, size_t, loff_t) =
+		(ssize_t (*)(unsigned int, char __user *, size_t, loff_t))SYS(pwrite64);
 
 	return sys_pwrite64(fd, buf, count, (loff_t)pos);
 }
@@ -757,8 +715,8 @@
 /* solaris_llseek returns long long - quite difficult */
 asmlinkage long solaris_llseek(struct pt_regs *regs, u32 off_hi, u32 off_lo, int whence)
 {
-	int (*sys_llseek)(unsigned int, unsigned long, unsigned long, loff_t *, unsigned int) =
-		(int (*)(unsigned int, unsigned long, unsigned long, loff_t *, unsigned int))SYS(_llseek);
+	int (*sys_llseek)(unsigned int, unsigned long, unsigned long, loff_t __user *, unsigned int) =
+		(int (*)(unsigned int, unsigned long, unsigned long, loff_t __user *, unsigned int))SYS(_llseek);
 	int ret;
 	mm_segment_t old_fs = get_fs();
 	loff_t retval;
@@ -774,8 +732,8 @@
 /* Have to mask out all but lower 3 bits */
 asmlinkage int solaris_access(u32 filename, long mode)
 {
-	int (*sys_access)(const char *, int) = 
-		(int (*)(const char *, int))SYS(access);
+	int (*sys_access)(const char __user *, int) = 
+		(int (*)(const char __user *, int))SYS(access);
 		
-	return sys_access((const char *)A(filename), mode & 7);
+	return sys_access(A(filename), mode & 7);
 }
diff -urN linux-2.6.8-rc2/arch/sparc64/solaris/ioctl.c linux-2.6.8-rc3/arch/sparc64/solaris/ioctl.c
--- linux-2.6.8-rc2/arch/sparc64/solaris/ioctl.c	2004-06-15 22:19:36.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/solaris/ioctl.c	2004-08-03 15:21:35.785687977 -0700
@@ -39,10 +39,10 @@
 	u32 arg);
 asmlinkage int solaris_ioctl(unsigned int fd, unsigned int cmd, u32 arg);
 
-extern int timod_putmsg(unsigned int fd, char *ctl_buf, int ctl_len,
-			char *data_buf, int data_len, int flags);
-extern int timod_getmsg(unsigned int fd, char *ctl_buf, int ctl_maxlen, int *ctl_len,
-			char *data_buf, int data_maxlen, int *data_len, int *flags);
+extern int timod_putmsg(unsigned int fd, char __user *ctl_buf, int ctl_len,
+			char __user *data_buf, int data_len, int flags);
+extern int timod_getmsg(unsigned int fd, char __user *ctl_buf, int ctl_maxlen, int __user *ctl_len,
+			char __user *data_buf, int data_maxlen, int __user *data_len, int *flags);
 
 /* termio* stuff {{{ */
 
@@ -117,16 +117,17 @@
 
 static inline int linux_to_solaris_termio(unsigned int fd, unsigned int cmd, u32 arg)
 {
+	struct solaris_termio __user *p = A(arg);
 	int ret;
 	
-	ret = sys_ioctl(fd, cmd, A(arg));
+	ret = sys_ioctl(fd, cmd, (unsigned long)p);
 	if (!ret) {
 		u32 cflag;
 		
-		if (__get_user (cflag, &((struct solaris_termio *)A(arg))->c_cflag))
+		if (__get_user (cflag, &p->c_cflag))
 			return -EFAULT;
 		cflag = linux_to_solaris_cflag(cflag);
-		if (__put_user (cflag, &((struct solaris_termio *)A(arg))->c_cflag))
+		if (__put_user (cflag, &p->c_cflag))
 			return -EFAULT;
 	}
 	return ret;
@@ -138,7 +139,7 @@
 	struct solaris_termio s;
 	mm_segment_t old_fs = get_fs();
 	
-	if (copy_from_user (&s, (struct solaris_termio *)A(arg), sizeof(struct solaris_termio)))
+	if (copy_from_user (&s, (struct solaris_termio __user *)A(arg), sizeof(struct solaris_termio)))
 		return -EFAULT;
 	s.c_cflag = solaris_to_linux_cflag(s.c_cflag);
 	set_fs(KERNEL_DS);
@@ -157,12 +158,13 @@
 	ret = sys_ioctl(fd, cmd, (unsigned long)&s);
 	set_fs(old_fs);
 	if (!ret) {
-		if (put_user (s.c_iflag, &((struct solaris_termios *)A(arg))->c_iflag) ||
-		    __put_user (s.c_oflag, &((struct solaris_termios *)A(arg))->c_oflag) ||
-		    __put_user (linux_to_solaris_cflag(s.c_cflag), &((struct solaris_termios *)A(arg))->c_cflag) ||
-		    __put_user (s.c_lflag, &((struct solaris_termios *)A(arg))->c_lflag) ||
-		    __copy_to_user (((struct solaris_termios *)A(arg))->c_cc, s.c_cc, 16) ||
-		    __clear_user (((struct solaris_termios *)A(arg))->c_cc + 16, 2))
+		struct solaris_termios __user *p = A(arg);
+		if (put_user (s.c_iflag, &p->c_iflag) ||
+		    __put_user (s.c_oflag, &p->c_oflag) ||
+		    __put_user (linux_to_solaris_cflag(s.c_cflag), &p->c_cflag) ||
+		    __put_user (s.c_lflag, &p->c_lflag) ||
+		    __copy_to_user (p->c_cc, s.c_cc, 16) ||
+		    __clear_user (p->c_cc + 16, 2))
 			return -EFAULT;
 	}
 	return ret;
@@ -172,17 +174,18 @@
 {
 	int ret;
 	struct solaris_termios s;
+	struct solaris_termios __user *p = A(arg);
 	mm_segment_t old_fs = get_fs();
 
 	set_fs(KERNEL_DS);
 	ret = sys_ioctl(fd, TCGETS, (unsigned long)&s);
 	set_fs(old_fs);
 	if (ret) return ret;
-	if (put_user (s.c_iflag, &((struct solaris_termios *)A(arg))->c_iflag) ||
-	    __put_user (s.c_oflag, &((struct solaris_termios *)A(arg))->c_oflag) ||
-	    __put_user (s.c_cflag, &((struct solaris_termios *)A(arg))->c_cflag) ||
-	    __put_user (s.c_lflag, &((struct solaris_termios *)A(arg))->c_lflag) ||
-	    __copy_from_user (s.c_cc, ((struct solaris_termios *)A(arg))->c_cc, 16))
+	if (put_user (s.c_iflag, &p->c_iflag) ||
+	    __put_user (s.c_oflag, &p->c_oflag) ||
+	    __put_user (s.c_cflag, &p->c_cflag) ||
+	    __put_user (s.c_lflag, &p->c_lflag) ||
+	    __copy_from_user (s.c_cc, p->c_cc, 16))
 		return -EFAULT;
 	s.c_cflag = solaris_to_linux_cflag(s.c_cflag);
 	set_fs(KERNEL_DS);
@@ -305,7 +308,7 @@
 	case 109: /* SI_SOCKPARAMS */
 	{
 		struct solaris_si_sockparams si;
-		if (copy_from_user (&si, (struct solaris_si_sockparams *) A(arg), sizeof(si)))
+		if (copy_from_user (&si, A(arg), sizeof(si)))
 			return (EFAULT << 8) | TSYSERR;
 
 		/* Should we modify socket ino->socket_i.ops and type? */
@@ -314,6 +317,7 @@
 	case 110: /* SI_GETUDATA */
 	{
 		int etsdusize, servtype;
+		struct solaris_si_udata __user *p = A(arg);
 		switch (SOCKET_I(ino)->type) {
 		case SOCK_STREAM:
 			etsdusize = 1;
@@ -324,23 +328,24 @@
 			servtype = 3;
 			break;
 		}
-		if (put_user(16384, &((struct solaris_si_udata *)A(arg))->tidusize) ||
-		    __put_user(sizeof(struct sockaddr), &((struct solaris_si_udata *)A(arg))->addrsize) ||
-		    __put_user(-1, &((struct solaris_si_udata *)A(arg))->optsize) ||
-		    __put_user(etsdusize, &((struct solaris_si_udata *)A(arg))->etsdusize) ||
-		    __put_user(servtype, &((struct solaris_si_udata *)A(arg))->servtype) ||
-		    __put_user(0, &((struct solaris_si_udata *)A(arg))->so_state) ||
-		    __put_user(0, &((struct solaris_si_udata *)A(arg))->so_options) ||
-		    __put_user(16384, &((struct solaris_si_udata *)A(arg))->tsdusize) ||
-		    __put_user(SOCKET_I(ino)->ops->family, &((struct solaris_si_udata *)A(arg))->sockparams.sp_family) ||
-		    __put_user(SOCKET_I(ino)->type, &((struct solaris_si_udata *)A(arg))->sockparams.sp_type) ||
-		    __put_user(SOCKET_I(ino)->ops->family, &((struct solaris_si_udata *)A(arg))->sockparams.sp_protocol))
+		if (put_user(16384, &p->tidusize) ||
+		    __put_user(sizeof(struct sockaddr), &p->addrsize) ||
+		    __put_user(-1, &p->optsize) ||
+		    __put_user(etsdusize, &p->etsdusize) ||
+		    __put_user(servtype, &p->servtype) ||
+		    __put_user(0, &p->so_state) ||
+		    __put_user(0, &p->so_options) ||
+		    __put_user(16384, &p->tsdusize) ||
+		    __put_user(SOCKET_I(ino)->ops->family, &p->sockparams.sp_family) ||
+		    __put_user(SOCKET_I(ino)->type, &p->sockparams.sp_type) ||
+		    __put_user(SOCKET_I(ino)->ops->family, &p->sockparams.sp_protocol))
 			return (EFAULT << 8) | TSYSERR;
 		return 0;
 	}
 	case 101: /* O_SI_GETUDATA */
 	{
 		int etsdusize, servtype;
+		struct solaris_o_si_udata __user *p = A(arg);
 		switch (SOCKET_I(ino)->type) {
 		case SOCK_STREAM:
 			etsdusize = 1;
@@ -351,14 +356,14 @@
 			servtype = 3;
 			break;
 		}
-		if (put_user(16384, &((struct solaris_o_si_udata *)A(arg))->tidusize) ||
-		    __put_user(sizeof(struct sockaddr), &((struct solaris_o_si_udata *)A(arg))->addrsize) ||
-		    __put_user(-1, &((struct solaris_o_si_udata *)A(arg))->optsize) ||
-		    __put_user(etsdusize, &((struct solaris_o_si_udata *)A(arg))->etsdusize) ||
-		    __put_user(servtype, &((struct solaris_o_si_udata *)A(arg))->servtype) ||
-		    __put_user(0, &((struct solaris_o_si_udata *)A(arg))->so_state) ||
-		    __put_user(0, &((struct solaris_o_si_udata *)A(arg))->so_options) ||
-		    __put_user(16384, &((struct solaris_o_si_udata *)A(arg))->tsdusize))
+		if (put_user(16384, &p->tidusize) ||
+		    __put_user(sizeof(struct sockaddr), &p->addrsize) ||
+		    __put_user(-1, &p->optsize) ||
+		    __put_user(etsdusize, &p->etsdusize) ||
+		    __put_user(servtype, &p->servtype) ||
+		    __put_user(0, &p->so_state) ||
+		    __put_user(0, &p->so_options) ||
+		    __put_user(16384, &p->tsdusize))
 			return (EFAULT << 8) | TSYSERR;
 		return 0;
 	}
@@ -375,7 +380,7 @@
 }
 
 static inline int solaris_timod(unsigned int fd, unsigned int cmd, u32 arg,
-                                    int len, int *len_p)
+                                    int len, int __user *len_p)
 {
 	int ret;
 		
@@ -385,25 +390,25 @@
 		int i;
 		u32 prim;
 		SOLD("TI_OPMGMT entry");
-		ret = timod_putmsg(fd, (char *)A(arg), len, NULL, -1, 0);
+		ret = timod_putmsg(fd, A(arg), len, NULL, -1, 0);
 		SOLD("timod_putmsg() returned");
 		if (ret)
 			return (-ret << 8) | TSYSERR;
 		i = MSG_HIPRI;
 		SOLD("calling timod_getmsg()");
-		ret = timod_getmsg(fd, (char *)A(arg), len, len_p, NULL, -1, NULL, &i);
+		ret = timod_getmsg(fd, A(arg), len, len_p, NULL, -1, NULL, &i);
 		SOLD("timod_getmsg() returned");
 		if (ret)
 			return (-ret << 8) | TSYSERR;
 		SOLD("ret ok");
-		if (get_user(prim, (u32 *)A(arg)))
+		if (get_user(prim, (u32 __user *)A(arg)))
 			return (EFAULT << 8) | TSYSERR;
 		SOLD("got prim");
 		if (prim == T_ERROR_ACK) {
 			u32 tmp, tmp2;
 			SOLD("prim is T_ERROR_ACK");
-			if (get_user(tmp, (u32 *)A(arg)+3) ||
-			    get_user(tmp2, (u32 *)A(arg)+2))
+			if (get_user(tmp, (u32 __user *)A(arg)+3) ||
+			    get_user(tmp2, (u32 __user *)A(arg)+2))
 				return (EFAULT << 8) | TSYSERR;
 			return (tmp2 << 8) | tmp;
 		}
@@ -415,26 +420,26 @@
 		int i;
 		u32 prim;
 		SOLD("TI_BIND entry");
-		ret = timod_putmsg(fd, (char *)A(arg), len, NULL, -1, 0);
+		ret = timod_putmsg(fd, A(arg), len, NULL, -1, 0);
 		SOLD("timod_putmsg() returned");
 		if (ret)
 			return (-ret << 8) | TSYSERR;
 		len = 1024; /* Solaris allows arbitrary return size */
 		i = MSG_HIPRI;
 		SOLD("calling timod_getmsg()");
-		ret = timod_getmsg(fd, (char *)A(arg), len, len_p, NULL, -1, NULL, &i);
+		ret = timod_getmsg(fd, A(arg), len, len_p, NULL, -1, NULL, &i);
 		SOLD("timod_getmsg() returned");
 		if (ret)
 			return (-ret << 8) | TSYSERR;
 		SOLD("ret ok");
-		if (get_user(prim, (u32 *)A(arg)))
+		if (get_user(prim, (u32 __user *)A(arg)))
 			return (EFAULT << 8) | TSYSERR;
 		SOLD("got prim");
 		if (prim == T_ERROR_ACK) {
 			u32 tmp, tmp2;
 			SOLD("prim is T_ERROR_ACK");
-			if (get_user(tmp, (u32 *)A(arg)+3) ||
-			    get_user(tmp2, (u32 *)A(arg)+2))
+			if (get_user(tmp, (u32 __user *)A(arg)+3) ||
+			    get_user(tmp2, (u32 __user *)A(arg)+2))
 				return (EFAULT << 8) | TSYSERR;
 			return (tmp2 << 8) | tmp;
 		}
@@ -444,7 +449,7 @@
 		SOLD("OK_ACK requested");
 		i = MSG_HIPRI;
 		SOLD("calling timod_getmsg()");
-		ret = timod_getmsg(fd, (char *)A(arg), len, len_p, NULL, -1, NULL, &i);
+		ret = timod_getmsg(fd, A(arg), len, len_p, NULL, -1, NULL, &i);
 		SOLD("timod_getmsg() returned");
 		if (ret)
 			return (-ret << 8) | TSYSERR;
@@ -491,7 +496,7 @@
 		return -ENOSYS;
 	case 2: /* I_PUSH */
         {
-		p = getname ((char *)A(arg));
+		p = getname (A(arg));
 		if (IS_ERR (p))
 			return PTR_ERR(p);
                 ret = -EINVAL;
@@ -520,14 +525,14 @@
         	const char *p;
                 if (sock->modcount <= 0) return -EINVAL;
                 p = module_table[(unsigned)sock->module[sock->modcount]].name;
-                if (copy_to_user ((char *)A(arg), p, strlen(p)))
+                if (copy_to_user (A(arg), p, strlen(p)))
                 	return -EFAULT;
                 return 0;
         }
 	case 5: /* I_FLUSH */
 		return 0;
 	case 8: /* I_STR */
-		if (copy_from_user(&si, (struct strioctl *)A(arg), sizeof(struct strioctl)))
+		if (copy_from_user(&si, A(arg), sizeof(struct strioctl)))
 			return -EFAULT;
                 /* We ignore what module is actually at the top of stack. */
 		switch ((si.cmd >> 8) & 0xff) {
@@ -535,7 +540,7 @@
                         return solaris_sockmod(fd, si.cmd, si.data);
 		case 'T':
                         return solaris_timod(fd, si.cmd, si.data, si.len,
-                                                &((struct strioctl*)A(arg))->len);
+				&((struct strioctl __user *)A(arg))->len);
 		default:
 			return solaris_ioctl(fd, si.cmd, si.data);
 		}
@@ -551,7 +556,7 @@
 	case 11: /* I_FIND */
         {
                 int i;
-		p = getname ((char *)A(arg));
+		p = getname (A(arg));
 		if (IS_ERR (p))
 			return PTR_ERR(p);
                 ret = 0;
@@ -580,7 +585,7 @@
 		return 0; /* We don't support them */
 	case 1: /* SIOCGHIWAT */
 	case 3: /* SIOCGLOWAT */
-		if (put_user (0, (u32 *)A(arg)))
+		if (put_user (0, (u32 __user *)A(arg)))
 			return -EFAULT;
 		return 0; /* Lie */
 	case 7: /* SIOCATMARK */
@@ -663,7 +668,7 @@
 					args);
 			set_fs(old_fs);
 			if (ret >= 0) {
-				if (copy_to_user((char *)A(arg), &uaddr, uaddr_len))
+				if (copy_to_user(A(arg), &uaddr, uaddr_len))
 					return -EFAULT;
 			}
 			return ret;
@@ -681,7 +686,7 @@
 			for (d = dev_base; d; d = d->next) i++;
 			read_unlock_bh(&dev_base_lock);
 
-			if (put_user (i, (int *)A(arg)))
+			if (put_user (i, (int __user *)A(arg)))
 				return -EFAULT;
 			return 0;
 		}
diff -urN linux-2.6.8-rc2/arch/sparc64/solaris/ipc.c linux-2.6.8-rc3/arch/sparc64/solaris/ipc.c
--- linux-2.6.8-rc2/arch/sparc64/solaris/ipc.c	2004-06-15 22:18:58.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/solaris/ipc.c	2004-08-03 15:21:35.785687977 -0700
@@ -54,8 +54,8 @@
 
 asmlinkage long solaris_shmsys(int cmd, u32 arg1, u32 arg2, u32 arg3)
 {
-	int (*sys_ipc)(unsigned,int,int,unsigned long,void *,long) = 
-		(int (*)(unsigned,int,int,unsigned long,void *,long))SYS(ipc);
+	int (*sys_ipc)(unsigned,int,int,unsigned long,void __user *,long) = 
+		(int (*)(unsigned,int,int,unsigned long,void __user *,long))SYS(ipc);
 	mm_segment_t old_fs;
 	unsigned long raddr;
 	int ret;
@@ -64,7 +64,7 @@
 	case 0: /* shmat */
 		old_fs = get_fs();
 		set_fs(KERNEL_DS);
-		ret = sys_ipc(SHMAT, arg1, arg3 & ~0x4000, (unsigned long)&raddr, (void *)A(arg2), 0);
+		ret = sys_ipc(SHMAT, arg1, arg3 & ~0x4000, (unsigned long)&raddr, A(arg2), 0);
 		set_fs(old_fs);
 		if (ret >= 0) return (u32)raddr;
 		else return ret;
@@ -78,10 +78,11 @@
 		case 11: /* IPC_SET */
 			{
 				struct shmid_ds s;
+				struct solaris_shmid_ds __user *p = A(arg3);
 				
-				if (get_user (s.shm_perm.uid, &(((struct solaris_shmid_ds *)A(arg3))->shm_perm.uid)) ||
-				    __get_user (s.shm_perm.gid, &(((struct solaris_shmid_ds *)A(arg3))->shm_perm.gid)) || 
-				    __get_user (s.shm_perm.mode, &(((struct solaris_shmid_ds *)A(arg3))->shm_perm.mode)))
+				if (get_user (s.shm_perm.uid, &p->shm_perm.uid) ||
+				    __get_user (s.shm_perm.gid, &p->shm_perm.gid) || 
+				    __get_user (s.shm_perm.mode, &p->shm_perm.mode))
 					return -EFAULT;
 				old_fs = get_fs();
 				set_fs(KERNEL_DS);
@@ -92,32 +93,33 @@
 		case 12: /* IPC_STAT */
 			{
 				struct shmid_ds s;
+				struct solaris_shmid_ds __user *p = A(arg3);
 				
 				old_fs = get_fs();
 				set_fs(KERNEL_DS);
 				ret = sys_ipc(SHMCTL, arg1, IPC_SET, 0, &s, 0);
 				set_fs(old_fs);
-				if (get_user (s.shm_perm.uid, &(((struct solaris_shmid_ds *)A(arg3))->shm_perm.uid)) ||
-				    __get_user (s.shm_perm.gid, &(((struct solaris_shmid_ds *)A(arg3))->shm_perm.gid)) || 
-				    __get_user (s.shm_perm.cuid, &(((struct solaris_shmid_ds *)A(arg3))->shm_perm.cuid)) ||
-				    __get_user (s.shm_perm.cgid, &(((struct solaris_shmid_ds *)A(arg3))->shm_perm.cgid)) || 
-				    __get_user (s.shm_perm.mode, &(((struct solaris_shmid_ds *)A(arg3))->shm_perm.mode)) ||
-				    __get_user (s.shm_perm.seq, &(((struct solaris_shmid_ds *)A(arg3))->shm_perm.seq)) ||
-				    __get_user (s.shm_perm.key, &(((struct solaris_shmid_ds *)A(arg3))->shm_perm.key)) ||
-				    __get_user (s.shm_segsz, &(((struct solaris_shmid_ds *)A(arg3))->shm_segsz)) ||
-				    __get_user (s.shm_lpid, &(((struct solaris_shmid_ds *)A(arg3))->shm_lpid)) ||
-				    __get_user (s.shm_cpid, &(((struct solaris_shmid_ds *)A(arg3))->shm_cpid)) ||
-				    __get_user (s.shm_nattch, &(((struct solaris_shmid_ds *)A(arg3))->shm_nattch)) ||
-				    __get_user (s.shm_atime, &(((struct solaris_shmid_ds *)A(arg3))->shm_atime)) ||
-				    __get_user (s.shm_dtime, &(((struct solaris_shmid_ds *)A(arg3))->shm_dtime)) ||
-				    __get_user (s.shm_ctime, &(((struct solaris_shmid_ds *)A(arg3))->shm_ctime)))
+				if (put_user (s.shm_perm.uid, &(p->shm_perm.uid)) ||
+				    __put_user (s.shm_perm.gid, &(p->shm_perm.gid)) || 
+				    __put_user (s.shm_perm.cuid, &(p->shm_perm.cuid)) ||
+				    __put_user (s.shm_perm.cgid, &(p->shm_perm.cgid)) || 
+				    __put_user (s.shm_perm.mode, &(p->shm_perm.mode)) ||
+				    __put_user (s.shm_perm.seq, &(p->shm_perm.seq)) ||
+				    __put_user (s.shm_perm.key, &(p->shm_perm.key)) ||
+				    __put_user (s.shm_segsz, &(p->shm_segsz)) ||
+				    __put_user (s.shm_lpid, &(p->shm_lpid)) ||
+				    __put_user (s.shm_cpid, &(p->shm_cpid)) ||
+				    __put_user (s.shm_nattch, &(p->shm_nattch)) ||
+				    __put_user (s.shm_atime, &(p->shm_atime)) ||
+				    __put_user (s.shm_dtime, &(p->shm_dtime)) ||
+				    __put_user (s.shm_ctime, &(p->shm_ctime)))
 					return -EFAULT;
 				return ret;
 			}
 		default: return -EINVAL;
 		}
 	case 2: /* shmdt */
-		return sys_ipc(SHMDT, 0, 0, 0, (void *)A(arg1), 0);
+		return sys_ipc(SHMDT, 0, 0, 0, A(arg1), 0);
 	case 3: /* shmget */
 		return sys_ipc(SHMGET, arg1, arg2, arg3, NULL, 0);
 	}
diff -urN linux-2.6.8-rc2/arch/sparc64/solaris/misc.c linux-2.6.8-rc3/arch/sparc64/solaris/misc.c
--- linux-2.6.8-rc2/arch/sparc64/solaris/misc.c	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/solaris/misc.c	2004-08-03 15:21:35.787688059 -0700
@@ -121,10 +121,10 @@
 	u32 offlo;
 	
 	if (regs->u_regs[UREG_G1]) {
-		if (get_user (offlo, (u32 *)(long)((u32)regs->u_regs[UREG_I6] + 0x5c)))
+		if (get_user (offlo, (u32 __user *)(long)((u32)regs->u_regs[UREG_I6] + 0x5c)))
 			return -EFAULT;
 	} else {
-		if (get_user (offlo, (u32 *)(long)((u32)regs->u_regs[UREG_I6] + 0x60)))
+		if (get_user (offlo, (u32 __user *)(long)((u32)regs->u_regs[UREG_I6] + 0x60)))
 			return -EFAULT;
 	}
 	return do_solaris_mmap((u32)regs->u_regs[UREG_I0], len, prot, flags, fd, (((u64)offhi)<<32)|offlo);
@@ -148,7 +148,7 @@
 		for (p=from,i=0; *p && *p != '.' && --len; p++,i++); 	\
 	else 								\
 		i = len - 1; 						\
-	if (__put_user('\0', (char *)(to+i)))				\
+	if (__put_user('\0', (char __user *)((to)+i)))			\
 		return -EFAULT;						\
 }
 
@@ -218,21 +218,17 @@
 
 asmlinkage int solaris_utssys(u32 buf, u32 flags, int which, u32 buf2)
 {
+	struct sol_uname __user *v = A(buf);
 	switch (which) {
 	case 0:	/* old uname */
 		/* Let's cheat */
-		set_utsfield(((struct sol_uname *)A(buf))->sysname, 
-			"SunOS", 1, 0);
+		set_utsfield(v->sysname, "SunOS", 1, 0);
 		down_read(&uts_sem);
-		set_utsfield(((struct sol_uname *)A(buf))->nodename, 
-			system_utsname.nodename, 1, 1);
+		set_utsfield(v->nodename, system_utsname.nodename, 1, 1);
 		up_read(&uts_sem);
-		set_utsfield(((struct sol_uname *)A(buf))->release, 
-			"2.6", 0, 0);
-		set_utsfield(((struct sol_uname *)A(buf))->version, 
-			"Generic", 0, 0);
-		set_utsfield(((struct sol_uname *)A(buf))->machine, 
-			machine(), 0, 0);
+		set_utsfield(v->release, "2.6", 0, 0);
+		set_utsfield(v->version, "Generic", 0, 0);
+		set_utsfield(v->machine, machine(), 0, 0);
 		return 0;
 	case 2: /* ustat */
 		return -ENOSYS;
@@ -245,18 +241,14 @@
 
 asmlinkage int solaris_utsname(u32 buf)
 {
+	struct sol_utsname __user *v = A(buf);
 	/* Why should we not lie a bit? */
 	down_read(&uts_sem);
-	set_utsfield(((struct sol_utsname *)A(buf))->sysname, 
-			"SunOS", 0, 0);
-	set_utsfield(((struct sol_utsname *)A(buf))->nodename, 
-			system_utsname.nodename, 1, 1);
-	set_utsfield(((struct sol_utsname *)A(buf))->release, 
-			"5.6", 0, 0);
-	set_utsfield(((struct sol_utsname *)A(buf))->version, 
-			"Generic", 0, 0);
-	set_utsfield(((struct sol_utsname *)A(buf))->machine, 
-			machine(), 0, 0);
+	set_utsfield(v->sysname, "SunOS", 0, 0);
+	set_utsfield(v->nodename, system_utsname.nodename, 1, 1);
+	set_utsfield(v->release, "5.6", 0, 0);
+	set_utsfield(v->version, "Generic", 0, 0);
+	set_utsfield(v->machine, machine(), 0, 0);
 	up_read(&uts_sem);
 	return 0;
 }
@@ -302,11 +294,11 @@
 	}
 	len = strlen(r) + 1;
 	if (count < len) {
-		if (copy_to_user((char *)A(buf), r, count - 1) ||
-		    __put_user(0, (char *)A(buf) + count - 1))
+		if (copy_to_user(A(buf), r, count - 1) ||
+		    __put_user(0, (char __user *)A(buf) + count - 1))
 			return -EFAULT;
 	} else {
-		if (copy_to_user((char *)A(buf), r, len))
+		if (copy_to_user(A(buf), r, len))
 			return -EFAULT;
 	}
 	return len;
@@ -453,7 +445,7 @@
 	u32	rlim_max;
 };
 
-asmlinkage int solaris_getrlimit(unsigned int resource, struct rlimit32 *rlim)
+asmlinkage int solaris_getrlimit(unsigned int resource, struct rlimit32 __user *rlim)
 {
 	struct rlimit r;
 	int ret;
@@ -486,15 +478,15 @@
 	return ret;
 }
 
-asmlinkage int solaris_setrlimit(unsigned int resource, struct rlimit32 *rlim)
+asmlinkage int solaris_setrlimit(unsigned int resource, struct rlimit32 __user *rlim)
 {
 	struct rlimit r, rold;
 	int ret;
 	mm_segment_t old_fs = get_fs ();
-	int (*sys_getrlimit)(unsigned int, struct rlimit *) =
-		(int (*)(unsigned int, struct rlimit *))SYS(getrlimit);
-	int (*sys_setrlimit)(unsigned int, struct rlimit *) =
-		(int (*)(unsigned int, struct rlimit *))SYS(setrlimit);
+	int (*sys_getrlimit)(unsigned int, struct rlimit __user *) =
+		(int (*)(unsigned int, struct rlimit __user *))SYS(getrlimit);
+	int (*sys_setrlimit)(unsigned int, struct rlimit __user *) =
+		(int (*)(unsigned int, struct rlimit __user *))SYS(setrlimit);
 
 	if (resource > RLIMIT_SOL_VMEM)
 		return -EINVAL;	
@@ -527,13 +519,13 @@
 	return ret;
 }
 
-asmlinkage int solaris_getrlimit64(unsigned int resource, struct rlimit *rlim)
+asmlinkage int solaris_getrlimit64(unsigned int resource, struct rlimit __user *rlim)
 {
 	struct rlimit r;
 	int ret;
 	mm_segment_t old_fs = get_fs ();
-	int (*sys_getrlimit)(unsigned int, struct rlimit *) =
-		(int (*)(unsigned int, struct rlimit *))SYS(getrlimit);
+	int (*sys_getrlimit)(unsigned int, struct rlimit __user *) =
+		(int (*)(unsigned int, struct rlimit __user *))SYS(getrlimit);
 
 	if (resource > RLIMIT_SOL_VMEM)
 		return -EINVAL;	
@@ -556,15 +548,15 @@
 	return ret;
 }
 
-asmlinkage int solaris_setrlimit64(unsigned int resource, struct rlimit *rlim)
+asmlinkage int solaris_setrlimit64(unsigned int resource, struct rlimit __user *rlim)
 {
 	struct rlimit r, rold;
 	int ret;
 	mm_segment_t old_fs = get_fs ();
-	int (*sys_getrlimit)(unsigned int, struct rlimit *) =
-		(int (*)(unsigned int, struct rlimit *))SYS(getrlimit);
-	int (*sys_setrlimit)(unsigned int, struct rlimit *) =
-		(int (*)(unsigned int, struct rlimit *))SYS(setrlimit);
+	int (*sys_getrlimit)(unsigned int, struct rlimit __user *) =
+		(int (*)(unsigned int, struct rlimit __user *))SYS(getrlimit);
+	int (*sys_setrlimit)(unsigned int, struct rlimit __user *) =
+		(int (*)(unsigned int, struct rlimit __user *))SYS(setrlimit);
 
 	if (resource > RLIMIT_SOL_VMEM)
 		return -EINVAL;	
@@ -623,10 +615,10 @@
 	s32 stbcnt;
 };
 
-asmlinkage int solaris_ntp_gettime(struct sol_ntptimeval *ntp)
+asmlinkage int solaris_ntp_gettime(struct sol_ntptimeval __user *ntp)
 {
-	int (*sys_adjtimex)(struct timex *) =
-		(int (*)(struct timex *))SYS(adjtimex);
+	int (*sys_adjtimex)(struct timex __user *) =
+		(int (*)(struct timex __user *))SYS(adjtimex);
 	struct timex t;
 	int ret;
 	mm_segment_t old_fs = get_fs();
@@ -644,10 +636,10 @@
 	return ret;	                        
 }
 
-asmlinkage int solaris_ntp_adjtime(struct sol_timex *txp)
+asmlinkage int solaris_ntp_adjtime(struct sol_timex __user *txp)
 {
-	int (*sys_adjtimex)(struct timex *) =
-		(int (*)(struct timex *))SYS(adjtimex);
+	int (*sys_adjtimex)(struct timex __user *) =
+		(int (*)(struct timex __user *))SYS(adjtimex);
 	struct timex t;
 	int ret, err;
 	mm_segment_t old_fs = get_fs();
diff -urN linux-2.6.8-rc2/arch/sparc64/solaris/signal.c linux-2.6.8-rc3/arch/sparc64/solaris/signal.c
--- linux-2.6.8-rc2/arch/sparc64/solaris/signal.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/solaris/signal.c	2004-08-03 15:21:35.788688100 -0700
@@ -76,8 +76,8 @@
 	struct sigaction sa, old;
 	int ret;
 	mm_segment_t old_fs = get_fs();
-	int (*sys_sigaction)(int,struct sigaction *,struct sigaction *) = 
-		(int (*)(int,struct sigaction *,struct sigaction *))SYS(sigaction);
+	int (*sys_sigaction)(int,struct sigaction __user *,struct sigaction __user *) = 
+		(int (*)(int,struct sigaction __user *,struct sigaction __user *))SYS(sigaction);
 	
 	sigemptyset(&sa.sa_mask);
 	sa.sa_restorer = NULL;
@@ -85,10 +85,10 @@
 	sa.sa_flags = 0;
 	if (one_shot) sa.sa_flags = SA_ONESHOT | SA_NOMASK;
 	set_fs (KERNEL_DS);
-	ret = sys_sigaction(sig, &sa, &old);
+	ret = sys_sigaction(sig, (void __user *)&sa, (void __user *)&old);
 	set_fs (old_fs);
 	if (ret < 0) return ret;
-	return (u32)(long)old.sa_handler;
+	return (u32)(unsigned long)old.sa_handler;
 }
 
 static inline long solaris_signal(int sig, u32 arg)
@@ -129,7 +129,7 @@
 
 static inline long solaris_sigignore(int sig)
 {
-	return sig_handler (sig, (u32)SIG_IGN, 0);
+	return sig_handler(sig, (u32)(unsigned long)SIG_IGN, 0);
 }
 
 static inline long solaris_sigpause(int sig)
@@ -207,21 +207,22 @@
 	sigset_t in_s, *ins, out_s, *outs;
 	mm_segment_t old_fs = get_fs();
 	int ret;
-	int (*sys_sigprocmask)(int,sigset_t *,sigset_t *) = 
-		(int (*)(int,sigset_t *,sigset_t *))SYS(sigprocmask);
+	int (*sys_sigprocmask)(int,sigset_t __user *,sigset_t __user *) = 
+		(int (*)(int,sigset_t __user *,sigset_t __user *))SYS(sigprocmask);
 	
 	ins = NULL; outs = NULL;
 	if (in) {
 		u32 tmp[2];
 		
-		if (copy_from_user (tmp, (sol_sigset_t *)A(in), 2*sizeof(u32)))
+		if (copy_from_user (tmp, (void __user *)A(in), 2*sizeof(u32)))
 			return -EFAULT;
 		ins = &in_s;
 		if (mapin (tmp, ins)) return -EINVAL;
 	}
 	if (out) outs = &out_s;
 	set_fs (KERNEL_DS);
-	ret = sys_sigprocmask((how == 3) ? SIG_SETMASK : how, ins, outs);
+	ret = sys_sigprocmask((how == 3) ? SIG_SETMASK : how,
+				(void __user *)ins, (void __user *)outs);
 	set_fs (old_fs);
 	if (ret) return ret;
 	if (out) {
@@ -229,7 +230,7 @@
 		
 		tmp[2] = 0; tmp[3] = 0;
 		if (mapout (outs, tmp)) return -EINVAL;
-		if (copy_to_user((sol_sigset_t *)A(out), tmp, 4*sizeof(u32)))
+		if (copy_to_user((void __user *)A(out), tmp, 4*sizeof(u32)))
 			return -EFAULT;
 	}
 	return 0;
@@ -240,7 +241,7 @@
 	sigset_t s;
 	u32 tmp[2];
 		
-	if (copy_from_user (tmp, (sol_sigset_t *)A(mask), 2*sizeof(u32)))
+	if (copy_from_user (tmp, (sol_sigset_t __user *)A(mask), 2*sizeof(u32)))
 		return -EFAULT;
 	if (mapin (tmp, &s)) return -EINVAL;
 	return (long)s.sig[0];
@@ -259,18 +260,19 @@
 	struct sigaction s, s2;
 	int ret;
 	mm_segment_t old_fs = get_fs();
-	int (*sys_sigaction)(int,struct sigaction *,struct sigaction *) = 
-		(int (*)(int,struct sigaction *,struct sigaction *))SYS(sigaction);
+	struct sol_sigaction __user *p = (void __user *)A(old);
+	int (*sys_sigaction)(int,struct sigaction __user *,struct sigaction __user *) = 
+		(int (*)(int,struct sigaction __user *,struct sigaction __user *))SYS(sigaction);
 	
 	sig = mapsig(sig); 
 	if (sig < 0) {
 		/* We cheat a little bit for Solaris only signals */
-		if (old && clear_user((struct sol_sigaction *)A(old), sizeof(struct sol_sigaction)))
+		if (old && clear_user(p, sizeof(struct sol_sigaction)))
 			return -EFAULT;
 		return 0;
 	}
 	if (act) {
-		if (get_user (tmp, &((struct sol_sigaction *)A(act))->sa_flags))
+		if (get_user (tmp, &p->sa_flags))
 			return -EFAULT;
 		s.sa_flags = 0;
 		if (tmp & SOLARIS_SA_ONSTACK) s.sa_flags |= SA_STACK;
@@ -278,15 +280,16 @@
 		if (tmp & SOLARIS_SA_NODEFER) s.sa_flags |= SA_NOMASK;
 		if (tmp & SOLARIS_SA_RESETHAND) s.sa_flags |= SA_ONESHOT;
 		if (tmp & SOLARIS_SA_NOCLDSTOP) s.sa_flags |= SA_NOCLDSTOP;
-		if (get_user (tmp, &((struct sol_sigaction *)A(act))->sa_handler) ||
-		    copy_from_user (tmp2, &((struct sol_sigaction *)A(act))->sa_mask, 2*sizeof(u32)))
+		if (get_user (tmp, &p->sa_handler) ||
+		    copy_from_user (tmp2, &p->sa_mask, 2*sizeof(u32)))
 			return -EFAULT;
 		s.sa_handler = (__sighandler_t)A(tmp);
 		if (mapin (tmp2, &s.sa_mask)) return -EINVAL;
-		s.sa_restorer = 0;
+		s.sa_restorer = NULL;
 	}
 	set_fs(KERNEL_DS);
-	ret = sys_sigaction(sig, act ? &s : NULL, old ? &s2 : NULL);
+	ret = sys_sigaction(sig, act ? (void __user *)&s : NULL,
+				 old ? (void __user *)&s2 : NULL);
 	set_fs(old_fs);
 	if (ret) return ret;
 	if (old) {
@@ -297,9 +300,9 @@
 		if (s2.sa_flags & SA_NOMASK) tmp |= SOLARIS_SA_NODEFER;
 		if (s2.sa_flags & SA_ONESHOT) tmp |= SOLARIS_SA_RESETHAND;
 		if (s2.sa_flags & SA_NOCLDSTOP) tmp |= SOLARIS_SA_NOCLDSTOP;
-		if (put_user (tmp, &((struct sol_sigaction *)A(old))->sa_flags) ||
-		    __put_user ((u32)(long)s2.sa_handler, &((struct sol_sigaction *)A(old))->sa_handler) ||
-		    copy_to_user (&((struct sol_sigaction *)A(old))->sa_mask, tmp2, 4*sizeof(u32)))
+		if (put_user (tmp, &p->sa_flags) ||
+		    __put_user ((u32)(unsigned long)s2.sa_handler, &p->sa_handler) ||
+		    copy_to_user (&p->sa_mask, tmp2, 4*sizeof(u32)))
 			return -EFAULT;
 	}
 	return 0;
@@ -323,26 +326,27 @@
 	}
 	if (mapout (&s, tmp)) return -EINVAL;
 	tmp[2] = 0; tmp[3] = 0;
-	if (copy_to_user ((u32 *)A(set), tmp, sizeof(tmp)))
+	if (copy_to_user ((u32 __user *)A(set), tmp, sizeof(tmp)))
 		return -EFAULT;
 	return 0;
 }
 
 asmlinkage int solaris_wait(u32 stat_loc)
 {
-	int (*sys_wait4)(pid_t,unsigned int *, int, struct rusage *) =
-		(int (*)(pid_t,unsigned int *, int, struct rusage *))SYS(wait4);
+	unsigned __user *p = (unsigned __user *)A(stat_loc);
+	int (*sys_wait4)(pid_t,unsigned __user *, int, struct rusage __user *) =
+		(int (*)(pid_t,unsigned __user *, int, struct rusage __user *))SYS(wait4);
 	int ret, status;
 	
-	ret = sys_wait4(-1, (unsigned int *)A(stat_loc), WUNTRACED, NULL);
+	ret = sys_wait4(-1, p, WUNTRACED, NULL);
 	if (ret >= 0 && stat_loc) {
-		if (get_user (status, (unsigned int *)A(stat_loc)))
+		if (get_user (status, p))
 			return -EFAULT;
 		if (((status - 1) & 0xffff) < 0xff)
 			status = linux_to_solaris_signals[status & 0x7f] & 0x7f;
 		else if ((status & 0xff) == 0x7f)
 			status = (linux_to_solaris_signals[(status >> 8) & 0xff] << 8) | 0x7f;
-		if (__put_user (status, (unsigned int *)A(stat_loc)))
+		if (__put_user (status, p))
 			return -EFAULT;
 	}
 	return ret;
@@ -350,8 +354,8 @@
 
 asmlinkage int solaris_waitid(int idtype, s32 pid, u32 info, int options)
 {
-	int (*sys_wait4)(pid_t,unsigned int *, int, struct rusage *) =
-		(int (*)(pid_t,unsigned int *, int, struct rusage *))SYS(wait4);
+	int (*sys_wait4)(pid_t,unsigned __user *, int, struct rusage __user *) =
+		(int (*)(pid_t,unsigned __user *, int, struct rusage __user *))SYS(wait4);
 	int opts, status, ret;
 	
 	switch (idtype) {
@@ -364,12 +368,12 @@
 	if (options & SOLARIS_WUNTRACED) opts |= WUNTRACED;
 	if (options & SOLARIS_WNOHANG) opts |= WNOHANG;
 	current->state = TASK_RUNNING;
-	ret = sys_wait4(pid, (unsigned int *)A(info), opts, NULL);
+	ret = sys_wait4(pid, (unsigned int __user *)A(info), opts, NULL);
 	if (ret < 0) return ret;
 	if (info) {
-		struct sol_siginfo *s = (struct sol_siginfo *)A(info);
+		struct sol_siginfo __user *s = (void __user *)A(info);
 	
-		if (get_user (status, (unsigned int *)A(info)))
+		if (get_user (status, (unsigned int __user *)A(info)))
 			return -EFAULT;
 
 		if (__put_user (SOLARIS_SIGCLD, &s->si_signo) ||
diff -urN linux-2.6.8-rc2/arch/sparc64/solaris/socket.c linux-2.6.8-rc3/arch/sparc64/solaris/socket.c
--- linux-2.6.8-rc2/arch/sparc64/solaris/socket.c	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/solaris/socket.c	2004-08-03 15:21:35.788688100 -0700
@@ -132,18 +132,18 @@
 	return sunos_getsockopt(fd, level, optname, optval, optlen);
 }
 
-asmlinkage int solaris_connect(int fd, struct sockaddr *addr, int addrlen)
+asmlinkage int solaris_connect(int fd, struct sockaddr __user *addr, int addrlen)
 {
-	int (*sys_connect)(int, struct sockaddr *, int) =
-		(int (*)(int, struct sockaddr *, int))SYS(connect);
+	int (*sys_connect)(int, struct sockaddr __user *, int) =
+		(int (*)(int, struct sockaddr __user *, int))SYS(connect);
 
 	return sys_connect(fd, addr, addrlen);
 }
 
-asmlinkage int solaris_accept(int fd, struct sockaddr *addr, int *addrlen)
+asmlinkage int solaris_accept(int fd, struct sockaddr __user *addr, int __user *addrlen)
 {
-	int (*sys_accept)(int, struct sockaddr *, int *) =
-		(int (*)(int, struct sockaddr *, int *))SYS(accept);
+	int (*sys_accept)(int, struct sockaddr __user *, int __user *) =
+		(int (*)(int, struct sockaddr __user *, int __user *))SYS(accept);
 
 	return sys_accept(fd, addr, addrlen);
 }
@@ -197,28 +197,28 @@
 	return fl;
 }
 
-asmlinkage int solaris_recvfrom(int s, char *buf, int len, int flags, u32 from, u32 fromlen)
+asmlinkage int solaris_recvfrom(int s, char __user *buf, int len, int flags, u32 from, u32 fromlen)
 {
-	int (*sys_recvfrom)(int, void *, size_t, unsigned, struct sockaddr *, int *) =
-		(int (*)(int, void *, size_t, unsigned, struct sockaddr *, int *))SYS(recvfrom);
+	int (*sys_recvfrom)(int, void __user *, size_t, unsigned, struct sockaddr __user *, int __user *) =
+		(int (*)(int, void __user *, size_t, unsigned, struct sockaddr __user *, int __user *))SYS(recvfrom);
 	
-	return sys_recvfrom(s, buf, len, solaris_to_linux_msgflags(flags), (struct sockaddr *)A(from), (int *)A(fromlen));
+	return sys_recvfrom(s, buf, len, solaris_to_linux_msgflags(flags), A(from), A(fromlen));
 }
 
-asmlinkage int solaris_recv(int s, char *buf, int len, int flags)
+asmlinkage int solaris_recv(int s, char __user *buf, int len, int flags)
 {
-	int (*sys_recvfrom)(int, void *, size_t, unsigned, struct sockaddr *, int *) =
-		(int (*)(int, void *, size_t, unsigned, struct sockaddr *, int *))SYS(recvfrom);
+	int (*sys_recvfrom)(int, void __user *, size_t, unsigned, struct sockaddr __user *, int __user *) =
+		(int (*)(int, void __user *, size_t, unsigned, struct sockaddr __user *, int __user *))SYS(recvfrom);
 	
 	return sys_recvfrom(s, buf, len, solaris_to_linux_msgflags(flags), NULL, NULL);
 }
 
-asmlinkage int solaris_sendto(int s, char *buf, int len, int flags, u32 to, u32 tolen)
+asmlinkage int solaris_sendto(int s, char __user *buf, int len, int flags, u32 to, u32 tolen)
 {
-	int (*sys_sendto)(int, void *, size_t, unsigned, struct sockaddr *, int *) =
-		(int (*)(int, void *, size_t, unsigned, struct sockaddr *, int *))SYS(sendto);
+	int (*sys_sendto)(int, void __user *, size_t, unsigned, struct sockaddr __user *, int __user *) =
+		(int (*)(int, void __user *, size_t, unsigned, struct sockaddr __user *, int __user *))SYS(sendto);
 	
-	return sys_sendto(s, buf, len, solaris_to_linux_msgflags(flags), (struct sockaddr *)A(to), (int *)A(tolen));
+	return sys_sendto(s, buf, len, solaris_to_linux_msgflags(flags), A(to), A(tolen));
 }
 
 asmlinkage int solaris_send(int s, char *buf, int len, int flags)
@@ -269,7 +269,7 @@
 };
 
 static inline int msghdr_from_user32_to_kern(struct msghdr *kmsg,
-					     struct sol_nmsghdr *umsg)
+					     struct sol_nmsghdr __user *umsg)
 {
 	u32 tmp1, tmp2, tmp3;
 	int err;
@@ -280,9 +280,9 @@
 	if (err)
 		return -EFAULT;
 
-	kmsg->msg_name = (void *)A(tmp1);
-	kmsg->msg_iov = (struct iovec *)A(tmp2);
-	kmsg->msg_control = (void *)A(tmp3);
+	kmsg->msg_name = A(tmp1);
+	kmsg->msg_iov = A(tmp2);
+	kmsg->msg_control = A(tmp3);
 
 	err = get_user(kmsg->msg_namelen, &umsg->msg_namelen);
 	err |= get_user(kmsg->msg_controllen, &umsg->msg_controllen);
@@ -293,7 +293,7 @@
 	return err;
 }
 
-asmlinkage int solaris_sendmsg(int fd, struct sol_nmsghdr *user_msg, unsigned user_flags)
+asmlinkage int solaris_sendmsg(int fd, struct sol_nmsghdr __user *user_msg, unsigned user_flags)
 {
 	struct socket *sock;
 	char address[MAX_SOCK_ADDR];
@@ -313,7 +313,7 @@
 	total_len = err;
 
 	if(kern_msg.msg_controllen) {
-		struct sol_cmsghdr *ucmsg = (struct sol_cmsghdr *)kern_msg.msg_control;
+		struct sol_cmsghdr __user *ucmsg = kern_msg.msg_control;
 		unsigned long *kcmsg;
 		compat_size_t cmlen;
 
@@ -356,15 +356,15 @@
 	return err;
 }
 
-asmlinkage int solaris_recvmsg(int fd, struct sol_nmsghdr *user_msg, unsigned int user_flags)
+asmlinkage int solaris_recvmsg(int fd, struct sol_nmsghdr __user *user_msg, unsigned int user_flags)
 {
 	struct iovec iovstack[UIO_FASTIOV];
 	struct msghdr kern_msg;
 	char addr[MAX_SOCK_ADDR];
 	struct socket *sock;
 	struct iovec *iov = iovstack;
-	struct sockaddr *uaddr;
-	int *uaddr_len;
+	struct sockaddr __user *uaddr;
+	int __user *uaddr_len;
 	unsigned long cmsg_ptr;
 	int err, total_len, len = 0;
 
diff -urN linux-2.6.8-rc2/arch/sparc64/solaris/timod.c linux-2.6.8-rc3/arch/sparc64/solaris/timod.c
--- linux-2.6.8-rc2/arch/sparc64/solaris/timod.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/arch/sparc64/solaris/timod.c	2004-08-03 15:21:35.790688182 -0700
@@ -219,7 +219,7 @@
 	SOLD("done");
 }
 
-static int timod_optmgmt(unsigned int fd, int flag, char *opt_buf, int opt_len, int do_ret)
+static int timod_optmgmt(unsigned int fd, int flag, char __user *opt_buf, int opt_len, int do_ret)
 {
 	int error, failed;
 	int ret_space, ret_len;
@@ -337,8 +337,8 @@
 	return 0;
 }
 
-int timod_putmsg(unsigned int fd, char *ctl_buf, int ctl_len,
-			char *data_buf, int data_len, int flags)
+int timod_putmsg(unsigned int fd, char __user *ctl_buf, int ctl_len,
+			char __user *data_buf, int data_len, int flags)
 {
 	int ret, error, terror;
 	char *buf;
@@ -347,15 +347,15 @@
 	struct sol_socket_struct *sock;
 	mm_segment_t old_fs = get_fs();
 	long args[6];
-	int (*sys_socketcall)(int, unsigned long *) =
-		(int (*)(int, unsigned long *))SYS(socketcall);
-	int (*sys_sendto)(int, void *, size_t, unsigned, struct sockaddr *, int) =
-		(int (*)(int, void *, size_t, unsigned, struct sockaddr *, int))SYS(sendto);
+	int (*sys_socketcall)(int, unsigned long __user *) =
+		(int (*)(int, unsigned long __user *))SYS(socketcall);
+	int (*sys_sendto)(int, void __user *, size_t, unsigned, struct sockaddr __user *, int) =
+		(int (*)(int, void __user *, size_t, unsigned, struct sockaddr __user *, int))SYS(sendto);
 	filp = current->files->fd[fd];
 	ino = filp->f_dentry->d_inode;
 	sock = (struct sol_socket_struct *)filp->private_data;
 	SOLD("entry");
-	if (get_user(ret, (int *)A(ctl_buf)))
+	if (get_user(ret, (int __user *)A(ctl_buf)))
 		return -EFAULT;
 	switch (ret) {
 	case T_BIND_REQ:
@@ -596,7 +596,7 @@
 			printk("\n");
 		}
 #endif		
-		err = sys_sendto(fd, data_buf, data_len, 0, req.DEST_length > 0 ? (struct sockaddr*)(ctl_buf+req.DEST_offset) : NULL, req.DEST_length);
+		err = sys_sendto(fd, data_buf, data_len, 0, req.DEST_length > 0 ? (struct sockaddr __user *)(ctl_buf+req.DEST_offset) : NULL, req.DEST_length);
 		if (err == data_len)
 			return 0;
 		if(err >= 0) {
@@ -613,8 +613,8 @@
 	return -EINVAL;
 }
 
-int timod_getmsg(unsigned int fd, char *ctl_buf, int ctl_maxlen, s32 *ctl_len,
-			char *data_buf, int data_maxlen, s32 *data_len, int *flags_p)
+int timod_getmsg(unsigned int fd, char __user *ctl_buf, int ctl_maxlen, s32 __user *ctl_len,
+			char __user *data_buf, int data_maxlen, s32 __user *data_len, int *flags_p)
 {
 	int error;
 	int oldflags;
@@ -624,11 +624,11 @@
 	struct T_unitdata_ind udi;
 	mm_segment_t old_fs = get_fs();
 	long args[6];
-	char *tmpbuf;
+	char __user *tmpbuf;
 	int tmplen;
-	int (*sys_socketcall)(int, unsigned long *) =
-		(int (*)(int, unsigned long *))SYS(socketcall);
-	int (*sys_recvfrom)(int, void *, size_t, unsigned, struct sockaddr *, int *);
+	int (*sys_socketcall)(int, unsigned long __user *) =
+		(int (*)(int, unsigned long __user *))SYS(socketcall);
+	int (*sys_recvfrom)(int, void __user *, size_t, unsigned, struct sockaddr __user *, int __user *);
 	
 	SOLD("entry");
 	SOLDD(("%u %p %d %p %p %d %p %d\n", fd, ctl_buf, ctl_maxlen, ctl_len, data_buf, data_maxlen, data_len, *flags_p));
@@ -808,8 +808,8 @@
 	oldflags = filp->f_flags;
 	filp->f_flags |= O_NONBLOCK;
 	SOLD("calling recvfrom");
-	sys_recvfrom = (int (*)(int, void *, size_t, unsigned, struct sockaddr *, int *))SYS(recvfrom);
-	error = sys_recvfrom(fd, data_buf, data_maxlen, 0, (struct sockaddr*)tmpbuf, ctl_len);
+	sys_recvfrom = (int (*)(int, void __user *, size_t, unsigned, struct sockaddr __user *, int __user *))SYS(recvfrom);
+	error = sys_recvfrom(fd, data_buf, data_maxlen, 0, (struct sockaddr __user *)tmpbuf, ctl_len);
 	filp->f_flags = oldflags;
 	if (error < 0)
 		return error;
@@ -838,9 +838,10 @@
 {
 	struct file *filp;
 	struct inode *ino;
-	struct strbuf *ctlptr, *datptr;
+	struct strbuf __user *ctlptr;
+	struct strbuf __user *datptr;
 	struct strbuf ctl, dat;
-	int *flgptr;
+	int __user *flgptr;
 	int flags;
 	int error = -EBADF;
 
@@ -857,9 +858,9 @@
 	if (!ino->i_sock)
 		goto out;
 
-	ctlptr = (struct strbuf *)A(arg1);
-	datptr = (struct strbuf *)A(arg2);
-	flgptr = (int *)A(arg3);
+	ctlptr = (struct strbuf __user *)A(arg1);
+	datptr = (struct strbuf __user *)A(arg2);
+	flgptr = (int __user *)A(arg3);
 
 	error = -EFAULT;
 
@@ -891,8 +892,8 @@
 		goto out;
 	}
 
-	error = timod_getmsg(fd,(char*)A(ctl.buf),ctl.maxlen,&ctlptr->len,
-				(char*)A(dat.buf),dat.maxlen,&datptr->len,&flags);
+	error = timod_getmsg(fd,A(ctl.buf),ctl.maxlen,&ctlptr->len,
+				A(dat.buf),dat.maxlen,&datptr->len,&flags);
 
 	if (!error && put_user(flags,flgptr))
 		error = -EFAULT;
@@ -906,7 +907,8 @@
 {
 	struct file *filp;
 	struct inode *ino;
-	struct strbuf *ctlptr, *datptr;
+	struct strbuf __user *ctlptr;
+	struct strbuf __user *datptr;
 	struct strbuf ctl, dat;
 	int flags = (int) arg3;
 	int error = -EBADF;
@@ -925,8 +927,8 @@
 		(imajor(ino) != 30 || iminor(ino) != 1))
 		goto out;
 
-	ctlptr = (struct strbuf *)A(arg1);
-	datptr = (struct strbuf *)A(arg2);
+	ctlptr = A(arg1);
+	datptr = A(arg2);
 
 	error = -EFAULT;
 
@@ -950,8 +952,8 @@
 		dat.buf = 0;
 	}
 
-	error = timod_putmsg(fd,(char*)A(ctl.buf),ctl.len,
-				(char*)A(dat.buf),dat.len,flags);
+	error = timod_putmsg(fd,A(ctl.buf),ctl.len,
+				A(dat.buf),dat.len,flags);
 out:
 	unlock_kernel();
 	SOLD("done");
diff -urN linux-2.6.8-rc2/arch/x86_64/ia32/sys_ia32.c linux-2.6.8-rc3/arch/x86_64/ia32/sys_ia32.c
--- linux-2.6.8-rc2/arch/x86_64/ia32/sys_ia32.c	2004-08-03 15:21:06.442484426 -0700
+++ linux-2.6.8-rc3/arch/x86_64/ia32/sys_ia32.c	2004-08-03 15:21:35.904692859 -0700
@@ -885,7 +885,7 @@
 	oldvalp = (void *) A(a32.oldval);
 	newvalp = (void *) A(a32.newval);
 
-	if ((oldvalp && get_user(oldlen, (int *) A(a32.oldlenp)))
+	if ((oldvalp && get_user(oldlen, (int __user *)compat_ptr(a32.oldlenp)))
 	    || !access_ok(VERIFY_WRITE, namep, 0)
 	    || !access_ok(VERIFY_WRITE, oldvalp, 0)
 	    || !access_ok(VERIFY_WRITE, newvalp, 0))
@@ -897,7 +897,7 @@
 	unlock_kernel();
 	set_fs(old_fs);
 
-	if (oldvalp && put_user (oldlen, (int *) A(a32.oldlenp)))
+	if (oldvalp && put_user (oldlen, (int __user *)compat_ptr(a32.oldlenp)))
 		return -EFAULT;
 
 	return ret;
diff -urN linux-2.6.8-rc2/arch/x86_64/kernel/i8259.c linux-2.6.8-rc3/arch/x86_64/kernel/i8259.c
--- linux-2.6.8-rc2/arch/x86_64/kernel/i8259.c	2004-08-03 15:21:06.444484508 -0700
+++ linux-2.6.8-rc3/arch/x86_64/kernel/i8259.c	2004-08-03 15:21:35.906692941 -0700
@@ -75,7 +75,7 @@
 BUILD_16_IRQS(0x8) BUILD_16_IRQS(0x9) BUILD_16_IRQS(0xa) BUILD_16_IRQS(0xb)
 BUILD_16_IRQS(0xc) BUILD_16_IRQS(0xd)
 
-#ifdef CONFIG_PCI_USE_VECTOR
+#ifdef CONFIG_PCI_MSI
 	BUILD_14_IRQS(0xe)
 #endif
 
@@ -110,7 +110,7 @@
 	IRQLIST_16(0x8), IRQLIST_16(0x9), IRQLIST_16(0xa), IRQLIST_16(0xb),
 	IRQLIST_16(0xc), IRQLIST_16(0xd)
 
-#ifdef CONFIG_PCI_USE_VECTOR
+#ifdef CONFIG_PCI_MSI
 	, IRQLIST_14(0xe)
 #endif
 
diff -urN linux-2.6.8-rc2/arch/x86_64/kernel/io_apic.c linux-2.6.8-rc3/arch/x86_64/kernel/io_apic.c
--- linux-2.6.8-rc2/arch/x86_64/kernel/io_apic.c	2004-08-03 15:21:06.446484590 -0700
+++ linux-2.6.8-rc3/arch/x86_64/kernel/io_apic.c	2004-08-03 15:21:35.908693023 -0700
@@ -68,7 +68,7 @@
 } irq_2_pin[PIN_MAP_SIZE];
 
 int vector_irq[NR_VECTORS] = { [0 ... NR_VECTORS - 1] = -1};
-#ifdef CONFIG_PCI_USE_VECTOR
+#ifdef CONFIG_PCI_MSI
 #define vector_to_irq(vector) 	\
 	(platform_legacy_irq(vector) ? vector : vector_irq[vector])
 #else
@@ -656,7 +656,7 @@
 /* irq_vectors is indexed by the sum of all RTEs in all I/O APICs. */
 u8 irq_vector[NR_IRQ_VECTORS] = { FIRST_DEVICE_VECTOR , 0 };
 
-#ifdef CONFIG_PCI_USE_VECTOR
+#ifdef CONFIG_PCI_MSI
 int assign_irq_vector(int irq)
 #else
 int __init assign_irq_vector(int irq)
@@ -1406,7 +1406,7 @@
 	spin_unlock_irqrestore(&ioapic_lock, flags);
 }
 
-#ifdef CONFIG_PCI_USE_VECTOR
+#ifdef CONFIG_PCI_MSI
 static unsigned int startup_edge_ioapic_vector(unsigned int vector)
 {
 	int irq = vector_to_irq(vector);
@@ -1747,7 +1747,7 @@
 		return;
 	}
 	printk(" failed :(.\n");
-	panic("IO-APIC + timer doesn't work! pester mingo@redhat.com");
+	panic("IO-APIC + timer doesn't work! Try using the 'noapic' kernel parameter\n");
 }
 
 /*
diff -urN linux-2.6.8-rc2/arch/x86_64/kernel/mpparse.c linux-2.6.8-rc3/arch/x86_64/kernel/mpparse.c
--- linux-2.6.8-rc2/arch/x86_64/kernel/mpparse.c	2004-08-03 15:21:06.493486515 -0700
+++ linux-2.6.8-rc3/arch/x86_64/kernel/mpparse.c	2004-08-03 15:21:35.971695608 -0700
@@ -44,7 +44,7 @@
 int apic_version [MAX_APICS];
 unsigned char mp_bus_id_to_type [MAX_MP_BUSSES] = { [0 ... MAX_MP_BUSSES-1] = -1 };
 int mp_bus_id_to_pci_bus [MAX_MP_BUSSES] = { [0 ... MAX_MP_BUSSES-1] = -1 };
-cpumask_t mp_bus_to_cpumask [MAX_MP_BUSSES] = { [0 ... MAX_MP_BUSSES-1] = CPU_MASK_ALL };
+cpumask_t pci_bus_to_cpumask [256] = { [0 ... 255] = CPU_MASK_ALL };
 
 int mp_current_pci_id = 0;
 /* I/O APIC entries */
diff -urN linux-2.6.8-rc2/arch/x86_64/kernel/pci-gart.c linux-2.6.8-rc3/arch/x86_64/kernel/pci-gart.c
--- linux-2.6.8-rc2/arch/x86_64/kernel/pci-gart.c	2004-08-03 15:21:06.494486556 -0700
+++ linux-2.6.8-rc3/arch/x86_64/kernel/pci-gart.c	2004-08-03 15:21:35.972695649 -0700
@@ -70,6 +70,8 @@
 static spinlock_t iommu_bitmap_lock = SPIN_LOCK_UNLOCKED;
 static unsigned long *iommu_gart_bitmap; /* guarded by iommu_bitmap_lock */
 
+static u32 gart_unmapped_entry; 
+
 #define GPTE_VALID    1
 #define GPTE_COHERENT 2
 #define GPTE_ENCODE(x) \
@@ -147,8 +149,6 @@
 static void flush_gart(struct pci_dev *dev)
 { 
 	unsigned long flags;
-	int bus = dev ? dev->bus->number : -1;
-	cpumask_t bus_cpumask = pcibus_to_cpumask(bus);
 	int flushed = 0;
 	int i;
 
@@ -158,8 +158,6 @@
 			u32 w;
 			if (!northbridges[i]) 
 				continue;
-			if (bus >= 0 && !(cpu_isset(i, bus_cpumask)))
-				continue;
 			pci_write_config_dword(northbridges[i], 0x9c, 
 					       northbridge_flush_word[i] | 1); 
 			/* Make sure the hardware actually executed the flush. */
@@ -169,7 +167,7 @@
 			flushed++;
 		} 
 		if (!flushed) 
-			printk("nothing to flush? %d\n", bus);
+			printk("nothing to flush?\n");
 		need_flush = 0;
 	} 
 	spin_unlock_irqrestore(&iommu_bitmap_lock, flags);
@@ -479,6 +477,11 @@
 	unsigned long pages = 0;
 	int need = 0, nextneed;
 
+#ifdef CONFIG_SWIOTLB
+	if (swiotlb)
+		return swiotlb_map_sg(&dev->dev,sg,nents,dir);
+#endif
+
 	BUG_ON(dir == PCI_DMA_NONE);
 	if (nents == 0) 
 		return 0;
@@ -562,7 +565,7 @@
 	iommu_page = (dma_addr - iommu_bus_base)>>PAGE_SHIFT;	
 	npages = to_pages(dma_addr, size);
 	for (i = 0; i < npages; i++) { 
-		iommu_gatt_base[iommu_page + i] = 0; 
+		iommu_gatt_base[iommu_page + i] = gart_unmapped_entry; 
 		CLEAR_LEAK(iommu_page + i);
 	}
 	free_iommu(iommu_page, npages);
@@ -729,7 +732,8 @@
 	unsigned long aper_size;
 	unsigned long iommu_start;
 	struct pci_dev *dev;
-		
+	unsigned long scratch;
+	long i;
 
 #ifndef CONFIG_AGP_AMD64
 	no_agp = 1; 
@@ -766,7 +770,7 @@
 			return -1;
 		}
 	} 
-	
+
 	aper_size = info.aper_size * 1024 * 1024;	
 	iommu_size = check_iommu_size(info.aper_base, aper_size); 
 	iommu_pages = iommu_size >> PAGE_SHIFT; 
@@ -815,6 +819,19 @@
 	 */
 	clear_kernel_mapping((unsigned long)__va(iommu_bus_base), iommu_size);
 
+	/* 
+	 * Try to workaround a bug (thanks to BenH) 
+	 * Set unmapped entries to a scratch page instead of 0. 
+	 * Any prefetches that hit unmapped entries won't get an bus abort
+	 * then.
+	 */
+	scratch = get_zeroed_page(GFP_KERNEL); 
+	if (!scratch) 
+		panic("Cannot allocate iommu scratch page");
+	gart_unmapped_entry = GPTE_ENCODE(__pa(scratch));
+	for (i = EMERGENCY_PAGES; i < iommu_pages; i++) 
+		iommu_gatt_base[i] = gart_unmapped_entry;
+
 	for_all_nb(dev) {
 		u32 flag; 
 		int cpu = PCI_SLOT(dev->devfn) - 24;
diff -urN linux-2.6.8-rc2/crypto/Kconfig linux-2.6.8-rc3/crypto/Kconfig
--- linux-2.6.8-rc2/crypto/Kconfig	2004-08-03 15:21:06.543488564 -0700
+++ linux-2.6.8-rc3/crypto/Kconfig	2004-08-03 15:21:36.014697372 -0700
@@ -118,9 +118,9 @@
 	  See also:
 	  http://www.cl.cam.ac.uk/~rja14/serpent.html
 
-config CRYPTO_AES
+config CRYPTO_AES_GENERIC
 	tristate "AES cipher algorithms"
-	depends on CRYPTO
+	depends on CRYPTO && !(X86 && !X86_64)
 	help
 	  AES cipher algorithms (FIPS-197). AES uses the Rijndael 
 	  algorithm.
@@ -138,6 +138,26 @@
 
 	  See http://csrc.nist.gov/CryptoToolkit/aes/ for more information.
 
+config CRYPTO_AES_586
+	tristate "AES cipher algorithms (i586)"
+	depends on CRYPTO && (X86 && !X86_64)
+	help
+	  AES cipher algorithms (FIPS-197). AES uses the Rijndael 
+	  algorithm.
+
+	  Rijndael appears to be consistently a very good performer in
+	  both hardware and software across a wide range of computing 
+	  environments regardless of its use in feedback or non-feedback 
+	  modes. Its key setup time is excellent, and its key agility is 
+	  good. Rijndael's very low memory requirements make it very well 
+	  suited for restricted-space environments, in which it also 
+	  demonstrates excellent performance. Rijndael's operations are 
+	  among the easiest to defend against power and timing attacks.	
+
+	  The AES specifies three key sizes: 128, 192 and 256 bits	  
+
+	  See http://csrc.nist.gov/encryption/aes/ for more information.
+
 config CRYPTO_CAST5
 	tristate "CAST5 (CAST-128) cipher algorithm"
 	depends on CRYPTO
diff -urN linux-2.6.8-rc2/crypto/cipher.c linux-2.6.8-rc3/crypto/cipher.c
--- linux-2.6.8-rc2/crypto/cipher.c	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/crypto/cipher.c	2004-08-03 15:21:36.049698808 -0700
@@ -52,8 +52,8 @@
 {
 	struct scatter_walk walk_in, walk_out;
 	const unsigned int bsize = crypto_tfm_alg_blocksize(tfm);
-	u8 tmp_src[nbytes > src->length ? bsize : 0];
-	u8 tmp_dst[nbytes > dst->length ? bsize : 0];
+	u8 tmp_src[bsize];
+	u8 tmp_dst[bsize];
 
 	if (!nbytes)
 		return 0;
diff -urN linux-2.6.8-rc2/drivers/atm/firestream.c linux-2.6.8-rc3/drivers/atm/firestream.c
--- linux-2.6.8-rc2/drivers/atm/firestream.c	2004-08-03 15:21:06.692494668 -0700
+++ linux-2.6.8-rc3/drivers/atm/firestream.c	2004-08-03 15:21:36.686724940 -0700
@@ -1380,7 +1380,7 @@
 
 	if (alignment <= 0x10) {
 		t = kmalloc (size, flags);
-		if ((unsigned int)t & (alignment-1)) {
+		if ((unsigned long)t & (alignment-1)) {
 			printk ("Kmalloc doesn't align things correctly! %p\n", t);
 			kfree (t);
 			return aligned_kmalloc (size, flags, alignment * 4);
diff -urN linux-2.6.8-rc2/drivers/atm/fore200e.c linux-2.6.8-rc3/drivers/atm/fore200e.c
--- linux-2.6.8-rc2/drivers/atm/fore200e.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/drivers/atm/fore200e.c	2004-08-03 15:21:36.732726827 -0700
@@ -110,8 +110,8 @@
 #endif
 
 
-extern const struct atmdev_ops   fore200e_ops;
-extern const struct fore200e_bus fore200e_bus[];
+static const struct atmdev_ops   fore200e_ops;
+static const struct fore200e_bus fore200e_bus[];
 
 static struct fore200e* fore200e_boards = NULL;
 
diff -urN linux-2.6.8-rc2/drivers/atm/iphase.h linux-2.6.8-rc3/drivers/atm/iphase.h
--- linux-2.6.8-rc2/drivers/atm/iphase.h	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/drivers/atm/iphase.h	2004-08-03 15:21:36.744727320 -0700
@@ -68,8 +68,6 @@
 #define IF_IADBG_SUNI_STAT      0x02000000        // suni statistics
 #define IF_IADBG_RESET          0x04000000        
 
-extern	unsigned int	IADebugFlag;
-
 #define IF_IADBG(f) if (IADebugFlag & (f))
 
 #ifdef  CONFIG_ATM_IA_DEBUG   /* Debug build */
diff -urN linux-2.6.8-rc2/drivers/base/Kconfig linux-2.6.8-rc3/drivers/base/Kconfig
--- linux-2.6.8-rc2/drivers/base/Kconfig	2004-08-03 15:21:06.705495201 -0700
+++ linux-2.6.8-rc3/drivers/base/Kconfig	2004-08-03 15:21:36.760727976 -0700
@@ -1,5 +1,14 @@
 menu "Generic Driver Options"
 
+config STANDALONE
+	bool "Select only drivers that don't need compile-time external firmware" if EXPERIMENTAL
+	default y
+	help
+	  Select this option if you don't have magic firmware for drivers that
+	  need it.
+
+	  If unsure, say Y.
+
 config PREVENT_FIRMWARE_BUILD
 	bool "Prevent firmware from being built"
 	default y
diff -urN linux-2.6.8-rc2/drivers/block/Kconfig linux-2.6.8-rc3/drivers/block/Kconfig
--- linux-2.6.8-rc2/drivers/block/Kconfig	2004-08-03 15:21:06.721495856 -0700
+++ linux-2.6.8-rc3/drivers/block/Kconfig	2004-08-03 15:21:36.968736509 -0700
@@ -33,6 +33,13 @@
 	  Say Y here to support the SWIM (Super Woz Integrated Machine) IOP
 	  floppy controller on the Macintosh IIfx and Quadra 900/950.
 
+config MAC_FLOPPY
+	tristate "Support for PowerMac floppy"
+	depends on PPC_PMAC && !PPC_PMAC64
+	help
+	  If you have a SWIM-3 (Super Woz Integrated Machine 3; from Apple)
+	  floppy controller, say Y here. Most commonly found in PowerMacs.
+
 config BLK_DEV_PS2
 	tristate "PS/2 ESDI hard disk support"
 	depends on MCA && MCA_LEGACY
diff -urN linux-2.6.8-rc2/drivers/block/ataflop.c linux-2.6.8-rc3/drivers/block/ataflop.c
--- linux-2.6.8-rc2/drivers/block/ataflop.c	2004-06-15 22:18:59.000000000 -0700
+++ linux-2.6.8-rc3/drivers/block/ataflop.c	2004-08-03 15:21:37.014738396 -0700
@@ -342,8 +342,6 @@
 static void fd_deselect( void );
 static void fd_motor_off_timer( unsigned long dummy );
 static void check_change( unsigned long dummy );
-static __inline__ void set_head_settle_flag( void );
-static __inline__ int get_head_settle_flag( void );
 static irqreturn_t floppy_irq (int irq, void *dummy, struct pt_regs *fp);
 static void fd_error( void );
 static int do_format(int drive, int type, struct atari_format_descr *desc);
@@ -361,7 +359,6 @@
 static void fd_times_out( unsigned long dummy );
 static void finish_fdc( void );
 static void finish_fdc_done( int dummy );
-static __inline__ void copy_buffer( void *from, void *to);
 static void setup_req_params( int drive );
 static void redo_fd_request( void);
 static int fd_ioctl( struct inode *inode, struct file *filp, unsigned int
@@ -385,27 +382,23 @@
 static struct timer_list fd_timer =
 	TIMER_INITIALIZER(check_change, 0, 0);
 	
-static inline void
-start_motor_off_timer(void)
+static inline void start_motor_off_timer(void)
 {
 	mod_timer(&motor_off_timer, jiffies + FD_MOTOR_OFF_DELAY);
 	MotorOffTrys = 0;
 }
 
-static inline void
-start_check_change_timer( void )
+static inline void start_check_change_timer( void )
 {
 	mod_timer(&fd_timer, jiffies + CHECK_CHANGE_DELAY);
 }
 
-static inline void
-start_timeout(void)
+static inline void start_timeout(void)
 {
 	mod_timer(&timeout_timer, jiffies + FLOPPY_TIMEOUT);
 }
 
-static inline void
-stop_timeout(void)
+static inline void stop_timeout(void)
 {
 	del_timer(&timeout_timer);
 }
@@ -558,18 +551,27 @@
  * seek operation, because we don't use seeks with verify.
  */
 
-static __inline__ void set_head_settle_flag( void )
+static inline void set_head_settle_flag(void)
 {
 	HeadSettleFlag = FDCCMDADD_E;
 }
 
-static __inline__ int get_head_settle_flag( void )
+static inline int get_head_settle_flag(void)
 {
 	int	tmp = HeadSettleFlag;
 	HeadSettleFlag = 0;
 	return( tmp );
 }
 
+static inline void copy_buffer(void *from, void *to)
+{
+	ulong *p1 = (ulong *)from, *p2 = (ulong *)to;
+	int cnt;
+
+	for (cnt = 512/4; cnt; cnt--)
+		*p2++ = *p1++;
+}
+
   
   
 
@@ -1372,15 +1374,6 @@
 	return 0;
 }
 
-static __inline__ void copy_buffer(void *from, void *to)
-{
-	ulong	*p1 = (ulong *)from, *p2 = (ulong *)to;
-	int		cnt;
-
-	for( cnt = 512/4; cnt; cnt-- )
-		*p2++ = *p1++;
-}
-
 
 /* This sets up the global variables describing the current request. */
 
diff -urN linux-2.6.8-rc2/drivers/block/cciss.c linux-2.6.8-rc3/drivers/block/cciss.c
--- linux-2.6.8-rc2/drivers/block/cciss.c	2004-08-03 15:21:06.783498396 -0700
+++ linux-2.6.8-rc3/drivers/block/cciss.c	2004-08-03 15:21:37.071740735 -0700
@@ -37,6 +37,7 @@
 #include <linux/init.h> 
 #include <linux/hdreg.h>
 #include <linux/spinlock.h>
+#include <linux/compat.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
 
@@ -555,12 +556,12 @@
 int cciss_ioctl32_passthru(unsigned int fd, unsigned cmd, unsigned long arg,
 	struct file *file)
 {
-	IOCTL32_Command_struct *arg32 =
-		(IOCTL32_Command_struct *) arg;
+	IOCTL32_Command_struct __user *arg32 =
+		(IOCTL32_Command_struct __user *) arg;
 	IOCTL_Command_struct arg64;
-	mm_segment_t old_fs;
+	IOCTL_Command_struct __user *p = compat_alloc_user_space(sizeof(arg64));
 	int err;
-	unsigned long cp;
+	u32 cp;
 
 	err = 0;
 	err |= copy_from_user(&arg64.LUN_info, &arg32->LUN_info, sizeof(arg64.LUN_info));
@@ -568,31 +569,30 @@
 	err |= copy_from_user(&arg64.error_info, &arg32->error_info, sizeof(arg64.error_info));
 	err |= get_user(arg64.buf_size, &arg32->buf_size);
 	err |= get_user(cp, &arg32->buf);
-	arg64.buf = (BYTE *)cp;
+	arg64.buf = compat_ptr(cp);
+	err |= copy_to_user(p, &arg64, sizeof(arg64));
 
 	if (err)
 		return -EFAULT;
 
-	old_fs = get_fs();
-	set_fs(KERNEL_DS);
-	err = sys_ioctl(fd, CCISS_PASSTHRU, (unsigned long) &arg64);
-	set_fs(old_fs);
+	err = sys_ioctl(fd, CCISS_PASSTHRU, (unsigned long) p);
 	if (err)
 		return err;
-	err |= copy_to_user(&arg32->error_info, &arg64.error_info, sizeof(&arg32->error_info));
+	err |= copy_in_user(&arg32->error_info, &p->error_info, sizeof(&arg32->error_info));
 	if (err)
 		return -EFAULT;
 	return err;
 }
+
 int cciss_ioctl32_big_passthru(unsigned int fd, unsigned cmd, unsigned long arg,
 	struct file *file)
 {
-	BIG_IOCTL32_Command_struct *arg32 =
-		(BIG_IOCTL32_Command_struct *) arg;
+	BIG_IOCTL32_Command_struct __user *arg32 =
+		(BIG_IOCTL32_Command_struct __user *) arg;
 	BIG_IOCTL_Command_struct arg64;
-	mm_segment_t old_fs;
+	BIG_IOCTL_Command_struct __user *p = compat_alloc_user_space(sizeof(arg64));
 	int err;
-	unsigned long cp;
+	u32 cp;
 
 	err = 0;
 	err |= copy_from_user(&arg64.LUN_info, &arg32->LUN_info, sizeof(arg64.LUN_info));
@@ -601,18 +601,16 @@
 	err |= get_user(arg64.buf_size, &arg32->buf_size);
 	err |= get_user(arg64.malloc_size, &arg32->malloc_size);
 	err |= get_user(cp, &arg32->buf);
-	arg64.buf = (BYTE *)cp;
+	arg64.buf = compat_ptr(cp);
+	err |= copy_to_user(p, &arg64, sizeof(arg64));
 
 	if (err)
 		 return -EFAULT;
 
-	old_fs = get_fs();
-	set_fs(KERNEL_DS);
-	err = sys_ioctl(fd, CCISS_BIG_PASSTHRU, (unsigned long) &arg64);
-	set_fs(old_fs);
+	err = sys_ioctl(fd, CCISS_BIG_PASSTHRU, (unsigned long) p);
 	if (err)
 		return err;
-	err |= copy_to_user(&arg32->error_info, &arg64.error_info, sizeof(&arg32->error_info));
+	err |= copy_in_user(&arg32->error_info, &p->error_info, sizeof(&arg32->error_info));
 	if (err)
 		return -EFAULT;
 	return err;
diff -urN linux-2.6.8-rc2/drivers/block/floppy.c linux-2.6.8-rc3/drivers/block/floppy.c
--- linux-2.6.8-rc2/drivers/block/floppy.c	2004-08-03 15:21:06.854501305 -0700
+++ linux-2.6.8-rc3/drivers/block/floppy.c	2004-08-03 15:21:37.173744919 -0700
@@ -4190,7 +4190,7 @@
 		printk("\n");
 	} else
 		DPRINT("botched floppy option\n");
-	DPRINT("Read linux/Documentation/floppy.txt\n");
+	DPRINT("Read Documentation/floppy.txt\n");
 	return 0;
 }
 
diff -urN linux-2.6.8-rc2/drivers/block/ll_rw_blk.c linux-2.6.8-rc3/drivers/block/ll_rw_blk.c
--- linux-2.6.8-rc2/drivers/block/ll_rw_blk.c	2004-08-03 15:21:06.867501838 -0700
+++ linux-2.6.8-rc3/drivers/block/ll_rw_blk.c	2004-08-03 15:21:37.255748283 -0700
@@ -1813,54 +1813,53 @@
  *
  *    A matching blk_rq_unmap_user() must be issued at the end of io, while
  *    still in process context.
+ *
+ *    Note: The mapped bio may need to be bounced through blk_queue_bounce()
+ *    before being submitted to the device, as pages mapped may be out of
+ *    reach. It's the callers responsibility to make sure this happens. The
+ *    original bio must be passed back in to blk_rq_unmap_user() for proper
+ *    unmapping.
  */
 struct request *blk_rq_map_user(request_queue_t *q, int rw, void __user *ubuf,
 				unsigned int len)
 {
-	struct request *rq = NULL;
-	char *buf = NULL;
+	unsigned long uaddr;
+	struct request *rq;
 	struct bio *bio;
-	int ret;
+
+	if (len > (q->max_sectors << 9))
+		return ERR_PTR(-EINVAL);
+	if ((!len && ubuf) || (len && !ubuf))
+		return ERR_PTR(-EINVAL);
 
 	rq = blk_get_request(q, rw, __GFP_WAIT);
 	if (!rq)
 		return ERR_PTR(-ENOMEM);
 
-	bio = bio_map_user(q, NULL, (unsigned long) ubuf, len, rw == READ);
-	if (!bio) {
-		int bytes = (len + 511) & ~511;
-
-		buf = kmalloc(bytes, q->bounce_gfp | GFP_USER);
-		if (!buf) {
-			ret = -ENOMEM;
-			goto fault;
-		}
-
-		if (rw == WRITE) {
-			if (copy_from_user(buf, ubuf, len)) {
-				ret = -EFAULT;
-				goto fault;
-			}
-		} else
-			memset(buf, 0, len);
-	}
+	/*
+	 * if alignment requirement is satisfied, map in user pages for
+	 * direct dma. else, set up kernel bounce buffers
+	 */
+	uaddr = (unsigned long) ubuf;
+	if (!(uaddr & queue_dma_alignment(q)) && !(len & queue_dma_alignment(q)))
+		bio = bio_map_user(q, NULL, uaddr, len, rw == READ);
+	else
+		bio = bio_copy_user(q, uaddr, len, rw == READ);
 
-	rq->bio = rq->biotail = bio;
-	if (rq->bio)
+	if (!IS_ERR(bio)) {
+		rq->bio = rq->biotail = bio;
 		blk_rq_bio_prep(q, rq, bio);
 
-	rq->buffer = rq->data = buf;
-	rq->data_len = len;
-	return rq;
-fault:
-	if (buf)
-		kfree(buf);
-	if (bio)
-		bio_unmap_user(bio, 1);
-	if (rq)
-		blk_put_request(rq);
+		rq->buffer = rq->data = NULL;
+		rq->data_len = len;
+		return rq;
+	}
 
-	return ERR_PTR(ret);
+	/*
+	 * bio is the err-ptr
+	 */
+	blk_put_request(rq);
+	return (struct request *) bio;
 }
 
 EXPORT_SYMBOL(blk_rq_map_user);
@@ -1874,18 +1873,15 @@
  * Description:
  *    Unmap a request previously mapped by blk_rq_map_user().
  */
-int blk_rq_unmap_user(struct request *rq, void __user *ubuf, struct bio *bio,
-		      unsigned int ulen)
+int blk_rq_unmap_user(struct request *rq, struct bio *bio, unsigned int ulen)
 {
-	const int read = rq_data_dir(rq) == READ;
 	int ret = 0;
 
-	if (bio)
-		bio_unmap_user(bio, read);
-	if (rq->buffer) {
-		if (read && copy_to_user(ubuf, rq->buffer, ulen))
-			ret = -EFAULT;
-		kfree(rq->buffer);
+	if (bio) {
+		if (bio_flagged(bio, BIO_USER_MAPPED))
+			bio_unmap_user(bio);
+		else
+			ret = bio_uncopy_user(bio);
 	}
 
 	blk_put_request(rq);
diff -urN linux-2.6.8-rc2/drivers/block/paride/bpck6.c linux-2.6.8-rc3/drivers/block/paride/bpck6.c
--- linux-2.6.8-rc2/drivers/block/paride/bpck6.c	2004-06-15 22:19:36.000000000 -0700
+++ linux-2.6.8-rc3/drivers/block/paride/bpck6.c	2004-08-03 15:21:37.269748858 -0700
@@ -41,7 +41,7 @@
 
  
 
-#define PPCSTRUCT(pi) ((PPC *)(pi->private))
+#define PPCSTRUCT(pi) ((Interface *)(pi->private))
 
 /****************************************************************/
 /*
@@ -224,10 +224,10 @@
 
 static int bpck6_init_proto(PIA *pi)
 {
-	PPC *p = kmalloc(sizeof(PPC), GFP_KERNEL);
+	Interface *p = kmalloc(sizeof(Interface), GFP_KERNEL);
 
 	if (p) {
-		memset(p, 0, sizeof(PPC));
+		memset(p, 0, sizeof(Interface));
 		pi->private = (unsigned long)p;
 		return 0;
 	}
diff -urN linux-2.6.8-rc2/drivers/block/paride/ppc6lnx.c linux-2.6.8-rc3/drivers/block/paride/ppc6lnx.c
--- linux-2.6.8-rc2/drivers/block/paride/ppc6lnx.c	2004-06-15 22:19:36.000000000 -0700
+++ linux-2.6.8-rc3/drivers/block/paride/ppc6lnx.c	2004-08-03 15:21:37.290749719 -0700
@@ -79,7 +79,7 @@
 	u8	org_data;				// original LPT data port contents
 	u8	org_ctrl;				// original LPT control port contents
 	u8	cur_ctrl;				// current control port contents
-} PPC;
+} Interface;
 
 //***************************************************************************
 
@@ -101,25 +101,25 @@
 
 //***************************************************************************
 
-static int ppc6_select(PPC *ppc);
-static void ppc6_deselect(PPC *ppc);
-static void ppc6_send_cmd(PPC *ppc, u8 cmd);
-static void ppc6_wr_data_byte(PPC *ppc, u8 data);
-static u8 ppc6_rd_data_byte(PPC *ppc);
-static u8 ppc6_rd_port(PPC *ppc, u8 port);
-static void ppc6_wr_port(PPC *ppc, u8 port, u8 data);
-static void ppc6_rd_data_blk(PPC *ppc, u8 *data, long count);
-static void ppc6_wait_for_fifo(PPC *ppc);
-static void ppc6_wr_data_blk(PPC *ppc, u8 *data, long count);
-static void ppc6_rd_port16_blk(PPC *ppc, u8 port, u8 *data, long length);
-static void ppc6_wr_port16_blk(PPC *ppc, u8 port, u8 *data, long length);
-static void ppc6_wr_extout(PPC *ppc, u8 regdata);
-static int ppc6_open(PPC *ppc);
-static void ppc6_close(PPC *ppc);
+static int ppc6_select(Interface *ppc);
+static void ppc6_deselect(Interface *ppc);
+static void ppc6_send_cmd(Interface *ppc, u8 cmd);
+static void ppc6_wr_data_byte(Interface *ppc, u8 data);
+static u8 ppc6_rd_data_byte(Interface *ppc);
+static u8 ppc6_rd_port(Interface *ppc, u8 port);
+static void ppc6_wr_port(Interface *ppc, u8 port, u8 data);
+static void ppc6_rd_data_blk(Interface *ppc, u8 *data, long count);
+static void ppc6_wait_for_fifo(Interface *ppc);
+static void ppc6_wr_data_blk(Interface *ppc, u8 *data, long count);
+static void ppc6_rd_port16_blk(Interface *ppc, u8 port, u8 *data, long length);
+static void ppc6_wr_port16_blk(Interface *ppc, u8 port, u8 *data, long length);
+static void ppc6_wr_extout(Interface *ppc, u8 regdata);
+static int ppc6_open(Interface *ppc);
+static void ppc6_close(Interface *ppc);
 
 //***************************************************************************
 
-static int ppc6_select(PPC *ppc)
+static int ppc6_select(Interface *ppc)
 {
 	u8 i, j, k;
 
@@ -205,7 +205,7 @@
 
 //***************************************************************************
 
-static void ppc6_deselect(PPC *ppc)
+static void ppc6_deselect(Interface *ppc)
 {
 	if (ppc->mode & 4)	// EPP
 		ppc->cur_ctrl |= port_init;
@@ -223,7 +223,7 @@
 
 //***************************************************************************
 
-static void ppc6_send_cmd(PPC *ppc, u8 cmd)
+static void ppc6_send_cmd(Interface *ppc, u8 cmd)
 {
 	switch(ppc->mode)
 	{
@@ -254,7 +254,7 @@
 
 //***************************************************************************
 
-static void ppc6_wr_data_byte(PPC *ppc, u8 data)
+static void ppc6_wr_data_byte(Interface *ppc, u8 data)
 {
 	switch(ppc->mode)
 	{
@@ -285,7 +285,7 @@
 
 //***************************************************************************
 
-static u8 ppc6_rd_data_byte(PPC *ppc)
+static u8 ppc6_rd_data_byte(Interface *ppc)
 {
 	u8 data = 0;
 
@@ -358,7 +358,7 @@
 
 //***************************************************************************
 
-static u8 ppc6_rd_port(PPC *ppc, u8 port)
+static u8 ppc6_rd_port(Interface *ppc, u8 port)
 {
 	ppc6_send_cmd(ppc,(u8)(port | ACCESS_PORT | ACCESS_READ));
 
@@ -367,7 +367,7 @@
 
 //***************************************************************************
 
-static void ppc6_wr_port(PPC *ppc, u8 port, u8 data)
+static void ppc6_wr_port(Interface *ppc, u8 port, u8 data)
 {
 	ppc6_send_cmd(ppc,(u8)(port | ACCESS_PORT | ACCESS_WRITE));
 
@@ -376,7 +376,7 @@
 
 //***************************************************************************
 
-static void ppc6_rd_data_blk(PPC *ppc, u8 *data, long count)
+static void ppc6_rd_data_blk(Interface *ppc, u8 *data, long count)
 {
 	switch(ppc->mode)
 	{
@@ -512,7 +512,7 @@
 
 //***************************************************************************
 
-static void ppc6_wait_for_fifo(PPC *ppc)
+static void ppc6_wait_for_fifo(Interface *ppc)
 {
 	int i;
 
@@ -525,7 +525,7 @@
 
 //***************************************************************************
 
-static void ppc6_wr_data_blk(PPC *ppc, u8 *data, long count)
+static void ppc6_wr_data_blk(Interface *ppc, u8 *data, long count)
 {
 	switch(ppc->mode)
 	{
@@ -644,7 +644,7 @@
 
 //***************************************************************************
 
-static void ppc6_rd_port16_blk(PPC *ppc, u8 port, u8 *data, long length)
+static void ppc6_rd_port16_blk(Interface *ppc, u8 port, u8 *data, long length)
 {
 	length = length << 1;
 
@@ -664,7 +664,7 @@
 
 //***************************************************************************
 
-static void ppc6_wr_port16_blk(PPC *ppc, u8 port, u8 *data, long length)
+static void ppc6_wr_port16_blk(Interface *ppc, u8 port, u8 *data, long length)
 {
 	length = length << 1;
 
@@ -684,7 +684,7 @@
 
 //***************************************************************************
 
-static void ppc6_wr_extout(PPC *ppc, u8 regdata)
+static void ppc6_wr_extout(Interface *ppc, u8 regdata)
 {
 	ppc6_send_cmd(ppc,(REG_VERSION | ACCESS_REG | ACCESS_WRITE));
 
@@ -693,7 +693,7 @@
 
 //***************************************************************************
 
-static int ppc6_open(PPC *ppc)
+static int ppc6_open(Interface *ppc)
 {
 	int ret;
 
@@ -717,7 +717,7 @@
 
 //***************************************************************************
 
-static void ppc6_close(PPC *ppc)
+static void ppc6_close(Interface *ppc)
 {
 	ppc6_deselect(ppc);
 }
diff -urN linux-2.6.8-rc2/drivers/block/scsi_ioctl.c linux-2.6.8-rc3/drivers/block/scsi_ioctl.c
--- linux-2.6.8-rc2/drivers/block/scsi_ioctl.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/drivers/block/scsi_ioctl.c	2004-08-03 15:21:37.339751729 -0700
@@ -170,6 +170,13 @@
 	rq->flags |= REQ_BLOCK_PC;
 	bio = rq->bio;
 
+	/*
+	 * bounce this after holding a reference to the original bio, it's
+	 * needed for proper unmapping
+	 */
+	if (rq->bio)
+		blk_queue_bounce(q, &rq->bio);
+
 	rq->timeout = (hdr->timeout * HZ) / 1000;
 	if (!rq->timeout)
 		rq->timeout = q->sg_timeout;
@@ -204,7 +211,7 @@
 			hdr->sb_len_wr = len;
 	}
 
-	if (blk_rq_unmap_user(rq, hdr->dxferp, bio, hdr->dxfer_len))
+	if (blk_rq_unmap_user(rq, bio, hdr->dxfer_len))
 		return -EFAULT;
 
 	/* may not have succeeded, but output values written to control
diff -urN linux-2.6.8-rc2/drivers/block/swim3.c linux-2.6.8-rc3/drivers/block/swim3.c
--- linux-2.6.8-rc2/drivers/block/swim3.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/drivers/block/swim3.c	2004-08-03 15:21:37.340751770 -0700
@@ -1058,6 +1058,7 @@
 		disk->fops = &floppy_fops;
 		disk->private_data = &floppy_states[i];
 		disk->queue = swim3_queue;
+		disk->flags |= GENHD_FL_REMOVABLE;
 		sprintf(disk->disk_name, "fd%d", i);
 		sprintf(disk->devfs_name, "floppy/%d", i);
 		set_capacity(disk, 2880);
diff -urN linux-2.6.8-rc2/drivers/bluetooth/bluecard_cs.c linux-2.6.8-rc3/drivers/bluetooth/bluecard_cs.c
--- linux-2.6.8-rc2/drivers/bluetooth/bluecard_cs.c	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/drivers/bluetooth/bluecard_cs.c	2004-08-03 15:21:37.371753042 -0700
@@ -28,6 +28,7 @@
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/sched.h>
+#include <linux/delay.h>
 #include <linux/timer.h>
 #include <linux/errno.h>
 #include <linux/ptrace.h>
@@ -776,8 +777,7 @@
 	outb(0x80, iobase + 0x30);
 
 	/* Wait some time */
-	set_current_state(TASK_INTERRUPTIBLE);
-	schedule_timeout(HZ / 100);
+	msleep(10);
 
 	/* Turn FPGA on */
 	outb(0x00, iobase + 0x30);
@@ -823,8 +823,7 @@
 	outb((0x0f << RTS_LEVEL_SHIFT_BITS) | 1, iobase + REG_RX_CONTROL);
 
 	/* Timeout before it is safe to send the first HCI packet */
-	set_current_state(TASK_INTERRUPTIBLE);
-	schedule_timeout((HZ * 5) / 4);		// or set it to 3/2
+	msleep(1250);
 
 	/* Register HCI device */
 	if (hci_register_dev(hdev) < 0) {
diff -urN linux-2.6.8-rc2/drivers/bluetooth/bt3c_cs.c linux-2.6.8-rc3/drivers/bluetooth/bt3c_cs.c
--- linux-2.6.8-rc2/drivers/bluetooth/bt3c_cs.c	2004-08-03 15:21:06.879502329 -0700
+++ linux-2.6.8-rc3/drivers/bluetooth/bt3c_cs.c	2004-08-03 15:21:37.378753329 -0700
@@ -25,12 +25,11 @@
 #include <linux/module.h>
 
 #include <linux/kernel.h>
-#include <linux/kmod.h>
 #include <linux/init.h>
 #include <linux/slab.h>
-#include <linux/delay.h>
 #include <linux/types.h>
 #include <linux/sched.h>
+#include <linux/delay.h>
 #include <linux/errno.h>
 #include <linux/ptrace.h>
 #include <linux/ioport.h>
@@ -639,8 +638,7 @@
 	}
 
 	/* Timeout before it is safe to send the first HCI packet */
-	set_current_state(TASK_INTERRUPTIBLE);
-	schedule_timeout(HZ);
+	msleep(1000);
 
 	/* Register HCI device */
 	err = hci_register_dev(hdev);
diff -urN linux-2.6.8-rc2/drivers/bluetooth/btuart_cs.c linux-2.6.8-rc3/drivers/bluetooth/btuart_cs.c
--- linux-2.6.8-rc2/drivers/bluetooth/btuart_cs.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/drivers/bluetooth/btuart_cs.c	2004-08-03 15:21:37.397754109 -0700
@@ -28,6 +28,7 @@
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/sched.h>
+#include <linux/delay.h>
 #include <linux/errno.h>
 #include <linux/ptrace.h>
 #include <linux/ioport.h>
@@ -545,8 +546,7 @@
 	btuart_change_speed(info, DEFAULT_BAUD_RATE);
 
 	/* Timeout before it is safe to send the first HCI packet */
-	set_current_state(TASK_INTERRUPTIBLE);
-	schedule_timeout(HZ);
+	msleep(1000);
 
 	/* Register HCI device */
 	if (hci_register_dev(hdev) < 0) {
diff -urN linux-2.6.8-rc2/drivers/bluetooth/dtl1_cs.c linux-2.6.8-rc3/drivers/bluetooth/dtl1_cs.c
--- linux-2.6.8-rc2/drivers/bluetooth/dtl1_cs.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/drivers/bluetooth/dtl1_cs.c	2004-08-03 15:21:37.398754150 -0700
@@ -28,6 +28,7 @@
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/sched.h>
+#include <linux/delay.h>
 #include <linux/errno.h>
 #include <linux/ptrace.h>
 #include <linux/ioport.h>
@@ -524,8 +525,7 @@
 	spin_unlock_irqrestore(&(info->lock), flags);
 
 	/* Timeout before it is safe to send the first HCI packet */
-	set_current_state(TASK_INTERRUPTIBLE);
-	schedule_timeout(HZ * 2);
+	msleep(2000);
 
 	/* Register HCI device */
 	if (hci_register_dev(hdev) < 0) {
diff -urN linux-2.6.8-rc2/drivers/bluetooth/hci_bcsp.c linux-2.6.8-rc3/drivers/bluetooth/hci_bcsp.c
--- linux-2.6.8-rc2/drivers/bluetooth/hci_bcsp.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/drivers/bluetooth/hci_bcsp.c	2004-08-03 15:21:37.404754396 -0700
@@ -633,7 +633,8 @@
 	struct sk_buff *skb;
 	unsigned long flags;
 
-	BT_ERR("Timeout, retransmitting %u pkts", bcsp->unack.qlen);
+	BT_DBG("hu %p retransmitting %u pkts", hu, bcsp->unack.qlen);
+
 	spin_lock_irqsave(&bcsp->unack.lock, flags);
 
 	while ((skb = __skb_dequeue_tail(&bcsp->unack)) != NULL) {
diff -urN linux-2.6.8-rc2/drivers/bluetooth/hci_usb.c linux-2.6.8-rc3/drivers/bluetooth/hci_usb.c
--- linux-2.6.8-rc2/drivers/bluetooth/hci_usb.c	2004-06-15 22:20:03.000000000 -0700
+++ linux-2.6.8-rc3/drivers/bluetooth/hci_usb.c	2004-08-03 15:21:37.406754478 -0700
@@ -65,7 +65,7 @@
 #define URB_ZERO_PACKET 0
 #endif
 
-#define VERSION "2.6"
+#define VERSION "2.7"
 
 static struct usb_driver hci_usb_driver; 
 
@@ -76,14 +76,15 @@
 	/* AVM BlueFRITZ! USB v2.0 */
 	{ USB_DEVICE(0x057c, 0x3800) },
 
-	/* Ericsson with non-standard id */
-	{ USB_DEVICE(0x0bdb, 0x1002) },
+	/* Bluetooth Ultraport Module from IBM */
+	{ USB_DEVICE(0x04bf, 0x030a) },
 
-	/* ALPS Module with non-standard id */
+	/* ALPS Modules with non-standard id */
+	{ USB_DEVICE(0x044e, 0x3001) },
 	{ USB_DEVICE(0x044e, 0x3002) },
 
-	/* Bluetooth Ultraport Module from IBM */
-	{ USB_DEVICE(0x04bf, 0x030a) },
+	/* Ericsson with non-standard id */
+	{ USB_DEVICE(0x0bdb, 0x1002) },
 
 	{ }	/* Terminating entry */
 };
@@ -97,6 +98,9 @@
 	/* Broadcom BCM2035 */
 	{ USB_DEVICE(0x0a5c, 0x200a), .driver_info = HCI_RESET },
 
+	/* ISSC Bluetooth Adapter v3.1 */
+	{ USB_DEVICE(0x1131, 0x1001), .driver_info = HCI_RESET },
+
 	/* Digianswer device */
 	{ USB_DEVICE(0x08fd, 0x0001), .driver_info = HCI_DIGIANSWER },
 
@@ -338,26 +342,18 @@
 
 	BT_DBG("%s", hdev->name);
 
-	for (i=0; i < 4; i++)
+	for (i = 0; i < 4; i++)
 		skb_queue_purge(&husb->transmit_q[i]);
 	return 0;
 }
 
-static inline void hci_usb_wait_for_urb(struct urb *urb)
-{
-	while (atomic_read(&urb->kref.refcount) > 1) {
-		current->state = TASK_UNINTERRUPTIBLE;
-		schedule_timeout((5 * HZ + 999) / 1000);
-	}
-}
-
 static void hci_usb_unlink_urbs(struct hci_usb *husb)
 {
 	int i;
 
 	BT_DBG("%s", husb->hdev->name);
 
-	for (i=0; i < 4; i++) {
+	for (i = 0; i < 4; i++) {
 		struct _urb *_urb;
 		struct urb *urb;
 
@@ -366,8 +362,7 @@
 			urb = &_urb->urb;
 			BT_DBG("%s unlinking _urb %p type %d urb %p", 
 					husb->hdev->name, _urb, _urb->type, urb);
-			usb_unlink_urb(urb);
-			hci_usb_wait_for_urb(urb);
+			usb_kill_urb(urb);
 			_urb_queue_tail(__completed_q(husb, _urb->type), _urb);
 		}
 
diff -urN linux-2.6.8-rc2/drivers/cdrom/aztcd.c linux-2.6.8-rc3/drivers/cdrom/aztcd.c
--- linux-2.6.8-rc2/drivers/cdrom/aztcd.c	2004-06-15 22:20:03.000000000 -0700
+++ linux-2.6.8-rc3/drivers/cdrom/aztcd.c	2004-08-03 15:21:37.408754560 -0700
@@ -129,7 +129,7 @@
                 Werner Zimmermann, August 8, 1995
         V1.70   Multisession support now is completed, but there is still not 
                 enough testing done. If you can test it, please contact me. For
-                details please read /usr/src/linux/Documentation/cdrom/aztcd
+                details please read Documentation/cdrom/aztcd
                 Werner Zimmermann, August 19, 1995
         V1.80   Modification to suit the new kernel boot procedure introduced
                 with kernel 1.3.33. Will definitely not work with older kernels.
diff -urN linux-2.6.8-rc2/drivers/cdrom/cdrom.c linux-2.6.8-rc3/drivers/cdrom/cdrom.c
--- linux-2.6.8-rc2/drivers/cdrom/cdrom.c	2004-08-03 15:21:06.882502452 -0700
+++ linux-2.6.8-rc3/drivers/cdrom/cdrom.c	2004-08-03 15:21:37.444756037 -0700
@@ -1921,6 +1921,8 @@
 	struct packet_command cgc;
 	int nr, ret;
 
+	cdi->last_sense = 0;
+
 	memset(&cgc, 0, sizeof(cgc));
 
 	/*
@@ -1972,6 +1974,8 @@
 	if (!q)
 		return -ENXIO;
 
+	cdi->last_sense = 0;
+
 	while (nframes) {
 		nr = nframes;
 		if (cdi->cdda_method == CDDA_BPC_SINGLE)
@@ -2002,13 +2006,16 @@
 		rq->timeout = 60 * HZ;
 		bio = rq->bio;
 
+		if (rq->bio)
+			blk_queue_bounce(q, &rq->bio);
+
 		if (blk_execute_rq(q, cdi->disk, rq)) {
 			struct request_sense *s = rq->sense;
 			ret = -EIO;
 			cdi->last_sense = s->sense_key;
 		}
 
-		if (blk_rq_unmap_user(rq, ubuf, bio, len))
+		if (blk_rq_unmap_user(rq, bio, len))
 			ret = -EFAULT;
 
 		if (ret)
@@ -2016,6 +2023,7 @@
 
 		nframes -= nr;
 		lba += nr;
+		ubuf += len;
 	}
 
 	return ret;
diff -urN linux-2.6.8-rc2/drivers/cdrom/optcd.c linux-2.6.8-rc3/drivers/cdrom/optcd.c
--- linux-2.6.8-rc2/drivers/cdrom/optcd.c	2004-06-15 22:19:02.000000000 -0700
+++ linux-2.6.8-rc3/drivers/cdrom/optcd.c	2004-08-03 15:21:37.448756201 -0700
@@ -964,7 +964,7 @@
 #endif /* MULTISESSION */
 	if (disk_info.multi)
 		printk(KERN_WARNING "optcd: Multisession support experimental, "
-			"see linux/Documentation/cdrom/optcd\n");
+			"see Documentation/cdrom/optcd\n");
 
 	DEBUG((DEBUG_TOC, "exiting update_toc"));
 
diff -urN linux-2.6.8-rc2/drivers/cdrom/sbpcd.c linux-2.6.8-rc3/drivers/cdrom/sbpcd.c
--- linux-2.6.8-rc2/drivers/cdrom/sbpcd.c	2004-06-15 22:18:59.000000000 -0700
+++ linux-2.6.8-rc3/drivers/cdrom/sbpcd.c	2004-08-03 15:21:37.460756693 -0700
@@ -570,7 +570,7 @@
 
 /*==========================================================================*/
 
-#if FUTURE
+#ifdef FUTURE
 static DECLARE_WAIT_QUEUE_HEAD(sbp_waitq);
 #endif /* FUTURE */
 
@@ -703,7 +703,7 @@
 	u_char TocEnt_number;
 	u_char TocEnt_format; /* em */
 	u_int TocEnt_address;
-#if SAFE_MIXED
+#ifdef SAFE_MIXED
 	char has_data;
 #endif /* SAFE_MIXED */ 
 	u_char ored_ctl_adr; /* to detect if CDROM contains data tracks */
@@ -3176,7 +3176,7 @@
 	return (0);
 }
 /*==========================================================================*/
-#if FUTURE
+#ifdef FUTURE
 static int cc_SubChanInfo(int frame, int count, u_char *buffer)
 	/* "frame" is a RED BOOK (msf-bin) address */
 {
@@ -3733,7 +3733,7 @@
 	return (0);
 }
 /*==========================================================================*/
-#if FUTURE
+#ifdef FUTURE
 /*
  *  obtain if requested service disturbs current audio state
  */            
@@ -4027,7 +4027,7 @@
 
 
 /*==========================================================================*/
-#if FUTURE
+#ifdef FUTURE
 /*
  *  called always if driver gets entered
  *  returns 0 or ERROR2 or ERROR15
@@ -4198,7 +4198,7 @@
 		
 	case CDROMREADMODE1:
 		msg(DBG_IOC,"ioctl: CDROMREADMODE1 requested.\n");
-#if SAFE_MIXED
+#ifdef SAFE_MIXED
 		if (current_drive->has_data>1) RETURN_UP(-EBUSY);
 #endif /* SAFE_MIXED */
 		cc_ModeSelect(CD_FRAMESIZE);
@@ -4208,7 +4208,7 @@
 		
 	case CDROMREADMODE2: /* not usable at the moment */
 		msg(DBG_IOC,"ioctl: CDROMREADMODE2 requested.\n");
-#if SAFE_MIXED
+#ifdef SAFE_MIXED
 		if (current_drive->has_data>1) RETURN_UP(-EBUSY);
 #endif /* SAFE_MIXED */
 		cc_ModeSelect(CD_FRAMESIZE_RAW1);
@@ -4257,11 +4257,11 @@
 		if (famL_drive) RETURN_UP(-EINVAL);
 		if (famV_drive) RETURN_UP(-EINVAL);
 		if (famT_drive) RETURN_UP(-EINVAL);
-#if SAFE_MIXED
+#ifdef SAFE_MIXED
 		if (current_drive->has_data>1) RETURN_UP(-EBUSY);
 #endif /* SAFE_MIXED */ 
 		if (current_drive->aud_buf==NULL) RETURN_UP(-EINVAL);
-		if (copy_from_user(&read_audio, (void *)arg,
+		if (copy_from_user(&read_audio, (void __user *)arg,
 				   sizeof(struct cdrom_read_audio)))
 			RETURN_UP(-EFAULT);
 		if (read_audio.nframes < 0 || read_audio.nframes>current_drive->sbp_audsiz) RETURN_UP(-EINVAL);
@@ -4460,8 +4460,8 @@
 				msg(DBG_AUD,"read_audio: cc_ReadError was necessary after read: %02X\n",i);
 				continue;
 			}
-			if (copy_to_user((u_char *)read_audio.buf,
-					 (u_char *) current_drive->aud_buf,
+			if (copy_to_user(read_audio.buf,
+					 current_drive->aud_buf,
 					 read_audio.nframes * CD_FRAMESIZE_RAW))
 				RETURN_UP(-EFAULT);
 			msg(DBG_AUD,"read_audio: copy_to_user done.\n");
@@ -4549,7 +4549,7 @@
 		
 	case CDROMPLAYMSF:
 		msg(DBG_IOC,"ioctl: CDROMPLAYMSF entered.\n");
-#if SAFE_MIXED
+#ifdef SAFE_MIXED
 		if (current_drive->has_data>1) RETURN_UP(-EBUSY);
 #endif /* SAFE_MIXED */ 
 		if (current_drive->audio_state==audio_playing)
@@ -4584,7 +4584,7 @@
 		
 	case CDROMPLAYTRKIND: /* Play a track.  This currently ignores index. */
 		msg(DBG_IOC,"ioctl: CDROMPLAYTRKIND entered.\n");
-#if SAFE_MIXED
+#ifdef SAFE_MIXED
 		if (current_drive->has_data>1) RETURN_UP(-EBUSY);
 #endif /* SAFE_MIXED */ 
 		if (current_drive->audio_state==audio_playing)
@@ -4647,7 +4647,7 @@
 		
 	case CDROMSTOP:      /* Spin down the drive */
 		msg(DBG_IOC,"ioctl: CDROMSTOP entered.\n");
-#if SAFE_MIXED
+#ifdef SAFE_MIXED
 		if (current_drive->has_data>1) RETURN_UP(-EBUSY);
 #endif /* SAFE_MIXED */ 
 		i=cc_Pause_Resume(1);
@@ -4912,7 +4912,7 @@
 		goto request_loop;
 	}
 
-#if FUTURE
+#ifdef FUTURE
 	i=prepare(0,0); /* at moment not really a hassle check, but ... */
 	if (i!=0)
 		msg(DBG_INF,"\"prepare\" tells error %d -- ignored\n", i);
@@ -4940,7 +4940,7 @@
 		sbp_sleep(0);
 		if (sbp_data(req) != 0)
 		{
-#if SAFE_MIXED
+#ifdef SAFE_MIXED
 			current_drive->has_data=2; /* is really a data disk */
 #endif /* SAFE_MIXED */ 
 #ifdef DEBUG_GTL
@@ -5416,11 +5416,11 @@
 		if ((current_drive->ored_ctl_adr&0x40)==0)
 		{		
 			msg(DBG_INF,"CD contains no data tracks.\n");
-#if SAFE_MIXED
+#ifdef SAFE_MIXED
 			current_drive->has_data=0;
 #endif /* SAFE_MIXED */
 		}
-#if SAFE_MIXED
+#ifdef SAFE_MIXED
 		else if (current_drive->has_data<1) current_drive->has_data=1;
 #endif /* SAFE_MIXED */ 
 	}
@@ -5455,7 +5455,7 @@
 				if (p->f_eject) cc_SpinDown();
 			p->diskstate_flags &= ~cd_size_bit;
 			p->open_count=0; 
-#if SAFE_MIXED
+#ifdef SAFE_MIXED
 			p->has_data=0;
 #endif /* SAFE_MIXED */ 
 		}
@@ -5715,7 +5715,7 @@
 	
 	if (port_index>0)
           {
-            msg(DBG_INF, "You should read linux/Documentation/cdrom/sbpcd\n");
+            msg(DBG_INF, "You should read Documentation/cdrom/sbpcd\n");
             msg(DBG_INF, "and then configure sbpcd.h for your hardware.\n");
           }
 	check_datarate();
@@ -5822,7 +5822,7 @@
 
 		if (p->drv_id==-1) continue;
 		switch_drive(p);
-#if SAFE_MIXED
+#ifdef SAFE_MIXED
 		p->has_data=0;
 #endif /* SAFE_MIXED */ 
 		/*
@@ -5942,7 +5942,7 @@
 		current_drive->diskstate_flags &= ~toc_bit;
 		/* we *don't* need invalidate here, it's done by caller */
 		current_drive->diskstate_flags &= ~cd_size_bit;
-#if SAFE_MIXED
+#ifdef SAFE_MIXED
 		current_drive->has_data=0;
 #endif /* SAFE_MIXED */ 
 
diff -urN linux-2.6.8-rc2/drivers/cdrom/sbpcd.h linux-2.6.8-rc3/drivers/cdrom/sbpcd.h
--- linux-2.6.8-rc2/drivers/cdrom/sbpcd.h	2004-06-15 22:19:42.000000000 -0700
+++ linux-2.6.8-rc3/drivers/cdrom/sbpcd.h	2004-08-03 15:21:37.461756734 -0700
@@ -5,7 +5,7 @@
 /*
  * Attention! This file contains user-serviceable parts!
  * I recommend to make use of it...
- * If you feel helpless, look into linux/Documentation/cdrom/sbpcd
+ * If you feel helpless, look into Documentation/cdrom/sbpcd
  * (good idea anyway, at least before mailing me).
  *
  * The definitions for the first controller can get overridden by
diff -urN linux-2.6.8-rc2/drivers/char/Kconfig linux-2.6.8-rc3/drivers/char/Kconfig
--- linux-2.6.8-rc2/drivers/char/Kconfig	2004-08-03 15:21:06.888502698 -0700
+++ linux-2.6.8-rc3/drivers/char/Kconfig	2004-08-03 15:21:37.478757432 -0700
@@ -203,7 +203,7 @@
 
 config ISI
 	tristate "Multi-Tech multiport card support (EXPERIMENTAL)"
-	depends on SERIAL_NONSTANDARD && EXPERIMENTAL && BROKEN_ON_SMP && m
+	depends on SERIAL_NONSTANDARD && PCI && EXPERIMENTAL && BROKEN_ON_SMP && m
 	help
 	  This is a driver for the Multi-Tech cards which provide several
 	  serial ports.  The driver is experimental and can currently only be
@@ -212,7 +212,7 @@
 
 config SYNCLINK
 	tristate "Microgate SyncLink card support"
-	depends on SERIAL_NONSTANDARD
+	depends on SERIAL_NONSTANDARD && PCI
 	help
 	  Provides support for the SyncLink ISA and PCI multiprotocol serial
 	  adapters. These adapters support asynchronous and HDLC bit
@@ -570,6 +570,23 @@
 	  console. This driver allows each pSeries partition to have a console
 	  which is accessed via the HMC.
 
+config HVCS
+	tristate "IBM Hypervisor Virtual Console Server support"
+	depends on PPC_PSERIES
+	help
+	  Partitionable IBM Power5 ppc64 machines allow hosting of
+	  firmware virtual consoles from one Linux partition by
+	  another Linux partition.  This driver allows console data
+	  from Linux partitions to be accessed through TTY device
+	  interfaces in the device tree of a Linux partition running
+	  this driver.
+
+	  To compile this driver as a module, choose M here: the
+	  module will be called hvcs.ko.  Additionally, this module
+	  will depend on arch specific APIs exported from hvcserver.ko
+	  which will also be compiled when this driver is built as a
+	  module.
+
 config QIC02_TAPE
 	tristate "QIC-02 tape support"
 	help
@@ -819,6 +836,7 @@
 
 config APPLICOM
 	tristate "Applicom intelligent fieldbus card support"
+	depends on PCI
 	---help---
 	  This driver provides the kernel-side support for the intelligent
 	  fieldbus cards made by Applicom International. More information
@@ -849,7 +867,7 @@
 
 config FTAPE
 	tristate "Ftape (QIC-80/Travan) support"
-	depends on BROKEN_ON_SMP
+	depends on BROKEN_ON_SMP && (ALPHA || X86)
 	---help---
 	  If you have a tape drive that is connected to your floppy
 	  controller, say Y here.
@@ -958,14 +976,18 @@
 	  is assumed the platform called hpet_alloc with the RTC IRQ values for
 	  the HPET timers.
 
-config HPET_NOMMAP
-	bool "HPET - Control mmap capability."
-	default n
+config HPET_MMAP
+	bool "Allow mmap of HPET"
+	default y
 	depends on HPET
 	help
-	  If you say Y here, then the mmap interface for the HPET driver returns ENOSYS.
-	  Some hardware implementations might not want all the memory in the page the
-	  HPET control registers reside to be exposed.
+	  If you say Y here, user applications will be able to mmap
+	  the HPET registers.
+
+	  In some hardware implementations, the page containing HPET
+	  registers may also contain other things that shouldn't be
+	  exposed to the user.  If this applies to your hardware,
+	  say N here.
 
 config MAX_RAW_DEVS
 	int "Maximum number of RAW devices to support (1-8192)"
diff -urN linux-2.6.8-rc2/drivers/char/Makefile linux-2.6.8-rc3/drivers/char/Makefile
--- linux-2.6.8-rc2/drivers/char/Makefile	2004-08-03 15:21:06.888502698 -0700
+++ linux-2.6.8-rc3/drivers/char/Makefile	2004-08-03 15:21:37.485757719 -0700
@@ -43,6 +43,7 @@
 obj-$(CONFIG_RAW_DRIVER)	+= raw.o
 obj-$(CONFIG_VIOCONS) += viocons.o
 obj-$(CONFIG_VIOTAPE)		+= viotape.o
+obj-$(CONFIG_HVCS)		+= hvcs.o
 
 obj-$(CONFIG_PRINTER) += lp.o
 obj-$(CONFIG_TIPAR) += tipar.o
diff -urN linux-2.6.8-rc2/drivers/char/README.scc linux-2.6.8-rc3/drivers/char/README.scc
--- linux-2.6.8-rc2/drivers/char/README.scc	2004-06-15 22:18:59.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/README.scc	2004-08-03 15:21:37.491757965 -0700
@@ -2,4 +2,4 @@
 	../net/scc.c
 
 A subset of the documentation is in
-	../../Documentation/networking/z8530drv.txt
+	Documentation/networking/z8530drv.txt
diff -urN linux-2.6.8-rc2/drivers/char/agp/Kconfig linux-2.6.8-rc3/drivers/char/agp/Kconfig
--- linux-2.6.8-rc2/drivers/char/agp/Kconfig	2004-08-03 15:21:06.889502739 -0700
+++ linux-2.6.8-rc3/drivers/char/agp/Kconfig	2004-08-03 15:21:37.502758416 -0700
@@ -82,7 +82,7 @@
 	  This option gives you AGP support for the GLX component of XFree86 4.x
 	  on Intel 440LX/BX/GX, 815, 820, 830, 840, 845, 850, 860, 875,
 	  E7205 and E7505 chipsets and full support for the 810, 815, 830M, 845G,
-	  852GM, 855GM and 865G integrated graphics chipsets.
+	  852GM, 855GM, 865G and I915 integrated graphics chipsets.
 
 	  You should say Y here if you use XFree86 3.3.6 or 4.x and want to
 	  use GLX or DRI, or if you have any Intel integrated graphics
diff -urN linux-2.6.8-rc2/drivers/char/agp/amd64-agp.c linux-2.6.8-rc3/drivers/char/agp/amd64-agp.c
--- linux-2.6.8-rc2/drivers/char/agp/amd64-agp.c	2004-08-03 15:21:06.890502780 -0700
+++ linux-2.6.8-rc3/drivers/char/agp/amd64-agp.c	2004-08-03 15:21:37.511758785 -0700
@@ -563,14 +563,25 @@
 	.subvendor	= PCI_ANY_ID,
 	.subdevice	= PCI_ANY_ID,
 	},
+	/* VIA K8T890 */
 	{
 	.class		= (PCI_CLASS_BRIDGE_HOST << 8),
 	.class_mask	= ~0,
 	.vendor		= PCI_VENDOR_ID_VIA,
-	.device		= PCI_DEVICE_ID_VIA_8380_0,
+	.device		= PCI_DEVICE_ID_VIA_3238_0,
 	.subvendor	= PCI_ANY_ID,
 	.subdevice	= PCI_ANY_ID,
 	},
+	/* VIA K8T800/K8M800/K8N800 */
+	{
+	.class		= (PCI_CLASS_BRIDGE_HOST << 8),
+	.class_mask	= ~0,
+	.vendor		= PCI_VENDOR_ID_VIA,
+	.device		= PCI_DEVICE_ID_VIA_838X_1,
+	.subvendor	= PCI_ANY_ID,
+	.subdevice	= PCI_ANY_ID,
+	},
+
 	/* NForce3 */
 	{
 	.class		= (PCI_CLASS_BRIDGE_HOST << 8),
diff -urN linux-2.6.8-rc2/drivers/char/agp/hp-agp.c linux-2.6.8-rc3/drivers/char/agp/hp-agp.c
--- linux-2.6.8-rc2/drivers/char/agp/hp-agp.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/agp/hp-agp.c	2004-08-03 15:21:37.546760221 -0700
@@ -1,7 +1,12 @@
 /*
- * HP AGPGART routines.
- *	Copyright (C) 2002-2003 Hewlett-Packard Co
- *		Bjorn Helgaas <bjorn_helgaas@hp.com>
+ * HP zx1 AGPGART routines.
+ *
+ * (c) Copyright 2002, 2003 Hewlett-Packard Development Company, L.P.
+ *	Bjorn Helgaas <bjorn.helgaas@hp.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include <linux/acpi.h>
diff -urN linux-2.6.8-rc2/drivers/char/agp/intel-agp.c linux-2.6.8-rc3/drivers/char/agp/intel-agp.c
--- linux-2.6.8-rc2/drivers/char/agp/intel-agp.c	2004-08-03 15:21:06.892502862 -0700
+++ linux-2.6.8-rc3/drivers/char/agp/intel-agp.c	2004-08-03 15:21:37.549760344 -0700
@@ -5,11 +5,15 @@
 /*
  * Intel(R) 855GM/852GM and 865G support added by David Dawes
  * <dawes@tungstengraphics.com>.
+ *
+ * Intel(R) 915G support added by Alan Hourihane
+ * <alanh@tungstengraphics.com>.
  */
 
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/init.h>
+#include <linux/pagemap.h>
 #include <linux/agp_backend.h>
 #include "agp.h"
 
@@ -29,6 +33,14 @@
 #define INTEL_I850_MCHCFG	0x50
 #define INTEL_I850_ERRSTS	0xc8
 
+/* intel 915G registers */
+#define I915_GMADDR	0x18
+#define I915_MMADDR	0x10
+#define I915_PTEADDR	0x1C
+#define I915_GMCH_GMS_STOLEN_48M	(0x6 << 4)
+#define I915_GMCH_GMS_STOLEN_64M	(0x7 << 4)
+
+
 /* Intel 7505 registers */
 #define INTEL_I7505_APSIZE	0x74
 #define INTEL_I7505_NCAPID	0x60
@@ -143,6 +155,40 @@
 	return;
 }
 
+/* Exists to support ARGB cursors */
+static void *i8xx_alloc_pages(void)
+{
+	struct page * page;
+
+	page = alloc_pages(GFP_KERNEL, 2);
+	if (page == NULL) {
+		return 0;
+	}
+	if (change_page_attr(page, 4, PAGE_KERNEL_NOCACHE) < 0) {
+		__free_page(page); 
+		return 0;
+	}
+	get_page(page);
+	SetPageLocked(page);
+	atomic_inc(&agp_bridge->current_memory_agp);
+	return page_address(page);
+}
+
+static void i8xx_destroy_pages(void *addr)
+{
+	struct page *page;
+
+	if (addr == NULL)
+		return;
+	
+	page = virt_to_page(addr);
+	change_page_attr(page, 4, PAGE_KERNEL);
+	put_page(page);
+	unlock_page(page);
+	free_pages((unsigned long)addr, 2);
+	atomic_dec(&agp_bridge->current_memory_agp);
+}
+
 static int intel_i810_insert_entries(struct agp_memory *mem, off_t pg_start,
 				int type)
 {
@@ -218,20 +264,36 @@
 	struct agp_memory *new;
 	void *addr;
 
-	if (pg_count != 1)
+	if (pg_count != 1 && pg_count != 4)
 		return NULL;
 
-	addr = agp_bridge->driver->agp_alloc_page();
+	switch (pg_count) {
+	case 1: addr = agp_bridge->driver->agp_alloc_page();
+		break;
+	case 4:
+		/* kludge to get 4 physical pages for ARGB cursor */
+		addr = i8xx_alloc_pages();
+		break;
+	default:
+		return NULL;
+	}
+
 	if (addr == NULL)
 		return NULL;
 
-	new = agp_create_memory(1);
+	new = agp_create_memory(pg_count);
 	if (new == NULL)
 		return NULL;
 
-	new->memory[0] = agp_bridge->driver->mask_memory(virt_to_phys(addr), type);
-	new->page_count = 1;
-	new->num_scratch_pages = 1;
+	new->memory[0] = virt_to_phys(addr);
+	if (pg_count == 4) {
+		/* kludge to get 4 physical pages for ARGB cursor */
+		new->memory[1] = new->memory[0] + PAGE_SIZE;
+		new->memory[2] = new->memory[1] + PAGE_SIZE;
+		new->memory[3] = new->memory[2] + PAGE_SIZE;
+	}
+	new->page_count = pg_count;
+	new->num_scratch_pages = pg_count;
 	new->type = AGP_PHYS_MEMORY;
 	new->physical = new->memory[0];
 	return new;
@@ -265,7 +327,11 @@
 {
 	agp_free_key(curr->key);
 	if(curr->type == AGP_PHYS_MEMORY) {
-		agp_bridge->driver->agp_destroy_page(phys_to_virt(curr->memory[0]));
+		if (curr->page_count == 4)
+			i8xx_destroy_pages(phys_to_virt(curr->memory[0]));
+		else
+	   		agp_bridge->driver->agp_destroy_page(
+				 phys_to_virt(curr->memory[0]));
 		vfree(curr->memory);
 	}
 	kfree(curr);
@@ -281,12 +347,14 @@
 {
 	{128, 32768, 5},
 	/* The 64M mode still requires a 128k gatt */
-	{64, 16384, 5}
+	{64, 16384, 5},
+	{256, 65536, 6},
 };
 
 static struct _intel_i830_private {
 	struct pci_dev *i830_dev;		/* device one */
 	volatile u8 *registers;
+	volatile u32 *gtt;		/* I915G */
 	int gtt_entries;
 } intel_i830_private;
 
@@ -297,20 +365,26 @@
 	u8 rdct;
 	int local = 0;
 	static const int ddt[4] = { 0, 16, 32, 64 };
+	int size;
 
 	pci_read_config_word(agp_bridge->dev,I830_GMCH_CTRL,&gmch_ctrl);
 
+	/* We obtain the size of the GTT, which is also stored (for some
+	 * reason) at the top of stolen memory. Then we add 4KB to that
+ 	 * for the video BIOS popup, which is also stored in there. */
+	size = agp_bridge->driver->fetch_size() + 4;
+
 	if (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82830_HB ||
 	    agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82845G_HB) {
 		switch (gmch_ctrl & I830_GMCH_GMS_MASK) {
 		case I830_GMCH_GMS_STOLEN_512:
-			gtt_entries = KB(512) - KB(132);
+			gtt_entries = KB(512) - KB(size);
 			break;
 		case I830_GMCH_GMS_STOLEN_1024:
-			gtt_entries = MB(1) - KB(132);
+			gtt_entries = MB(1) - KB(size);
 			break;
 		case I830_GMCH_GMS_STOLEN_8192:
-			gtt_entries = MB(8) - KB(132);
+			gtt_entries = MB(8) - KB(size);
 			break;
 		case I830_GMCH_GMS_LOCAL:
 			rdct = INREG8(intel_i830_private.registers,
@@ -326,20 +400,33 @@
 	} else {
 		switch (gmch_ctrl & I830_GMCH_GMS_MASK) {
 		case I855_GMCH_GMS_STOLEN_1M:
-			gtt_entries = MB(1) - KB(132);
+			gtt_entries = MB(1) - KB(size);
 			break;
 		case I855_GMCH_GMS_STOLEN_4M:
-			gtt_entries = MB(4) - KB(132);
+			gtt_entries = MB(4) - KB(size);
 			break;
 		case I855_GMCH_GMS_STOLEN_8M:
-			gtt_entries = MB(8) - KB(132);
+			gtt_entries = MB(8) - KB(size);
 			break;
 		case I855_GMCH_GMS_STOLEN_16M:
-			gtt_entries = MB(16) - KB(132);
+			gtt_entries = MB(16) - KB(size);
 			break;
 		case I855_GMCH_GMS_STOLEN_32M:
-			gtt_entries = MB(32) - KB(132);
+			gtt_entries = MB(32) - KB(size);
+			break;
+		case I915_GMCH_GMS_STOLEN_48M:
+			/* Check it's really I915G */
+			if (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82915G_HB)
+				gtt_entries = MB(48) - KB(size);
+			else
+				gtt_entries = 0;
 			break;
+		case I915_GMCH_GMS_STOLEN_64M:
+			/* Check it's really I915G */
+			if (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82915G_HB)
+				gtt_entries = MB(64) - KB(size);
+			else
+				gtt_entries = 0;
 		default:
 			gtt_entries = 0;
 			break;
@@ -421,7 +508,7 @@
 		agp_bridge->aperture_size_idx = 0;
 		return(values[0].size);
 	} else {
-		agp_bridge->previous_size = agp_bridge->current_size = (void *) values;
+		agp_bridge->previous_size = agp_bridge->current_size = (void *) (values + 1);
 		agp_bridge->aperture_size_idx = 1;
 		return(values[1].size);
 	}
@@ -532,6 +619,161 @@
 	return(NULL);
 }
 
+static int intel_i915_configure(void)
+{
+	struct aper_size_info_fixed *current_size;
+	u32 temp;
+	u16 gmch_ctrl;
+	int i;
+
+	current_size = A_SIZE_FIX(agp_bridge->current_size);
+
+	pci_read_config_dword(intel_i830_private.i830_dev, I915_GMADDR, &temp);
+
+	agp_bridge->gart_bus_addr = (temp & PCI_BASE_ADDRESS_MEM_MASK);
+
+	pci_read_config_word(agp_bridge->dev,I830_GMCH_CTRL,&gmch_ctrl);
+	gmch_ctrl |= I830_GMCH_ENABLED;
+	pci_write_config_word(agp_bridge->dev,I830_GMCH_CTRL,gmch_ctrl);
+
+	OUTREG32(intel_i830_private.registers,I810_PGETBL_CTL,agp_bridge->gatt_bus_addr | I810_PGETBL_ENABLED);
+	global_cache_flush();
+
+	if (agp_bridge->driver->needs_scratch_page) {
+		for (i = intel_i830_private.gtt_entries; i < current_size->num_entries; i++)
+			OUTREG32(intel_i830_private.gtt, i, agp_bridge->scratch_page);
+	}
+
+	return (0);
+}
+
+static void intel_i915_cleanup(void)
+{
+	iounmap((void *) intel_i830_private.gtt);
+	iounmap((void *) intel_i830_private.registers);
+}
+
+static int intel_i915_insert_entries(struct agp_memory *mem,off_t pg_start,
+				int type)
+{
+	int i,j,num_entries;
+	void *temp;
+
+	temp = agp_bridge->current_size;
+	num_entries = A_SIZE_FIX(temp)->num_entries;
+
+	if (pg_start < intel_i830_private.gtt_entries) {
+		printk (KERN_DEBUG PFX "pg_start == 0x%.8lx,intel_i830_private.gtt_entries == 0x%.8x\n",
+				pg_start,intel_i830_private.gtt_entries);
+
+		printk (KERN_INFO PFX "Trying to insert into local/stolen memory\n");
+		return (-EINVAL);
+	}
+
+	if ((pg_start + mem->page_count) > num_entries)
+		return (-EINVAL);
+
+	/* The i830 can't check the GTT for entries since its read only,
+	 * depend on the caller to make the correct offset decisions.
+	 */
+
+	if ((type != 0 && type != AGP_PHYS_MEMORY) ||
+		(mem->type != 0 && mem->type != AGP_PHYS_MEMORY))
+		return (-EINVAL);
+
+	global_cache_flush();
+
+	for (i = 0, j = pg_start; i < mem->page_count; i++, j++)
+		OUTREG32(intel_i830_private.gtt, j, agp_bridge->driver->mask_memory(mem->memory[i], mem->type));
+
+	global_cache_flush();
+
+	agp_bridge->driver->tlb_flush(mem);
+
+	return(0);
+}
+
+static int intel_i915_remove_entries(struct agp_memory *mem,off_t pg_start,
+				int type)
+{
+	int i;
+
+	global_cache_flush();
+
+	if (pg_start < intel_i830_private.gtt_entries) {
+		printk (KERN_INFO PFX "Trying to disable local/stolen memory\n");
+		return (-EINVAL);
+	}
+
+	for (i = pg_start; i < (mem->page_count + pg_start); i++)
+		OUTREG32(intel_i830_private.gtt, i, agp_bridge->scratch_page);
+
+	global_cache_flush();
+
+	agp_bridge->driver->tlb_flush(mem);
+
+	return (0);
+}
+
+static int intel_i915_fetch_size(void)
+{
+	struct aper_size_info_fixed *values;
+	u32 temp, offset = 0;
+
+#define I915_256MB_ADDRESS_MASK (1<<27)
+
+	values = A_SIZE_FIX(agp_bridge->driver->aperture_sizes);
+
+	pci_read_config_dword(intel_i830_private.i830_dev, I915_GMADDR, &temp);
+	if (temp & I915_256MB_ADDRESS_MASK)
+		offset = 0;	/* 128MB aperture */
+	else
+		offset = 2;	/* 256MB aperture */
+	agp_bridge->previous_size = agp_bridge->current_size = (void *)(values + offset);
+	return(values[offset].size);
+}
+
+/* The intel i915 automatically initializes the agp aperture during POST.
+ * Use the memory already set aside for in the GTT.
+ */
+static int intel_i915_create_gatt_table(void)
+{
+	int page_order;
+	struct aper_size_info_fixed *size;
+	int num_entries;
+	u32 temp, temp2;
+
+	size = agp_bridge->current_size;
+	page_order = size->page_order;
+	num_entries = size->num_entries;
+	agp_bridge->gatt_table_real = 0;
+
+	pci_read_config_dword(intel_i830_private.i830_dev, I915_MMADDR, &temp);
+	pci_read_config_dword(intel_i830_private.i830_dev, I915_PTEADDR,&temp2);
+
+	intel_i830_private.gtt = (volatile u32 *) ioremap(temp2, 256 * 1024);
+	if (!intel_i830_private.gtt) 
+		return (-ENOMEM);
+
+	temp &= 0xfff80000;
+
+	intel_i830_private.registers = (volatile u8 *) ioremap(temp,128 * 4096);
+	if (!intel_i830_private.registers)
+		return (-ENOMEM);
+
+	temp = INREG32(intel_i830_private.registers,I810_PGETBL_CTL) & 0xfffff000;
+	global_cache_flush();
+
+	/* we have to call this as early as possible after the MMIO base address is known */
+	intel_i830_init_gtt_entries();
+
+	agp_bridge->gatt_table = NULL;
+
+	agp_bridge->gatt_bus_addr = temp;
+
+	return(0);
+}
+
 static int intel_fetch_size(void)
 {
 	int i;
@@ -1041,7 +1283,7 @@
 	.owner			= THIS_MODULE,
 	.aperture_sizes		= intel_i830_sizes,
 	.size_type		= FIXED_APER_SIZE,
-	.num_aperture_sizes 	= 2,
+	.num_aperture_sizes 	= 3,
 	.needs_scratch_page	= TRUE,
 	.configure		= intel_i830_configure,
 	.fetch_size		= intel_i830_fetch_size,
@@ -1199,6 +1441,31 @@
 	.agp_destroy_page	= agp_generic_destroy_page,
 };
 
+static struct agp_bridge_driver intel_915_driver = {
+	.owner			= THIS_MODULE,
+	.aperture_sizes		= intel_i830_sizes,
+	.size_type		= FIXED_APER_SIZE,
+	.num_aperture_sizes 	= 3,
+	.needs_scratch_page	= TRUE,
+	.configure		= intel_i915_configure,
+	.fetch_size		= intel_i915_fetch_size,
+	.cleanup		= intel_i915_cleanup,
+	.tlb_flush		= intel_i810_tlbflush,
+	.mask_memory		= intel_i810_mask_memory,
+	.masks			= intel_i810_masks,
+	.agp_enable		= intel_i810_agp_enable,
+	.cache_flush		= global_cache_flush,
+	.create_gatt_table	= intel_i915_create_gatt_table,
+	.free_gatt_table	= intel_i830_free_gatt_table,
+	.insert_memory		= intel_i915_insert_entries,
+	.remove_memory		= intel_i915_remove_entries,
+	.alloc_by_type		= intel_i830_alloc_by_type,
+	.free_by_type		= intel_i810_free_by_type,
+	.agp_alloc_page		= agp_generic_alloc_page,
+	.agp_destroy_page	= agp_generic_destroy_page,
+};
+
+
 static struct agp_bridge_driver intel_7505_driver = {
 	.owner			= THIS_MODULE,
 	.aperture_sizes		= intel_8xx_sizes,
@@ -1373,9 +1640,17 @@
 		bridge->driver = &intel_845_driver;
 		name = "i875";
 		break;
+	case PCI_DEVICE_ID_INTEL_82915G_HB:
+		if (find_i830(PCI_DEVICE_ID_INTEL_82915G_IG)) {
+			bridge->driver = &intel_915_driver;
+		} else {
+			bridge->driver = &intel_845_driver;
+		}
+		name = "915G";
+		break;
 	case PCI_DEVICE_ID_INTEL_7505_0:
 		bridge->driver = &intel_7505_driver;
-		name =  "E7505";
+		name = "E7505";
 		break;
 	case PCI_DEVICE_ID_INTEL_7205_0:
 		bridge->driver = &intel_7505_driver;
@@ -1458,6 +1733,8 @@
 		intel_845_configure();
 	else if (bridge->driver == &intel_830mp_driver)
 		intel_830mp_configure();
+	else if (bridge->driver == &intel_915_driver)
+		intel_i915_configure();
 
 	return 0;
 }
diff -urN linux-2.6.8-rc2/drivers/char/agp/sis-agp.c linux-2.6.8-rc3/drivers/char/agp/sis-agp.c
--- linux-2.6.8-rc2/drivers/char/agp/sis-agp.c	2004-06-15 22:18:56.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/agp/sis-agp.c	2004-08-03 15:21:37.561760837 -0700
@@ -145,6 +145,10 @@
 static struct agp_device_ids sis_agp_device_ids[] __devinitdata =
 {
 	{
+		.device_id	= PCI_DEVICE_ID_SI_5591_AGP,
+		.chipset_name	= "5591",
+	},
+	{
 		.device_id	= PCI_DEVICE_ID_SI_530,
 		.chipset_name	= "530",
 	},
diff -urN linux-2.6.8-rc2/drivers/char/agp/via-agp.c linux-2.6.8-rc3/drivers/char/agp/via-agp.c
--- linux-2.6.8-rc2/drivers/char/agp/via-agp.c	2004-08-03 15:21:06.894502944 -0700
+++ linux-2.6.8-rc3/drivers/char/agp/via-agp.c	2004-08-03 15:21:37.563760919 -0700
@@ -348,6 +348,21 @@
 		.device_id	= PCI_DEVICE_ID_VIA_PX8X0_0,
 		.chipset_name	= "PM800/PN800/PM880/PN880",
 	},
+	/* KT880 */
+	{
+		.device_id	= PCI_DEVICE_ID_VIA_3269_0,
+		.chipset_name	= "KT880",
+	},
+	/* KTxxx/Px8xx */
+	{
+		.device_id	= PCI_DEVICE_ID_VIA_83_87XX_1,
+		.chipset_name	= "VT83xx/VT87xx/KTxxx/Px8xx",
+	},
+	/* P4M800 */
+	{
+		.device_id	= PCI_DEVICE_ID_VIA_3296_0,
+		.chipset_name	= "P4M800",
+	},
 
 	{ }, /* dummy final entry, always present */
 };
@@ -457,7 +472,10 @@
 	ID(PCI_DEVICE_ID_VIA_8378_0),
 	ID(PCI_DEVICE_ID_VIA_PT880),
 	ID(PCI_DEVICE_ID_VIA_8783_0),
-	ID(PCI_DEVICE_ID_VIA_PX8X0_0),	
+	ID(PCI_DEVICE_ID_VIA_PX8X0_0),
+	ID(PCI_DEVICE_ID_VIA_3269_0),
+	ID(PCI_DEVICE_ID_VIA_83_87XX_1),
+	ID(PCI_DEVICE_ID_VIA_3296_0),
 	{ }
 };
 
diff -urN linux-2.6.8-rc2/drivers/char/drm/drm_drv.h linux-2.6.8-rc3/drivers/char/drm/drm_drv.h
--- linux-2.6.8-rc2/drivers/char/drm/drm_drv.h	2004-08-03 15:21:06.925504214 -0700
+++ linux-2.6.8-rc3/drivers/char/drm/drm_drv.h	2004-08-03 15:21:37.780769821 -0700
@@ -1178,7 +1178,7 @@
 	 * agent to request it then we should just be able to
 	 * take it immediately and not eat the ioctl.
 	 */
-	dev->lock.filp = 0;
+	dev->lock.filp = NULL;
 	{
 		__volatile__ unsigned int *plock = &dev->lock.hw_lock->lock;
 		unsigned int old, new, prev, ctx;
diff -urN linux-2.6.8-rc2/drivers/char/drm/ffb_context.c linux-2.6.8-rc3/drivers/char/drm/ffb_context.c
--- linux-2.6.8-rc2/drivers/char/drm/ffb_context.c	2004-06-15 22:19:36.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/drm/ffb_context.c	2004-08-03 15:21:37.796770477 -0700
@@ -358,7 +358,7 @@
 {
 	ffb_dev_priv_t *fpriv = (ffb_dev_priv_t *) dev->dev_private;
 
-#if DRM_DMA_HISTOGRAM
+#ifdef DRM_DMA_HISTOGRAM
         dev->ctx_start = get_cycles();
 #endif
         
@@ -388,7 +388,7 @@
 	int		i;
 
 	DRM_DEBUG("%d\n", DRM_RESERVED_CONTEXTS);
-	if (copy_from_user(&res, (drm_ctx_res_t *)arg, sizeof(res)))
+	if (copy_from_user(&res, (drm_ctx_res_t __user *)arg, sizeof(res)))
 		return -EFAULT;
 	if (res.count >= DRM_RESERVED_CONTEXTS) {
 		memset(&ctx, 0, sizeof(ctx));
@@ -401,7 +401,7 @@
 		}
 	}
 	res.count = DRM_RESERVED_CONTEXTS;
-	if (copy_to_user((drm_ctx_res_t *)arg, &res, sizeof(res)))
+	if (copy_to_user((drm_ctx_res_t __user *)arg, &res, sizeof(res)))
 		return -EFAULT;
 	return 0;
 }
@@ -415,7 +415,7 @@
 	drm_ctx_t	ctx;
 	int idx;
 
-	if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
 		return -EFAULT;
 	idx = DRM(alloc_queue)(dev, (ctx.flags & _DRM_CONTEXT_2DONLY));
 	if (idx < 0)
@@ -423,7 +423,7 @@
 
 	DRM_DEBUG("%d\n", ctx.handle);
 	ctx.handle = idx;
-	if (copy_to_user((drm_ctx_t *)arg, &ctx, sizeof(ctx)))
+	if (copy_to_user((drm_ctx_t __user *)arg, &ctx, sizeof(ctx)))
 		return -EFAULT;
 	return 0;
 }
@@ -438,7 +438,7 @@
 	drm_ctx_t ctx;
 	int idx;
 
-	if (copy_from_user(&ctx, (drm_ctx_t*)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
 		return -EFAULT;
 
 	idx = ctx.handle;
@@ -467,7 +467,7 @@
 	drm_ctx_t ctx;
 	int idx;
 
-	if (copy_from_user(&ctx, (drm_ctx_t*)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
 		return -EFAULT;
 
 	idx = ctx.handle;
@@ -483,7 +483,7 @@
 	else
 		ctx.flags = 0;
 
-	if (copy_to_user((drm_ctx_t*)arg, &ctx, sizeof(ctx)))
+	if (copy_to_user((drm_ctx_t __user *)arg, &ctx, sizeof(ctx)))
 		return -EFAULT;
 
 	return 0;
@@ -496,7 +496,7 @@
 	drm_device_t	*dev	= priv->dev;
 	drm_ctx_t	ctx;
 
-	if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, (drm_ctx_t  __user *)arg, sizeof(ctx)))
 		return -EFAULT;
 	DRM_DEBUG("%d\n", ctx.handle);
 	return DRM(context_switch)(dev, dev->last_context, ctx.handle);
@@ -507,7 +507,7 @@
 {
 	drm_ctx_t	ctx;
 
-	if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, (drm_ctx_t  __user *)arg, sizeof(ctx)))
 		return -EFAULT;
 	DRM_DEBUG("%d\n", ctx.handle);
 
@@ -523,7 +523,7 @@
 	ffb_dev_priv_t	*fpriv	= (ffb_dev_priv_t *) dev->dev_private;
 	int idx;
 
-	if (copy_from_user(&ctx, (drm_ctx_t *)arg, sizeof(ctx)))
+	if (copy_from_user(&ctx, (drm_ctx_t __user *)arg, sizeof(ctx)))
 		return -EFAULT;
 	DRM_DEBUG("%d\n", ctx.handle);
 
diff -urN linux-2.6.8-rc2/drivers/char/drm/gamma_old_dma.h linux-2.6.8-rc3/drivers/char/drm/gamma_old_dma.h
--- linux-2.6.8-rc2/drivers/char/drm/gamma_old_dma.h	2004-06-15 22:20:03.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/drm/gamma_old_dma.h	2004-08-03 15:21:37.805770847 -0700
@@ -122,6 +122,8 @@
 	int		  idx;
 	int		  while_locked = 0;
 	drm_device_dma_t  *dma = dev->dma;
+	int		  *ind;
+	int		  err;
 	DECLARE_WAITQUEUE(entry, current);
 
 	DRM_DEBUG("%d\n", d->send_count);
@@ -168,45 +170,51 @@
 		remove_wait_queue(&q->write_queue, &entry);
 	}
 
+	ind = DRM(alloc)(d->send_count * sizeof(int), DRM_MEM_DRIVER);
+	if (!ind)
+		return -ENOMEM;
+
+	if (copy_from_user(ind, d->send_indices, d->send_count * sizeof(int))) {
+		err = -EFAULT;
+                goto out;
+	}
+
+	err = -EINVAL;
 	for (i = 0; i < d->send_count; i++) {
-		idx = d->send_indices[i];
+		idx = ind[i];
 		if (idx < 0 || idx >= dma->buf_count) {
-			atomic_dec(&q->use_count);
 			DRM_ERROR("Index %d (of %d max)\n",
-				  d->send_indices[i], dma->buf_count - 1);
-			return -EINVAL;
+				  ind[i], dma->buf_count - 1);
+			goto out;
 		}
 		buf = dma->buflist[ idx ];
 		if (buf->filp != filp) {
-			atomic_dec(&q->use_count);
 			DRM_ERROR("Process %d using buffer not owned\n",
 				  current->pid);
-			return -EINVAL;
+			goto out;
 		}
 		if (buf->list != DRM_LIST_NONE) {
-			atomic_dec(&q->use_count);
 			DRM_ERROR("Process %d using buffer %d on list %d\n",
 				  current->pid, buf->idx, buf->list);
+			goto out;
 		}
-		buf->used	  = d->send_sizes[i];
+		buf->used	  = ind[i];
 		buf->while_locked = while_locked;
 		buf->context	  = d->context;
 		if (!buf->used) {
 			DRM_ERROR("Queueing 0 length buffer\n");
 		}
 		if (buf->pending) {
-			atomic_dec(&q->use_count);
 			DRM_ERROR("Queueing pending buffer:"
 				  " buffer %d, offset %d\n",
-				  d->send_indices[i], i);
-			return -EINVAL;
+				  ind[i], i);
+			goto out;
 		}
 		if (buf->waiting) {
-			atomic_dec(&q->use_count);
 			DRM_ERROR("Queueing waiting buffer:"
 				  " buffer %d, offset %d\n",
-				  d->send_indices[i], i);
-			return -EINVAL;
+				  ind[i], i);
+			goto out;
 		}
 		buf->waiting = 1;
 		if (atomic_read(&q->use_count) == 1
@@ -220,6 +228,11 @@
 	atomic_dec(&q->use_count);
 
 	return 0;
+
+out:
+	DRM(free)(ind, d->send_count * sizeof(int), DRM_MEM_DRIVER);
+	atomic_dec(&q->use_count);
+	return err;
 }
 
 static int DRM(dma_get_buffers_of_order)(struct file *filp, drm_dma_t *d,
diff -urN linux-2.6.8-rc2/drivers/char/dsp56k.c linux-2.6.8-rc3/drivers/char/dsp56k.c
--- linux-2.6.8-rc2/drivers/char/dsp56k.c	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/dsp56k.c	2004-08-03 15:21:37.883774047 -0700
@@ -293,10 +293,10 @@
 		}
 		case 2:  /* 16 bit */
 		{
-			short *data;
+			const short *data;
 
 			count /= 2;
-			data = (short*) buf;
+			data = (const short *)buf;
 			handshake(count, dsp56k.maxio, dsp56k.timeout, DSP56K_TRANSMIT,
 				  get_user(dsp56k_host_interface.data.w[1], data+n++));
 			return 2*n;
@@ -312,10 +312,10 @@
 		}
 		case 4:  /* 32 bit */
 		{
-			long *data;
+			const long *data;
 
 			count /= 4;
-			data = (long*) buf;
+			data = (const long *)buf;
 			handshake(count, dsp56k.maxio, dsp56k.timeout, DSP56K_TRANSMIT,
 				  get_user(dsp56k_host_interface.data.l, data+n++));
 			return 4*n;
diff -urN linux-2.6.8-rc2/drivers/char/epca.c linux-2.6.8-rc3/drivers/char/epca.c
--- linux-2.6.8-rc2/drivers/char/epca.c	2004-06-15 22:19:36.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/epca.c	2004-08-03 15:21:37.899774703 -0700
@@ -48,8 +48,8 @@
 #define ENABLE_PCI
 #endif /* CONFIG_PCI */
 
-#define putUser(arg1, arg2) put_user(arg1, (unsigned long *)arg2)
-#define getUser(arg1, arg2) get_user(arg1, (unsigned int *)arg2)
+#define putUser(arg1, arg2) put_user(arg1, (unsigned long __user *)arg2)
+#define getUser(arg1, arg2) get_user(arg1, (unsigned __user *)arg2)
 
 #ifdef ENABLE_PCI
 #include <linux/pci.h>
@@ -218,7 +218,7 @@
 void epca_setup(char *, int *);
 void console_print(const char *);
 
-static int get_termio(struct tty_struct *, struct termio *);
+static int get_termio(struct tty_struct *, struct termio __user *);
 static int pc_write(struct tty_struct *, int, const unsigned char *, int);
 int pc_init(void);
 
@@ -835,38 +835,29 @@
 
 		if (bytesAvailable) 
 		{ /* Begin bytesAvailable */
+			/* ---------------------------------------------------------------
+				The below function reads data from user memory.  This routine
+				can not be used in an interrupt routine. (Because it may 
+				generate a page fault)  It can only be called while we can the
+				user context is accessible. 
+
+				The prototype is :
+				inline void copy_from_user(void * to, const void * from,
+							  unsigned long count);
+
+				I also think (Check hackers guide) that optimization must
+				be turned ON.  (Which sounds strange to me...)
+
+				Remember copy_from_user WILL generate a page fault if the
+				user memory being accessed has been swapped out.  This can
+				cause this routine to temporarily sleep while this page
+				fault is occurring.
+			
+			----------------------------------------------------------------- */
 
-			/* Can the user buffer be accessed at the moment ? */
-			if (verify_area(VERIFY_READ, (char*)buf, bytesAvailable))
-				bytesAvailable = 0; /* Can't do; try again later */
-			else  /* Evidently it can, began transmission */
-			{ /* Begin if area verified */
-				/* ---------------------------------------------------------------
-					The below function reads data from user memory.  This routine
-					can not be used in an interrupt routine. (Because it may 
-					generate a page fault)  It can only be called while we can the
-					user context is accessible. 
-
-					The prototype is :
-					inline void copy_from_user(void * to, const void * from,
-					                          unsigned long count);
-
-					I also think (Check hackers guide) that optimization must
-					be turned ON.  (Which sounds strange to me...)
-	
-					Remember copy_from_user WILL generate a page fault if the
-					user memory being accessed has been swapped out.  This can
-					cause this routine to temporarily sleep while this page
-					fault is occurring.
-				
-				----------------------------------------------------------------- */
-
-				if (copy_from_user(ch->tmp_buf, buf,
-						   bytesAvailable))
-					return -EFAULT;
-
-			} /* End if area verified */
-
+			if (copy_from_user(ch->tmp_buf, buf,
+					   bytesAvailable))
+				return -EFAULT;
 		} /* End bytesAvailable */
 
 		/* ------------------------------------------------------------------ 
@@ -1984,7 +1975,7 @@
 		ch->boardnum   = crd;
 		ch->channelnum = i;
 		ch->magic      = EPCA_MAGIC;
-		ch->tty        = 0;
+		ch->tty        = NULL;
 
 		if (shrinkmem) 
 		{
@@ -2728,7 +2719,7 @@
 { /* Begin receive_data */
 
 	unchar *rptr;
-	struct termios *ts = 0;
+	struct termios *ts = NULL;
 	struct tty_struct *tty;
 	volatile struct board_chan *bc;
 	register int dataToRead, wrapgap, bytesAvailable;
@@ -2851,8 +2842,6 @@
 static int info_ioctl(struct tty_struct *tty, struct file * file,
 		    unsigned int cmd, unsigned long arg)
 {
-	int error;
-	
 	switch (cmd) 
 	{ /* Begin switch cmd */
 
@@ -2862,13 +2851,7 @@
 			struct digi_info di ;
 			int brd;
 
-			getUser(brd, (unsigned int *)arg);
-
-			if ((error = verify_area(VERIFY_WRITE, (char*)arg, sizeof(di))))
-			{
-				printk(KERN_ERR "DIGI_GETINFO : verify area size 0x%x failed\n",sizeof(di));
-				return(error);
-			}
+			getUser(brd, (unsigned int __user *)arg);
 
 			if ((brd < 0) || (brd >= num_cards) || (num_cards == 0))
 				return (-ENODEV);
@@ -2882,7 +2865,7 @@
 			di.port = boards[brd].port ;
 			di.membase = boards[brd].membase ;
 
-			if (copy_to_user((char *)arg, &di, sizeof (di)))
+			if (copy_to_user((void __user *)arg, &di, sizeof (di)))
 				return -EFAULT;
 			break;
 
@@ -3020,6 +3003,7 @@
 	epcaparam(tty,ch);
 	memoff(ch);
 	restore_flags(flags);
+	return 0;
 }
 
 static int pc_ioctl(struct tty_struct *tty, struct file * file,
@@ -3027,12 +3011,13 @@
 { /* Begin pc_ioctl */
 
 	digiflow_t dflow;
-	int retval, error;
+	int retval;
 	unsigned long flags;
 	unsigned int mflag, mstat;
 	unsigned char startc, stopc;
 	volatile struct board_chan *bc;
 	struct channel *ch = (struct channel *) tty->driver_data;
+	void __user *argp = (void __user *)arg;
 	
 	if (ch)
 		bc = ch->brdchan;
@@ -3054,13 +3039,13 @@
 	{ /* Begin switch cmd */
 
 		case TCGETS:
-			if (copy_to_user((struct termios *)arg, 
+			if (copy_to_user(argp, 
 					 tty->termios, sizeof(struct termios)))
 				return -EFAULT;
 			return(0);
 
 		case TCGETA:
-			return get_termio(tty, (struct termio *)arg);
+			return get_termio(tty, argp);
 
 		case TCSBRK:	/* SVID version: non-zero arg --> no break */
 
@@ -3090,21 +3075,16 @@
 			return 0;
 
 		case TIOCGSOFTCAR:
-
-			error = verify_area(VERIFY_WRITE, (void *) arg,sizeof(long));
-			if (error)
-				return error;
-
-			putUser(C_CLOCAL(tty) ? 1 : 0,
-			            (unsigned long *) arg);
+			if (put_user(C_CLOCAL(tty)?1:0, (unsigned long __user *)arg))
+				return -EFAULT;
 			return 0;
 
 		case TIOCSSOFTCAR:
-			/*RONNIE PUT VERIFY_READ (See above) check here */
 		{
 			unsigned int value;
 
-			getUser(value, (unsigned int *)arg);
+			if (get_user(value, (unsigned __user *)argp))
+				return -EFAULT;
 			tty->termios->c_cflag =
 				((tty->termios->c_cflag & ~CLOCAL) |
 				 (value ? CLOCAL : 0));
@@ -3113,12 +3093,12 @@
 
 		case TIOCMODG:
 			mflag = pc_tiocmget(tty, file);
-			if (putUser(mflag, (unsigned int *) arg))
+			if (put_user(mflag, (unsigned long __user *)argp))
 				return -EFAULT;
 			break;
 
 		case TIOCMODS:
-			if (getUser(mstat, (unsigned int *)arg))
+			if (get_user(mstat, (unsigned __user *)argp))
 				return -EFAULT;
 			return pc_tiocmset(tty, file, mstat, ~mstat);
 
@@ -3141,8 +3121,7 @@
 			break;
 
 		case DIGI_GETA:
-			if (copy_to_user((char*)arg, &ch->digiext,
-					 sizeof(digi_t)))
+			if (copy_to_user(argp, &ch->digiext, sizeof(digi_t)))
 				return -EFAULT;
 			break;
 
@@ -3164,8 +3143,7 @@
 			/* Fall Thru */
 
 		case DIGI_SETA:
-			if (copy_from_user(&ch->digiext, (char*)arg,
-					   sizeof(digi_t)))
+			if (copy_from_user(&ch->digiext, argp, sizeof(digi_t)))
 				return -EFAULT;
 			
 			if (ch->digiext.digi_flags & DIGI_ALTPIN) 
@@ -3209,7 +3187,7 @@
 			memoff(ch);
 			restore_flags(flags);
 
-			if (copy_to_user((char*)arg, &dflow, sizeof(dflow)))
+			if (copy_to_user(argp, &dflow, sizeof(dflow)))
 				return -EFAULT;
 			break;
 
@@ -3226,7 +3204,7 @@
 				stopc = ch->stopca;
 			}
 
-			if (copy_from_user(&dflow, (char*)arg, sizeof(dflow)))
+			if (copy_from_user(&dflow, argp, sizeof(dflow)))
 				return -EFAULT;
 
 			if (dflow.startc != startc || dflow.stopc != stopc) 
@@ -3555,17 +3533,9 @@
 
 /* --------------------- Begin get_termio ----------------------- */
 
-static int get_termio(struct tty_struct * tty, struct termio * termio)
+static int get_termio(struct tty_struct * tty, struct termio __user * termio)
 { /* Begin get_termio */
-	int error;
-
-	error = verify_area(VERIFY_WRITE, termio, sizeof (struct termio));
-	if (error)
-		return error;
-
-	kernel_termios_to_user_termio(termio, tty->termios);
-
-	return 0;
+	return kernel_termios_to_user_termio(termio, tty->termios);
 } /* End get_termio */
 /* ---------------------- Begin epca_setup  -------------------------- */
 void epca_setup(char *str, int *ints)
diff -urN linux-2.6.8-rc2/drivers/char/esp.c linux-2.6.8-rc3/drivers/char/esp.c
--- linux-2.6.8-rc2/drivers/char/esp.c	2004-08-03 15:21:06.955505443 -0700
+++ linux-2.6.8-rc3/drivers/char/esp.c	2004-08-03 15:21:37.944776549 -0700
@@ -933,7 +933,7 @@
 		else if (request_dma(dma, "esp serial")) {
 			free_pages((unsigned long)dma_buffer,
 				   get_order(DMA_BUFFER_SZ));
-			dma_buffer = 0;
+			dma_buffer = NULL;
 			info->stat_flags |= ESP_STAT_USE_PIO;
 		}
 			
@@ -1038,13 +1038,13 @@
 			free_dma(dma);
 			free_pages((unsigned long)dma_buffer,
 				   get_order(DMA_BUFFER_SZ));
-			dma_buffer = 0;
+			dma_buffer = NULL;
 		}		
 	}
 
 	if (info->xmit_buf) {
 		free_page((unsigned long) info->xmit_buf);
-		info->xmit_buf = 0;
+		info->xmit_buf = NULL;
 	}
 
 	info->IER = 0;
@@ -1435,12 +1435,10 @@
  */
 
 static int get_serial_info(struct esp_struct * info,
-			   struct serial_struct * retinfo)
+			   struct serial_struct __user *retinfo)
 {
 	struct serial_struct tmp;
   
-	if (!retinfo)
-		return -EFAULT;
 	memset(&tmp, 0, sizeof(tmp));
 	tmp.type = PORT_16550A;
 	tmp.line = info->line;
@@ -1459,7 +1457,7 @@
 }
 
 static int get_esp_config(struct esp_struct * info,
-			  struct hayes_esp_config * retinfo)
+			  struct hayes_esp_config __user *retinfo)
 {
 	struct hayes_esp_config tmp;
   
@@ -1479,7 +1477,7 @@
 }
 
 static int set_serial_info(struct esp_struct * info,
-			   struct serial_struct * new_info)
+			   struct serial_struct __user *new_info)
 {
 	struct serial_struct new_serial;
 	struct esp_struct old_info;
@@ -1594,7 +1592,7 @@
 }
 
 static int set_esp_config(struct esp_struct * info,
-			  struct hayes_esp_config * new_info)
+			  struct hayes_esp_config __user * new_info)
 {
 	struct hayes_esp_config new_config;
 	unsigned int change_dma;
@@ -1739,7 +1737,7 @@
  * 	    transmit holding register is empty.  This functionality
  * 	    allows an RS485 driver to be written in user space. 
  */
-static int get_lsr_info(struct esp_struct * info, unsigned int *value)
+static int get_lsr_info(struct esp_struct * info, unsigned int __user *value)
 {
 	unsigned char status;
 	unsigned int result;
@@ -1834,7 +1832,8 @@
 {
 	struct esp_struct * info = (struct esp_struct *)tty->driver_data;
 	struct async_icount cprev, cnow;	/* kernel counter temps */
-	struct serial_icounter_struct *p_cuser;	/* user space */
+	struct serial_icounter_struct __user *p_cuser;	/* user space */
+	void __user *argp = (void __user *)arg;
 
 	if (serial_paranoia_check(info, tty->name, "rs_ioctl"))
 		return -ENODEV;
@@ -1850,20 +1849,18 @@
 	
 	switch (cmd) {
 		case TIOCGSERIAL:
-			return get_serial_info(info,
-					       (struct serial_struct *) arg);
+			return get_serial_info(info, argp);
 		case TIOCSSERIAL:
-			return set_serial_info(info,
-					       (struct serial_struct *) arg);
+			return set_serial_info(info, argp);
 		case TIOCSERCONFIG:
 			/* do not reconfigure after initial configuration */
 			return 0;
 
 		case TIOCSERGWILD:
-			return put_user(0L, (unsigned long *) arg);
+			return put_user(0L, (unsigned long __user *)argp);
 
 		case TIOCSERGETLSR: /* Get line status register */
-			    return get_lsr_info(info, (unsigned int *) arg);
+			    return get_lsr_info(info, argp);
 
 		case TIOCSERSWILD:
 			if (!capable(CAP_SYS_ADMIN))
@@ -1917,7 +1914,7 @@
 			cli();
 			cnow = info->icount;
 			sti();
-			p_cuser = (struct serial_icounter_struct *) arg;
+			p_cuser = argp;
 			if (put_user(cnow.cts, &p_cuser->cts) ||
 			    put_user(cnow.dsr, &p_cuser->dsr) ||
 			    put_user(cnow.rng, &p_cuser->rng) ||
@@ -1926,9 +1923,9 @@
 
 			return 0;
 	case TIOCGHAYESESP:
-		return (get_esp_config(info, (struct hayes_esp_config *)arg));
+		return get_esp_config(info, argp);
 	case TIOCSHAYESESP:
-		return (set_esp_config(info, (struct hayes_esp_config *)arg));
+		return set_esp_config(info, argp);
 
 		default:
 			return -ENOIOCTLCMD;
@@ -2076,7 +2073,7 @@
 		tty->ldisc.flush_buffer(tty);
 	tty->closing = 0;
 	info->event = 0;
-	info->tty = 0;
+	info->tty = NULL;
 
 	if (info->blocked_open) {
 		if (info->close_delay) {
@@ -2144,7 +2141,7 @@
 	info->event = 0;
 	info->count = 0;
 	info->flags &= ~ASYNC_NORMAL_ACTIVE;
-	info->tty = 0;
+	info->tty = NULL;
 	wake_up_interruptible(&info->open_wait);
 }
 
@@ -2446,7 +2443,7 @@
 	int i, offset;
 	int region_start;
 	struct esp_struct * info;
-	struct esp_struct *last_primary = 0;
+	struct esp_struct *last_primary = NULL;
 	int esp[] = {0x100,0x140,0x180,0x200,0x240,0x280,0x300,0x380};
 
 	esp_driver = alloc_tty_driver(NR_PORTS);
diff -urN linux-2.6.8-rc2/drivers/char/ftape/compressor/lzrw3.c linux-2.6.8-rc3/drivers/char/ftape/compressor/lzrw3.c
--- linux-2.6.8-rc2/drivers/char/ftape/compressor/lzrw3.c	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/ftape/compressor/lzrw3.c	2004-08-03 15:21:38.002778928 -0700
@@ -115,13 +115,14 @@
 /* compress a block of memory, decompress a block of memory, or to identify   */
 /* itself. For more information, see the specification file "compress.h".     */
 
-EXPORT void lzrw3_compress(action,wrk_mem,src_adr,src_len,dst_adr,p_dst_len)
-UWORD     action;      /* Action to be performed.                             */
-UBYTE   *wrk_mem;      /* Address of working memory we can use.               */
-UBYTE   *src_adr;      /* Address of input data.                              */
-LONG     src_len;      /* Length  of input data.                              */
-UBYTE   *dst_adr;      /* Address to put output data.                         */
-void  *p_dst_len;      /* Address of longword for length of output data.      */
+EXPORT void lzrw3_compress(
+	UWORD     action,      /* Action to be performed.		*/
+	UBYTE   *wrk_mem,	/* Address of working memory we can use.*/
+	UBYTE   *src_adr,	/* Address of input data.		*/
+	LONG     src_len,	/* Length  of input data.		*/
+	UBYTE   *dst_adr,	/* Address to put output data.		*/
+	void  *p_dst_len	/* Address of longword for length of output data.*/
+)
 {
  switch (action)
    {
@@ -314,9 +315,7 @@
    (((40543*(((*(PTR))<<8)^((*((PTR)+1))<<4)^(*((PTR)+2))))>>4) & 0xFFF)
 
 /******************************************************************************/
-                            
-LOCAL void compress_compress
-           (p_wrk_mem,p_src_first,src_len,p_dst_first,p_dst_len)
+
 /* Input  : Hand over the required amount of working memory in p_wrk_mem.     */
 /* Input  : Specify input block using p_src_first and src_len.                */
 /* Input  : Point p_dst_first to the start of the output zone (OZ).           */
@@ -326,11 +325,9 @@
 /* Output : Output block in Mem[p_dst_first..p_dst_first+*p_dst_len-1]. May   */
 /* Output : write in OZ=Mem[p_dst_first..p_dst_first+src_len+MAX_CMP_GROUP-1].*/
 /* Output : Upon completion guaranteed *p_dst_len<=src_len+FLAG_BYTES.        */
-UBYTE *p_wrk_mem;
-UBYTE *p_src_first;
-ULONG  src_len;
-UBYTE *p_dst_first;
-LONG  *p_dst_len;
+LOCAL void compress_compress(UBYTE *p_wrk_mem,
+			     UBYTE *p_src_first, ULONG  src_len,
+			     UBYTE *p_dst_first, LONG  *p_dst_len)
 {
  /* p_src and p_dst step through the source and destination blocks.           */
  register UBYTE *p_src = p_src_first;
@@ -366,8 +363,8 @@
  /* to the hash table entry corresponding to the second youngest literal.     */
  /* Note: p_h1=0=>p_h2=0 because zero values denote absence of a pending      */
  /* literal. The variables are initialized to zero meaning an empty "buffer". */
- UBYTE **p_h1=0;
- UBYTE **p_h2=0;
+ UBYTE **p_h1=NULL;
+ UBYTE **p_h2=NULL;
   
  /* To start, we write the flag bytes. Being optimistic, we set the flag to   */
  /* FLAG_COMPRESS. The remaining flag bytes are zeroed so as to keep the      */
@@ -488,9 +485,9 @@
           /* upon the arrival of extra context bytes.                         */
           if (p_h1!=0)
             {
-             if (p_h2!=0)
-               {*p_h2=p_ziv-2; p_h2=0;}
-             *p_h1=p_ziv-1; p_h1=0;
+             if (p_h2)
+               {*p_h2=p_ziv-2; p_h2=NULL;}
+             *p_h1=p_ziv-1; p_h1=NULL;
             }
             
           /* In any case, we can update the hash table based on the current   */
@@ -564,8 +561,6 @@
 
 /******************************************************************************/
 
-LOCAL void compress_decompress
-           (p_wrk_mem,p_src_first,src_len,p_dst_first,p_dst_len)
 /* Input  : Hand over the required amount of working memory in p_wrk_mem.     */
 /* Input  : Specify input block using p_src_first and src_len.                */
 /* Input  : Point p_dst_first to the start of the output zone.                */
@@ -576,11 +571,9 @@
 /* Output : Length of output block written to *p_dst_len.                     */
 /* Output : Output block in Mem[p_dst_first..p_dst_first+*p_dst_len-1].       */
 /* Output : Writes only  in Mem[p_dst_first..p_dst_first+*p_dst_len-1].       */
-UBYTE *p_wrk_mem;
-UBYTE *p_src_first;
-LONG   src_len;
-UBYTE *p_dst_first;
-ULONG *p_dst_len;
+LOCAL void compress_decompress( UBYTE *p_wrk_mem,
+				UBYTE *p_src_first, LONG   src_len,
+				UBYTE *p_dst_first, ULONG *p_dst_len)
 {
  /* Byte pointers p_src and p_dst scan through the input and output blocks.   */
  register UBYTE *p_src = p_src_first+FLAG_BYTES;
diff -urN linux-2.6.8-rc2/drivers/char/ftape/compressor/zftape-compress.c linux-2.6.8-rc3/drivers/char/ftape/compressor/zftape-compress.c
--- linux-2.6.8-rc2/drivers/char/ftape/compressor/zftape-compress.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/ftape/compressor/zftape-compress.c	2004-08-03 15:21:38.006779093 -0700
@@ -74,10 +74,10 @@
 /* forward */
 static int  zftc_write(int *write_cnt,
 		       __u8 *dst_buf, const int seg_sz,
-		       const __u8 *src_buf, const int req_len,
+		       const __u8 __user *src_buf, const int req_len,
 		       const zft_position *pos, const zft_volinfo *volume);
 static int  zftc_read(int *read_cnt,
-		      __u8  *dst_buf, const int to_do,
+		      __u8  __user *dst_buf, const int to_do,
 		      const __u8 *src_buf, const int seg_sz,
 		      const zft_position *pos, const zft_volinfo *volume);
 static int  zftc_seek(unsigned int new_block_pos, 
@@ -539,7 +539,7 @@
  */
 static int zftc_write(int *write_cnt,
 		      __u8 *dst_buf, const int seg_sz,
-		      const __u8 *src_buf, const int req_len,
+		      const __u8 __user *src_buf, const int req_len,
 		      const zft_position *pos, const zft_volinfo *volume)
 {
 	int req_len_left = req_len;
@@ -656,7 +656,7 @@
  * be set to 0 
  */
 static int zftc_read (int *read_cnt, 
-		      __u8  *dst_buf, const int to_do, 
+		      __u8  __user *dst_buf, const int to_do, 
 		      const __u8 *src_buf, const int seg_sz, 
 		      const zft_position *pos, const zft_volinfo *volume)
 {          
diff -urN linux-2.6.8-rc2/drivers/char/ftape/lowlevel/ftape-init.c linux-2.6.8-rc3/drivers/char/ftape/lowlevel/ftape-init.c
--- linux-2.6.8-rc2/drivers/char/ftape/lowlevel/ftape-init.c	2004-08-03 15:21:06.957505525 -0700
+++ linux-2.6.8-rc3/drivers/char/ftape/lowlevel/ftape-init.c	2004-08-03 15:21:38.065781513 -0700
@@ -90,7 +90,7 @@
 	TRACE(ft_t_info, "ftape_init @ 0x%p", ftape_init);
 	/*  Allocate the DMA buffers. They are deallocated at cleanup() time.
 	 */
-#if TESTING
+#ifdef TESTING
 #ifdef MODULE
 	while (ftape_set_nr_buffers(CONFIG_FT_NR_BUFFERS) < 0) {
 		ftape_sleep(FT_SECOND/20);
diff -urN linux-2.6.8-rc2/drivers/char/ftape/lowlevel/ftape-proc.c linux-2.6.8-rc3/drivers/char/ftape/lowlevel/ftape-proc.c
--- linux-2.6.8-rc2/drivers/char/ftape/lowlevel/ftape-proc.c	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/ftape/lowlevel/ftape-proc.c	2004-08-03 15:21:38.065781513 -0700
@@ -192,7 +192,7 @@
 	ptr += get_history_info(ptr);
 
 	len = strlen(page);
-	*start = 0;
+	*start = NULL;
 	if (off+count >= len) {
 		*eof = 1;
 	} else {
diff -urN linux-2.6.8-rc2/drivers/char/ftape/zftape/zftape-ctl.c linux-2.6.8-rc3/drivers/char/ftape/zftape/zftape-ctl.c
--- linux-2.6.8-rc2/drivers/char/ftape/zftape/zftape-ctl.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/ftape/zftape/zftape-ctl.c	2004-08-03 15:21:38.067781595 -0700
@@ -1319,7 +1319,7 @@
 
 /*  IOCTL routine called by kernel-interface code
  */
-int _zft_ioctl(unsigned int command, void * arg)
+int _zft_ioctl(unsigned int command, void __user * arg)
 {
 	int result;
 	union { struct mtop       mtop;
diff -urN linux-2.6.8-rc2/drivers/char/ftape/zftape/zftape-ctl.h linux-2.6.8-rc3/drivers/char/ftape/zftape/zftape-ctl.h
--- linux-2.6.8-rc2/drivers/char/ftape/zftape/zftape-ctl.h	2004-06-15 22:19:42.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/ftape/zftape/zftape-ctl.h	2004-08-03 15:21:38.068781636 -0700
@@ -52,7 +52,7 @@
  */
 extern int  _zft_open(unsigned int dev_minor, unsigned int access_mode);
 extern int  _zft_close(void);
-extern int  _zft_ioctl(unsigned int command, void *arg);
+extern int  _zft_ioctl(unsigned int command, void __user *arg);
 #endif
 
 
diff -urN linux-2.6.8-rc2/drivers/char/ftape/zftape/zftape-init.c linux-2.6.8-rc3/drivers/char/ftape/zftape/zftape-init.c
--- linux-2.6.8-rc2/drivers/char/ftape/zftape/zftape-init.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/ftape/zftape/zftape-init.c	2004-08-03 15:21:38.084782292 -0700
@@ -88,9 +88,9 @@
 static int  zft_ioctl(struct inode *ino, struct file *filep,
 		      unsigned int command, unsigned long arg);
 static int  zft_mmap(struct file *filep, struct vm_area_struct *vma);
-static ssize_t zft_read (struct file *fp, char *buff,
+static ssize_t zft_read (struct file *fp, char __user *buff,
 			 size_t req_len, loff_t *ppos);
-static ssize_t zft_write(struct file *fp, const char *buff,
+static ssize_t zft_write(struct file *fp, const char __user *buff,
 			 size_t req_len, loff_t *ppos);
 
 static struct file_operations zft_cdev =
@@ -177,7 +177,7 @@
 	old_sigmask = current->blocked; /* save mask */
 	sigfillset(&current->blocked);
 	/* This will work as long as sizeof(void *) == sizeof(long) */
-	result = _zft_ioctl(command, (void *) arg);
+	result = _zft_ioctl(command, (void __user *) arg);
 	current->blocked = old_sigmask; /* restore mask */
 	TRACE_EXIT result;
 }
@@ -211,7 +211,7 @@
 
 /*      Read from floppy tape device
  */
-static ssize_t zft_read(struct file *fp, char *buff,
+static ssize_t zft_read(struct file *fp, char __user *buff,
 			size_t req_len, loff_t *ppos)
 {
 	int result = -EIO;
@@ -234,7 +234,7 @@
 
 /*      Write to tape device
  */
-static ssize_t zft_write(struct file *fp, const char *buff,
+static ssize_t zft_write(struct file *fp, const char __user *buff,
 			 size_t req_len, loff_t *ppos)
 {
 	int result = -EIO;
diff -urN linux-2.6.8-rc2/drivers/char/ftape/zftape/zftape-init.h linux-2.6.8-rc3/drivers/char/ftape/zftape/zftape-init.h
--- linux-2.6.8-rc2/drivers/char/ftape/zftape/zftape-init.h	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/ftape/zftape/zftape-init.h	2004-08-03 15:21:38.084782292 -0700
@@ -52,10 +52,10 @@
 struct zft_cmpr_ops {
 	int (*write)(int *write_cnt,
 		     __u8 *dst_buf, const int seg_sz,
-		     const __u8 *src_buf, const int req_len, 
+		     const __u8 __user *src_buf, const int req_len, 
 		     const zft_position *pos, const zft_volinfo *volume);
 	int (*read)(int *read_cnt,
-		    __u8 *dst_buf, const int req_len,
+		    __u8 __user *dst_buf, const int req_len,
 		    const __u8 *src_buf, const int seg_sz,
 		    const zft_position *pos, const zft_volinfo *volume);
 	int (*seek)(unsigned int new_block_pos,
diff -urN linux-2.6.8-rc2/drivers/char/ftape/zftape/zftape-read.c linux-2.6.8-rc3/drivers/char/ftape/zftape/zftape-read.c
--- linux-2.6.8-rc2/drivers/char/ftape/zftape/zftape-read.c	2004-06-15 22:19:43.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/ftape/zftape/zftape-read.c	2004-08-03 15:21:38.111783400 -0700
@@ -154,7 +154,7 @@
  * amount of data actually * copied to the user-buffer
  */
 static int zft_simple_read (int *read_cnt, 
-			    __u8  *dst_buf, 
+			    __u8  __user *dst_buf, 
 			    const int to_do, 
 			    const __u8 *src_buf, 
 			    const int seg_sz, 
@@ -252,7 +252,7 @@
  * req_len: how much data should be read at most.
  * volume: contains information on current volume (blk_sz etc.)
  */  
-static int empty_deblock_buf(__u8 *usr_buf, const int req_len,
+static int empty_deblock_buf(__u8 __user *usr_buf, const int req_len,
 			     const __u8 *src_buf, const int seg_sz,
 			     zft_position *pos,
 			     const zft_volinfo *volume)
@@ -293,7 +293,7 @@
  * use small block-sizes. The block-size may be 1kb (SECTOR_SIZE). In
  * this case a MTFSR 28 maybe still inside the same segment.
  */
-int _zft_read(char* buff, int req_len)
+int _zft_read(char __user *buff, int req_len)
 {
 	int req_clipped;
 	int result     = 0;
diff -urN linux-2.6.8-rc2/drivers/char/ftape/zftape/zftape-read.h linux-2.6.8-rc3/drivers/char/ftape/zftape/zftape-read.h
--- linux-2.6.8-rc2/drivers/char/ftape/zftape/zftape-read.h	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/ftape/zftape/zftape-read.h	2004-08-03 15:21:38.111783400 -0700
@@ -48,6 +48,6 @@
 				   0, FT_SEGMENT_SIZE)
 /*   hook for the VFS interface
  */
-extern int  _zft_read(char* buff, int req_len);
+extern int  _zft_read(char __user *buff, int req_len);
 
 #endif /* _ZFTAPE_READ_H */
diff -urN linux-2.6.8-rc2/drivers/char/ftape/zftape/zftape-write.c linux-2.6.8-rc3/drivers/char/ftape/zftape/zftape-write.c
--- linux-2.6.8-rc2/drivers/char/ftape/zftape/zftape-write.c	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/ftape/zftape/zftape-write.c	2004-08-03 15:21:38.112783441 -0700
@@ -303,7 +303,7 @@
  */
 static int zft_simple_write(int *cnt,
 			    __u8 *dst_buf, const int seg_sz,
-			    const __u8 *src_buf, const int req_len, 
+			    const __u8 __user *src_buf, const int req_len, 
 			    const zft_position *pos,const zft_volinfo *volume)
 {
 	int space_left;
@@ -379,7 +379,7 @@
 
 static int fill_deblock_buf(__u8 *dst_buf, const int seg_sz,
 			    zft_position *pos, const zft_volinfo *volume,
-			    const char *usr_buf, const int req_len)
+			    const char __user *usr_buf, const int req_len)
 {
 	int cnt = 0;
 	int result = 0;
@@ -420,7 +420,7 @@
 
 /*  called by the kernel-interface routine "zft_write()"
  */
-int _zft_write(const char* buff, int req_len)
+int _zft_write(const char __user *buff, int req_len)
 {
 	int result = 0;
 	int written = 0;
diff -urN linux-2.6.8-rc2/drivers/char/ftape/zftape/zftape-write.h linux-2.6.8-rc3/drivers/char/ftape/zftape/zftape-write.h
--- linux-2.6.8-rc2/drivers/char/ftape/zftape/zftape-write.h	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/ftape/zftape/zftape-write.h	2004-08-03 15:21:38.112783441 -0700
@@ -34,5 +34,5 @@
 
 /*  hook for the VFS interface 
  */
-extern int _zft_write(const char *buff, int req_len);
+extern int _zft_write(const char __user *buff, int req_len);
 #endif /* _ZFTAPE_WRITE_H */
diff -urN linux-2.6.8-rc2/drivers/char/generic_serial.c linux-2.6.8-rc3/drivers/char/generic_serial.c
--- linux-2.6.8-rc2/drivers/char/generic_serial.c	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/generic_serial.c	2004-08-03 15:21:38.125783974 -0700
@@ -45,7 +45,7 @@
 #define func_enter() gs_dprintk (GS_DEBUG_FLOW, "gs: enter %s\n", __FUNCTION__)
 #define func_exit()  gs_dprintk (GS_DEBUG_FLOW, "gs: exit  %s\n", __FUNCTION__)
 
-#if NEW_WRITE_LOCKING
+#ifdef NEW_WRITE_LOCKING
 #define DECL      /* Nothing */
 #define LOCKIT    down (& port->port_write_sem);
 #define RELEASEIT up (&port->port_write_sem);
@@ -526,7 +526,7 @@
 
 	if (port->xmit_buf) {
 		free_page((unsigned long) port->xmit_buf);
-		port->xmit_buf = 0;
+		port->xmit_buf = NULL;
 	}
 
 	if (port->tty)
@@ -767,7 +767,7 @@
 	port->event = 0;
 	port->rd->close (port);
 	port->rd->shutdown_port (port);
-	port->tty = 0;
+	port->tty = NULL;
 
 	if (port->blocked_open) {
 		if (port->close_delay) {
@@ -967,7 +967,7 @@
 }
 
 
-int gs_setserial(struct gs_port *port, struct serial_struct *sp)
+int gs_setserial(struct gs_port *port, struct serial_struct __user *sp)
 {
 	struct serial_struct sio;
 
@@ -1002,7 +1002,7 @@
  *      Generate the serial struct info.
  */
 
-int gs_getserial(struct gs_port *port, struct serial_struct *sp)
+int gs_getserial(struct gs_port *port, struct serial_struct __user *sp)
 {
 	struct serial_struct    sio;
 
diff -urN linux-2.6.8-rc2/drivers/char/genrtc.c linux-2.6.8-rc3/drivers/char/genrtc.c
--- linux-2.6.8-rc2/drivers/char/genrtc.c	2004-08-03 15:21:06.958505566 -0700
+++ linux-2.6.8-rc3/drivers/char/genrtc.c	2004-08-03 15:21:38.144784754 -0700
@@ -469,7 +469,7 @@
 {
 	struct proc_dir_entry *r;
 
-	r = create_proc_read_entry("driver/rtc", 0, 0, gen_rtc_read_proc, NULL);
+	r = create_proc_read_entry("driver/rtc", 0, NULL, gen_rtc_read_proc, NULL);
 	if (!r)
 		return -ENOMEM;
 	return 0;
diff -urN linux-2.6.8-rc2/drivers/char/hpet.c linux-2.6.8-rc3/drivers/char/hpet.c
--- linux-2.6.8-rc2/drivers/char/hpet.c	2004-08-03 15:21:06.967505935 -0700
+++ linux-2.6.8-rc3/drivers/char/hpet.c	2004-08-03 15:21:38.165785615 -0700
@@ -1,8 +1,14 @@
 /*
  * Intel & MS High Precision Event Timer Implementation.
- * Contributors:
+ *
+ * Copyright (C) 2003 Intel Corporation
  *	Venki Pallipadi
- * 	Bob Picco
+ * (c) Copyright 2004 Hewlett-Packard Development Company, L.P.
+ *	Bob Picco <robert.picco@hp.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include <linux/config.h>
@@ -250,9 +256,7 @@
 
 static int hpet_mmap(struct file *file, struct vm_area_struct *vma)
 {
-#ifdef	CONFIG_HPET_NOMMAP
-	return -ENOSYS;
-#else
+#ifdef	CONFIG_HPET_MMAP
 	struct hpet_dev *devp;
 	unsigned long addr;
 
@@ -276,6 +280,8 @@
 	}
 
 	return 0;
+#else
+	return -ENOSYS;
 #endif
 }
 
@@ -901,14 +907,10 @@
 			hdp->hd_nirqs = irqp->number_of_interrupts;
 
 			for (i = 0; i < hdp->hd_nirqs; i++)
-#ifdef	CONFIG_IA64
 				hdp->hd_irq[i] =
 				    acpi_register_gsi(irqp->interrupts[i],
 						      irqp->edge_level,
 						      irqp->active_high_low);
-#else
-				hdp->hd_irq[i] = irqp->interrupts[i];
-#endif
 		}
 	}
 
diff -urN linux-2.6.8-rc2/drivers/char/hvcs.c linux-2.6.8-rc3/drivers/char/hvcs.c
--- linux-2.6.8-rc2/drivers/char/hvcs.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/drivers/char/hvcs.c	2004-08-03 15:21:38.168785739 -0700
@@ -0,0 +1,1579 @@
+/*
+ * IBM eServer Hypervisor Virtual Console Server Device Driver
+ * Copyright (C) 2003, 2004 IBM Corp.
+ *  Ryan S. Arnold (rsa@us.ibm.com)
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
+ *
+ * Author(s) :  Ryan S. Arnold <rsa@us.ibm.com>
+ *
+ * This is the device driver for the IBM Hypervisor Virtual Console Server,
+ * "hvcs".  The IBM hvcs provides a tty driver interface to allow Linux
+ * user space applications access to the system consoles of logically
+ * partitioned operating systems, e.g. Linux, running on the same partitioned
+ * Power5 ppc64 system.  Physical hardware consoles per partition are not
+ * practical on this hardware so system consoles are accessed by this driver
+ * using inter-partition firmware interfaces to virtual terminal devices.
+ *
+ * A vty is known to the HMC as a "virtual serial server adapter".  It is a
+ * virtual terminal device that is created by firmware upon partition creation
+ * to act as a partitioned OS's console device.
+ *
+ * Firmware dynamically (via hotplug) exposes vty-servers to a running ppc64
+ * Linux system upon their creation by the HMC or their exposure during boot.
+ * The non-user interactive backend of this driver is implemented as a vio
+ * device driver so that it can receive notification of vty-server lifetimes
+ * after it registers with the vio bus to handle vty-server probe and remove
+ * callbacks.
+ *
+ * Many vty-servers can be configured to connect to one vty, but a vty can
+ * only be actively connected to by a single vty-server, in any manner, at one
+ * time.  If the HMC is currently hosting the console for a target Linux
+ * partition; attempts to open the tty device to the partition's console using
+ * the hvcs on any partition will return -EBUSY with every open attempt until
+ * the HMC frees the connection between its vty-server and the desired
+ * partition's vty device.  Conversely, a vty-server may only be connected to
+ * a single vty at one time even though it may have several configured vty
+ * partner possibilities.
+ *
+ * Firmware does not provide notification of vty partner changes to this
+ * driver.  This means that an HMC Super Admin may add or remove partner vtys
+ * from a vty-server's partner list but the changes will not be signaled to
+ * the vty-server.  Firmware only notifies the driver when a vty-server is
+ * added or removed from the system.  To compensate for this deficiency, this
+ * driver implements a sysfs update attribute which provides a method for
+ * rescanning partner information upon a user's request.
+ *
+ * Each vty-server, prior to being exposed to this driver is reference counted
+ * using the 2.6 Linux kernel kobject construct.  This kobject is also used by
+ * the vio bus to provide a vio device sysfs entry that this driver attaches
+ * device specific attributes to, including partner information.  The vio bus
+ * framework also provides a sysfs entry for each vio driver.  The hvcs driver
+ * provides driver attributes in this entry.
+ *
+ * For direction on installation and usage of this driver please reference
+ * Documentation/powerpc/hvcs.txt.
+ */
+
+#include <linux/device.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/kernel.h>
+#include <linux/kobject.h>
+#include <linux/kthread.h>
+#include <linux/list.h>
+#include <linux/major.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/sched.h>
+#include <linux/spinlock.h>
+#include <linux/stat.h>
+#include <linux/tty.h>
+#include <linux/tty_flip.h>
+#include <asm/hvconsole.h>
+#include <asm/hvcserver.h>
+#include <asm/uaccess.h>
+#include <asm/vio.h>
+
+/*
+ * 1.0.0 -> 1.1.0 Added kernel_thread scheduling methodology to driver to
+ * replace wait_task constructs.
+ *
+ * 1.1.0 -> 1.2.0 Moved pi_buff initialization out of arch code into driver code
+ * and added locking to share this buffer between hvcs_struct instances.  This
+ * is because the page_size kmalloc can't be done with a spin_lock held.
+ *
+ * Also added sysfs attribute to manually disconnect the vty-server from the vty
+ * due to stupid firmware behavior when opening the connection then sending data
+ * then then quickly closing the connection would cause data loss on the
+ * receiving side.  This required some reordering of the termination code.
+ *
+ * Fixed the hangup scenario and fixed memory leaks on module_exit.
+ *
+ * 1.2.0 -> 1.3.0 Moved from manual kernel thread creation & execution to
+ * kthread construct which replaced in-kernel IPC for thread termination with
+ * kthread_stop and kthread_should_stop.  Explicit wait_queue handling was
+ * removed because kthread handles this.  Minor bug fix to postpone partner_info
+ * clearing on hvcs_close until adapter removal to preserve context data for
+ * printk on partner connection free.  Added lock to protect hvcs_structs so
+ * that hvcs_struct instances aren't added or removed during list traversal.
+ * Cleaned up comment style, added spaces after commas, and broke function
+ * declaration lines to be under 80 columns.
+ */
+#define HVCS_DRIVER_VERSION "1.3.0"
+
+MODULE_AUTHOR("Ryan S. Arnold <rsa@us.ibm.com>");
+MODULE_DESCRIPTION("IBM hvcs (Hypervisor Virtual Console Server) Driver");
+MODULE_LICENSE("GPL");
+MODULE_VERSION(HVCS_DRIVER_VERSION);
+
+/*
+ * Since the Linux TTY code does not currently (2-04-2004) support dynamic
+ * addition of tty derived devices and we shouldn't allocate thousands of
+ * tty_device pointers when the number of vty-server & vty partner connections
+ * will most often be much lower than this, we'll arbitrarily allocate
+ * HVCS_DEFAULT_SERVER_ADAPTERS tty_structs and cdev's by default when we
+ * register the tty_driver. This can be overridden using an insmod parameter.
+ */
+#define HVCS_DEFAULT_SERVER_ADAPTERS	64
+
+/*
+ * The user can't insmod with more than HVCS_MAX_SERVER_ADAPTERS hvcs device
+ * nodes as a sanity check.  Theoretically there can be over 1 Billion
+ * vty-server & vty partner connections.
+ */
+#define HVCS_MAX_SERVER_ADAPTERS	1024
+
+/*
+ * We let Linux assign us a major number and we start the minors at zero.  There
+ * is no intuitive mapping between minor number and the target partition.  The
+ * mapping of minor number is related to the order the vty-servers are exposed
+ * to this driver via the hvcs_probe function.
+ */
+#define HVCS_MINOR_START	0
+
+/*
+ * The hcall interface involves putting 8 chars into each of two registers.
+ * We load up those 2 registers (in arch/ppc64/hvconsole.c) by casting char[16]
+ * to long[2].  It would work without __ALIGNED__, but a little (tiny) bit
+ * slower because an unaligned load is slower than aligned load.
+ */
+#define __ALIGNED__	__attribute__((__aligned__(8)))
+
+/* Converged location code string length + 1 null terminator */
+#define CLC_LENGTH		80
+
+/*
+ * How much data can firmware send with each hvc_put_chars()?  Maybe this
+ * should be moved into an architecture specific area.
+ */
+#define HVCS_BUFF_LEN	16
+
+/*
+ * This is the maximum amount of data we'll let the user send us (hvcs_write) at
+ * once in a chunk as a sanity check.
+ */
+#define HVCS_MAX_FROM_USER	4096
+
+/*
+ * Be careful when adding flags to this line discipline.  Don't add anything
+ * that will cause echoing or we'll go into recursive loop echoing chars back
+ * and forth with the console drivers.
+ */
+static struct termios hvcs_tty_termios = {
+	.c_iflag = IGNBRK | IGNPAR,
+	.c_oflag = OPOST,
+	.c_cflag = B38400 | CS8 | CREAD | HUPCL,
+	.c_cc = INIT_C_CC
+};
+
+/*
+ * This value is used to take the place of a command line parameter when the
+ * module is inserted.  It starts as -1 and stays as such if the user doesn't
+ * specify a module insmod parameter.  If they DO specify one then it is set to
+ * the value of the integer passed in.
+ */
+static int hvcs_parm_num_devs = -1;
+module_param(hvcs_parm_num_devs, int, 0);
+
+char hvcs_driver_name[] = "hvcs";
+char hvcs_device_node[] = "hvcs";
+char hvcs_driver_string[]
+	= "IBM hvcs (Hypervisor Virtual Console Server) Driver";
+
+/* Status of partner info rescan triggered via sysfs. */
+static int hvcs_rescan_status = 0;
+
+static struct tty_driver *hvcs_tty_driver;
+
+/*
+ * This is used to associate a vty-server, as it is exposed to this driver, with
+ * a preallocated tty_struct.index.  The dev node and hvcs index numbers are not
+ * re-used after device removal otherwise removing and adding a new one would
+ * link a /dev/hvcs* entry to a different vty-server than it did before the
+ * removal.  Incidentally, a newly exposed vty-server will always map to an
+ * incrementally higher /dev/hvcs* entry than the last exposed vty-server.
+ */
+static int hvcs_struct_count = -1;
+
+/*
+ * Used by the khvcsd to pick up I/O operations when the kernel_thread is
+ * already awake but potentially shifted to TASK_INTERRUPTIBLE state.
+ */
+static int hvcs_kicked = 0;
+
+/* Used the the kthread construct for task operations */
+static struct task_struct *hvcs_task;
+
+/*
+ * We allocate this for the use of all of the hvcs_structs when they fetch
+ * partner info.
+ */
+static unsigned long *hvcs_pi_buff;
+
+static spinlock_t hvcs_pi_lock;
+
+/* One vty-server per hvcs_struct */
+struct hvcs_struct {
+	spinlock_t lock;
+
+	/*
+	 * This index identifies this hvcs device as the complement to a
+	 * specific tty index.
+	 */
+	unsigned int index;
+
+	struct tty_struct *tty;
+	unsigned int open_count;
+
+	/*
+	 * Used to tell the driver kernel_thread what operations need to take
+	 * place upon this hvcs_struct instance.
+	 */
+	int todo_mask;
+
+	/*
+	 * This buffer is required so that when hvcs_write_room() reports that
+	 * it can send HVCS_BUFF_LEN characters that it will buffer the full
+	 * HVCS_BUFF_LEN characters if need be.  This is essential for opost
+	 * writes since they do not do high level buffering and expect to be
+	 * able to send what the driver commits to sending buffering
+	 * [e.g. tab to space conversions in n_tty.c opost()].
+	 */
+	char buffer[HVCS_BUFF_LEN];
+	int chars_in_buffer;
+
+	/*
+	 * Any variable below the kobject is valid before a tty is connected and
+	 * stays valid after the tty is disconnected.  These shouldn't be
+	 * whacked until the koject refcount reaches zero though some entries
+	 * may be changed via sysfs initiatives.
+	 */
+	struct kobject kobj; /* ref count & hvcs_struct lifetime */
+	int connected; /* is the vty-server currently connected to a vty? */
+	unsigned int p_unit_address; /* partner unit address */
+	unsigned int p_partition_ID; /* partner partition ID */
+	char p_location_code[CLC_LENGTH];
+	struct list_head next; /* list management */
+	struct vio_dev *vdev;
+};
+
+/* Required to back map a kobject to its containing object */
+#define from_kobj(kobj) container_of(kobj, struct hvcs_struct, kobj)
+
+static struct list_head hvcs_structs = LIST_HEAD_INIT(hvcs_structs);
+static spinlock_t hvcs_structs_lock;
+
+static void hvcs_unthrottle(struct tty_struct *tty);
+static void hvcs_throttle(struct tty_struct *tty);
+static irqreturn_t hvcs_handle_interrupt(int irq, void *dev_instance,
+		struct pt_regs *regs);
+
+static int hvcs_write(struct tty_struct *tty, int from_user,
+		const unsigned char *buf, int count);
+static int hvcs_write_room(struct tty_struct *tty);
+static int hvcs_chars_in_buffer(struct tty_struct *tty);
+
+static int hvcs_has_pi(struct hvcs_struct *hvcsd);
+static void hvcs_set_pi(struct hvcs_partner_info *pi,
+		struct hvcs_struct *hvcsd);
+static int hvcs_get_pi(struct hvcs_struct *hvcsd);
+static int hvcs_rescan_devices_list(void);
+
+static int hvcs_partner_connect(struct hvcs_struct *hvcsd);
+static void hvcs_partner_free(struct hvcs_struct *hvcsd);
+
+static int hvcs_enable_device(struct hvcs_struct *hvcsd,
+		uint32_t unit_address, unsigned int irq, struct vio_dev *dev);
+static void hvcs_final_close(struct hvcs_struct *hvcsd);
+
+static void destroy_hvcs_struct(struct kobject *kobj);
+static int hvcs_open(struct tty_struct *tty, struct file *filp);
+static void hvcs_close(struct tty_struct *tty, struct file *filp);
+static void hvcs_hangup(struct tty_struct * tty);
+
+static void hvcs_create_device_attrs(struct hvcs_struct *hvcsd);
+static void hvcs_remove_device_attrs(struct vio_dev *vdev);
+static void hvcs_create_driver_attrs(void);
+static void hvcs_remove_driver_attrs(void);
+
+static int __devinit hvcs_probe(struct vio_dev *dev,
+		const struct vio_device_id *id);
+static int __devexit hvcs_remove(struct vio_dev *dev);
+static int __init hvcs_module_init(void);
+static void __exit hvcs_module_exit(void);
+
+#define HVCS_SCHED_READ	0x00000001
+#define HVCS_QUICK_READ	0x00000002
+#define HVCS_TRY_WRITE	0x00000004
+#define HVCS_READ_MASK	(HVCS_SCHED_READ | HVCS_QUICK_READ)
+
+static void hvcs_kick(void)
+{
+	hvcs_kicked = 1;
+	wmb();
+	wake_up_process(hvcs_task);
+}
+
+static void hvcs_unthrottle(struct tty_struct *tty)
+{
+	struct hvcs_struct *hvcsd = tty->driver_data;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+	hvcsd->todo_mask |= HVCS_SCHED_READ;
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+	hvcs_kick();
+}
+
+static void hvcs_throttle(struct tty_struct *tty)
+{
+	struct hvcs_struct *hvcsd = tty->driver_data;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+	vio_disable_interrupts(hvcsd->vdev);
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+}
+
+/*
+ * If the device is being removed we don't have to worry about this interrupt
+ * handler taking any further interrupts because they are disabled which means
+ * the hvcs_struct will always be valid in this handler.
+ */
+static irqreturn_t hvcs_handle_interrupt(int irq, void *dev_instance,
+		struct pt_regs *regs)
+{
+	struct hvcs_struct *hvcsd = dev_instance;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+	vio_disable_interrupts(hvcsd->vdev);
+	hvcsd->todo_mask |= HVCS_SCHED_READ;
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+	hvcs_kick();
+
+	return IRQ_HANDLED;
+}
+
+/* This function must be called with the hvcsd->lock held */
+static void hvcs_try_write(struct hvcs_struct *hvcsd)
+{
+	unsigned int unit_address = hvcsd->vdev->unit_address;
+	struct tty_struct *tty = hvcsd->tty;
+	int sent;
+
+	if (hvcsd->todo_mask & HVCS_TRY_WRITE) {
+		/* won't send partial writes */
+		sent = hvc_put_chars(unit_address,
+				&hvcsd->buffer[0],
+				hvcsd->chars_in_buffer );
+		if (sent > 0) {
+			hvcsd->chars_in_buffer = 0;
+			wmb();
+			hvcsd->todo_mask &= ~(HVCS_TRY_WRITE);
+			wmb();
+
+			/*
+			 * We are still obligated to deliver the data to the
+			 * hypervisor even if the tty has been closed because
+			 * we commited to delivering it.  But don't try to wake
+			 * a non-existent tty.
+			 */
+			if (tty) {
+				if ((tty->flags & (1 << TTY_DO_WRITE_WAKEUP))
+						&& tty->ldisc.write_wakeup)
+					(tty->ldisc.write_wakeup) (tty);
+				wake_up_interruptible(&tty->write_wait);
+			}
+		}
+	}
+}
+
+static int hvcs_io(struct hvcs_struct *hvcsd)
+{
+	unsigned int unit_address;
+	struct tty_struct *tty;
+	char buf[HVCS_BUFF_LEN] __ALIGNED__;
+	unsigned long flags;
+	int got;
+	int i;
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+
+	unit_address = hvcsd->vdev->unit_address;
+	tty = hvcsd->tty;
+
+	hvcs_try_write(hvcsd);
+
+	if (!tty || test_bit(TTY_THROTTLED, &tty->flags)) {
+		hvcsd->todo_mask &= ~(HVCS_READ_MASK);
+		goto bail;
+	} else if (!(hvcsd->todo_mask & (HVCS_READ_MASK)))
+		goto bail;
+
+	/* remove the read masks */
+	hvcsd->todo_mask &= ~(HVCS_READ_MASK);
+
+	if ((tty->flip.count + HVCS_BUFF_LEN) < TTY_FLIPBUF_SIZE) {
+		got = hvc_get_chars(unit_address,
+				&buf[0],
+				HVCS_BUFF_LEN);
+		for (i=0;got && i<got;i++)
+			tty_insert_flip_char(tty, buf[i], TTY_NORMAL);
+	}
+
+	/* Give the TTY time to process the data we just sent. */
+	if (got)
+		hvcsd->todo_mask |= HVCS_QUICK_READ;
+
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+	if (tty->flip.count) {
+		/* This is synch because tty->low_latency == 1 */
+		tty_flip_buffer_push(tty);
+	}
+
+	if (!got) {
+		/* Do this _after_ the flip_buffer_push */
+		spin_lock_irqsave(&hvcsd->lock, flags);
+		vio_enable_interrupts(hvcsd->vdev);
+		spin_unlock_irqrestore(&hvcsd->lock, flags);
+	}
+
+	return hvcsd->todo_mask;
+
+ bail:
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+	return hvcsd->todo_mask;
+}
+
+static int khvcsd(void *unused)
+{
+	struct hvcs_struct *hvcsd = NULL;
+	struct list_head *element;
+	struct list_head *safe_temp;
+	int hvcs_todo_mask;
+	unsigned long structs_flags;
+
+	__set_current_state(TASK_RUNNING);
+
+	do {
+		hvcs_todo_mask = 0;
+		hvcs_kicked = 0;
+		wmb();
+
+		spin_lock_irqsave(&hvcs_structs_lock, structs_flags);
+		list_for_each_safe(element, safe_temp, &hvcs_structs) {
+			hvcsd = list_entry(element, struct hvcs_struct, next);
+				hvcs_todo_mask |= hvcs_io(hvcsd);
+		}
+		spin_unlock_irqrestore(&hvcs_structs_lock, structs_flags);
+
+		/*
+		 * If any of the hvcs adapters want to try a write or quick read
+		 * don't schedule(), yield a smidgen then execute the hvcs_io
+		 * thread again for those that want the write.
+		 */
+		 if (hvcs_todo_mask & (HVCS_TRY_WRITE | HVCS_QUICK_READ)) {
+			yield();
+			continue;
+		}
+
+		set_current_state(TASK_INTERRUPTIBLE);
+		if (!hvcs_kicked)
+			schedule();
+		__set_current_state(TASK_RUNNING);
+	} while (!kthread_should_stop());
+
+	return 0;
+}
+
+static struct vio_device_id hvcs_driver_table[] __devinitdata= {
+	{"serial-server", "hvterm2"},
+	{ 0, }
+};
+MODULE_DEVICE_TABLE(vio, hvcs_driver_table);
+
+/* callback when the kboject ref count reaches zero */
+static void destroy_hvcs_struct(struct kobject *kobj)
+{
+	struct hvcs_struct *hvcsd = from_kobj(kobj);
+	struct vio_dev *vdev;
+	unsigned long flags;
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+
+	/* the list_del poisons the pointers */
+	list_del(&(hvcsd->next));
+
+	if (hvcsd->connected == 1) {
+		hvcs_partner_free(hvcsd);
+		printk(KERN_INFO "HVCS: Closed vty-server@%X and"
+				" partner vty@%X:%d connection.\n",
+				hvcsd->vdev->unit_address,
+				hvcsd->p_unit_address,
+				(unsigned int)hvcsd->p_partition_ID);
+	}
+	printk(KERN_INFO "HVCS: Destroyed hvcs_struct for vty-server@%X.\n",
+			hvcsd->vdev->unit_address);
+
+	vdev = hvcsd->vdev;
+	hvcsd->vdev = NULL;
+
+	hvcsd->p_unit_address = 0;
+	hvcsd->p_partition_ID = 0;
+	memset(&hvcsd->p_location_code[0], 0x00, CLC_LENGTH);
+
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+
+	hvcs_remove_device_attrs(vdev);
+
+	kfree(hvcsd);
+}
+
+/* This function must be called with hvcsd->lock held. */
+static void hvcs_final_close(struct hvcs_struct *hvcsd)
+{
+	vio_disable_interrupts(hvcsd->vdev);
+	free_irq(hvcsd->vdev->irq, hvcsd);
+
+	hvcsd->todo_mask = 0;
+
+	/* These two may be redundant if the operation was a close. */
+	if (hvcsd->tty) {
+		hvcsd->tty->driver_data = NULL;
+		hvcsd->tty = NULL;
+	}
+
+	hvcsd->open_count = 0;
+
+	memset(&hvcsd->buffer[0], 0x00, HVCS_BUFF_LEN);
+	hvcsd->chars_in_buffer = 0;
+}
+
+static struct kobj_type hvcs_kobj_type = {
+	.release = destroy_hvcs_struct,
+};
+
+static int __devinit hvcs_probe(
+	struct vio_dev *dev,
+	const struct vio_device_id *id)
+{
+	struct hvcs_struct *hvcsd;
+	unsigned long structs_flags;
+
+	if (!dev || !id) {
+		printk(KERN_ERR "HVCS: probed with invalid parameter.\n");
+		return -EPERM;
+	}
+
+	hvcsd = kmalloc(sizeof(*hvcsd), GFP_KERNEL);
+	if (!hvcsd) {
+		return -ENODEV;
+	}
+
+	/* hvcsd->tty is zeroed out with the memset */
+	memset(hvcsd, 0x00, sizeof(*hvcsd));
+
+	hvcsd->lock = SPIN_LOCK_UNLOCKED;
+	/* Automatically incs the refcount the first time */
+	kobject_init(&hvcsd->kobj);
+	/* Set up the callback for terminating the hvcs_struct's life */
+	hvcsd->kobj.ktype = &hvcs_kobj_type;
+
+	hvcsd->vdev = dev;
+	dev->dev.driver_data = hvcsd;
+
+	hvcsd->index = ++hvcs_struct_count;
+	hvcsd->chars_in_buffer = 0;
+	hvcsd->todo_mask = 0;
+	hvcsd->connected = 0;
+
+	/*
+	 * This will populate the hvcs_struct's partner info fields for the
+	 * first time.
+	 */
+	if (hvcs_get_pi(hvcsd)) {
+		printk(KERN_ERR "HVCS: Failed to fetch partner"
+			" info for vty-server@%X on device probe.\n",
+			hvcsd->vdev->unit_address);
+	}
+
+	/*
+	 * If a user app opens a tty that corresponds to this vty-server before
+	 * the hvcs_struct has been added to the devices list then the user app
+	 * will get -ENODEV.
+	 */
+
+	spin_lock_irqsave(&hvcs_structs_lock, structs_flags);
+
+	list_add_tail(&(hvcsd->next), &hvcs_structs);
+
+	spin_unlock_irqrestore(&hvcs_structs_lock, structs_flags);
+
+	hvcs_create_device_attrs(hvcsd);
+
+	printk(KERN_INFO "HVCS: Added vty-server@%X.\n", dev->unit_address);
+
+	/*
+	 * DON'T enable interrupts here because there is no user to receive the
+	 * data.
+	 */
+	return 0;
+}
+
+static int __devexit hvcs_remove(struct vio_dev *dev)
+{
+	struct hvcs_struct *hvcsd = dev->dev.driver_data;
+	unsigned long flags;
+	struct kobject *kobjp;
+	struct tty_struct *tty;
+
+	if (!hvcsd)
+		return -ENODEV;
+
+	/* By this time the vty-server won't be getting any more interrups */
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+
+	tty = hvcsd->tty;
+
+	kobjp = &hvcsd->kobj;
+
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+
+	/*
+	 * Let the last holder of this object cause it to be removed, which
+	 * would probably be tty_hangup below.
+	 */
+	kobject_put (kobjp);
+
+	/*
+	 * The hangup is a scheduled function which will auto chain call
+	 * hvcs_hangup.  The tty should always be valid at this time unless a
+	 * simultaneous tty close already cleaned up the hvcs_struct.
+	 */
+	if (tty)
+		tty_hangup(tty);
+
+	printk(KERN_INFO "HVCS: vty-server@%X removed from the"
+			" vio bus.\n", dev->unit_address);
+	return 0;
+};
+
+static struct vio_driver hvcs_vio_driver = {
+	.name		= hvcs_driver_name,
+	.id_table	= hvcs_driver_table,
+	.probe		= hvcs_probe,
+	.remove		= hvcs_remove,
+};
+
+/* Only called from hvcs_get_pi please */
+static void hvcs_set_pi(struct hvcs_partner_info *pi, struct hvcs_struct *hvcsd)
+{
+	int clclength;
+
+	hvcsd->p_unit_address = pi->unit_address;
+	hvcsd->p_partition_ID  = pi->partition_ID;
+	clclength = strlen(&pi->location_code[0]);
+	if (clclength > CLC_LENGTH - 1)
+		clclength = CLC_LENGTH - 1;
+
+	/* copy the null-term char too */
+	strncpy(&hvcsd->p_location_code[0],
+			&pi->location_code[0], clclength + 1);
+}
+
+/*
+ * Traverse the list and add the partner info that is found to the hvcs_struct
+ * struct entry. NOTE: At this time I know that partner info will return a
+ * single entry but in the future there may be multiple partner info entries per
+ * vty-server and you'll want to zero out that list and reset it.  If for some
+ * reason you have an old version of this driver but there IS more than one
+ * partner info then hvcsd->p_* will hold the last partner info data from the
+ * firmware query.  A good way to update this code would be to replace the three
+ * partner info fields in hvcs_struct with a list of hvcs_partner_info
+ * instances.
+ *
+ * This function must be called with the hvcsd->lock held.
+ */
+static int hvcs_get_pi(struct hvcs_struct *hvcsd)
+{
+	/* struct hvcs_partner_info *head_pi = NULL; */
+	struct hvcs_partner_info *pi = NULL;
+	unsigned int unit_address = hvcsd->vdev->unit_address;
+	struct list_head head;
+	unsigned long flags;
+	int retval;
+
+	spin_lock_irqsave(&hvcs_pi_lock, flags);
+	if (!hvcs_pi_buff) {
+		spin_unlock_irqrestore(&hvcs_pi_lock, flags);
+		return -EFAULT;
+	}
+	retval = hvcs_get_partner_info(unit_address, &head, hvcs_pi_buff);
+	spin_unlock_irqrestore(&hvcs_pi_lock, flags);
+	if (retval) {
+		printk(KERN_ERR "HVCS: Failed to fetch partner"
+			" info for vty-server@%x.\n", unit_address);
+		return retval;
+	}
+
+	/* nixes the values if the partner vty went away */
+	hvcsd->p_unit_address = 0;
+	hvcsd->p_partition_ID = 0;
+
+	list_for_each_entry(pi, &head, node)
+		hvcs_set_pi(pi, hvcsd);
+
+	hvcs_free_partner_info(&head);
+	return 0;
+}
+
+/*
+ * This function is executed by the driver "rescan" sysfs entry.  It shouldn't
+ * be executed elsewhere, in order to prevent deadlock issues.
+ */
+static int hvcs_rescan_devices_list(void)
+{
+	struct hvcs_struct *hvcsd = NULL;
+	unsigned long flags;
+	unsigned long structs_flags;
+
+	spin_lock_irqsave(&hvcs_structs_lock, structs_flags);
+
+	list_for_each_entry(hvcsd, &hvcs_structs, next) {
+		spin_lock_irqsave(&hvcsd->lock, flags);
+		hvcs_get_pi(hvcsd);
+		spin_unlock_irqrestore(&hvcsd->lock, flags);
+	}
+
+	spin_unlock_irqrestore(&hvcs_structs_lock, structs_flags);
+
+	return 0;
+}
+
+/*
+ * Farm this off into its own function because it could be more complex once
+ * multiple partners support is added. This function should be called with
+ * the hvcsd->lock held.
+ */
+static int hvcs_has_pi(struct hvcs_struct *hvcsd)
+{
+	if ((!hvcsd->p_unit_address) || (!hvcsd->p_partition_ID))
+		return 0;
+	return 1;
+}
+
+/*
+ * NOTE: It is possible that the super admin removed a partner vty and then
+ * added a different vty as the new partner.
+ *
+ * This function must be called with the hvcsd->lock held.
+ */
+static int hvcs_partner_connect(struct hvcs_struct *hvcsd)
+{
+	int retval;
+	unsigned int unit_address = hvcsd->vdev->unit_address;
+
+	/*
+	 * If there wasn't any pi when the device was added it doesn't meant
+	 * there isn't any now.  This driver isn't notified when a new partner
+	 * vty is added to a vty-server so we discover changes on our own.
+	 * Please see comments in hvcs_register_connection() for justification
+	 * of this bizarre code.
+	 */
+	retval = hvcs_register_connection(unit_address,
+			hvcsd->p_partition_ID,
+			hvcsd->p_unit_address);
+	if (!retval) {
+		hvcsd->connected = 1;
+		return 0;
+	} else if (retval != -EINVAL)
+		return retval;
+
+	/*
+	 * As per the spec re-get the pi and try again if -EINVAL after the
+	 * first connection attempt.
+	 */
+	if (hvcs_get_pi(hvcsd))
+		return -ENOMEM;
+
+	if (!hvcs_has_pi(hvcsd))
+		return -ENODEV;
+
+	retval = hvcs_register_connection(unit_address,
+			hvcsd->p_partition_ID,
+			hvcsd->p_unit_address);
+	if (retval != -EINVAL) {
+		hvcsd->connected = 1;
+		return retval;
+	}
+
+	/*
+	 * EBUSY is the most likely scenario though the vty could have been
+	 * removed or there really could be an hcall error due to the parameter
+	 * data but thanks to ambiguous firmware return codes we can't really
+	 * tell.
+	 */
+	printk(KERN_INFO "HVCS: vty-server or partner"
+			" vty is busy.  Try again later.\n");
+	return -EBUSY;
+}
+
+/* This function must be called with the hvcsd->lock held */
+static void hvcs_partner_free(struct hvcs_struct *hvcsd)
+{
+	int retval;
+	do {
+		retval = hvcs_free_connection(hvcsd->vdev->unit_address);
+	} while (retval == -EBUSY);
+	hvcsd->connected = 0;
+}
+
+/* This helper function must be called WITHOUT the hvcsd->lock held */
+static int hvcs_enable_device(struct hvcs_struct *hvcsd, uint32_t unit_address,
+		unsigned int irq, struct vio_dev *vdev)
+{
+	unsigned long flags;
+
+	/*
+	 * It is possible that the vty-server was removed between the time that
+	 * the conn was registered and now.
+	 */
+	if (!request_irq(irq, &hvcs_handle_interrupt,
+				SA_INTERRUPT, "ibmhvcs", hvcsd)) {
+		/*
+		 * It is possible the vty-server was removed after the irq was
+		 * requested but before we have time to enable interrupts.
+		 */
+		if (vio_enable_interrupts(vdev) == H_Success)
+			return 0;
+		else {
+			printk(KERN_ERR "HVCS: int enable failed for"
+					" vty-server@%X.\n", unit_address);
+			free_irq(irq, hvcsd);
+		}
+	} else
+		printk(KERN_ERR "HVCS: irq req failed for"
+				" vty-server@%X.\n", unit_address);
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+	hvcs_partner_free(hvcsd);
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+
+	return -ENODEV;
+
+}
+
+/*
+ * This always increments the kobject ref count if the call is successful.
+ * Please remember to dec when you are done with the instance.
+ *
+ * NOTICE: Do NOT hold either the hvcs_struct.lock or hvcs_structs_lock when
+ * calling this function or you will get deadlock.
+ */
+struct hvcs_struct *hvcs_get_by_index(int index)
+{
+	struct hvcs_struct *hvcsd = NULL;
+	struct list_head *element;
+	struct list_head *safe_temp;
+	unsigned long flags;
+	unsigned long structs_flags;
+
+	spin_lock_irqsave(&hvcs_structs_lock, structs_flags);
+	/* We can immediately discard OOB requests */
+	if (index >= 0 && index < HVCS_MAX_SERVER_ADAPTERS) {
+		list_for_each_safe(element, safe_temp, &hvcs_structs) {
+			hvcsd = list_entry(element, struct hvcs_struct, next);
+			spin_lock_irqsave(&hvcsd->lock, flags);
+			if (hvcsd->index == index) {
+				kobject_get(&hvcsd->kobj);
+				spin_unlock_irqrestore(&hvcsd->lock, flags);
+				spin_unlock_irqrestore(&hvcs_structs_lock,
+						structs_flags);
+				return hvcsd;
+			}
+			spin_unlock_irqrestore(&hvcsd->lock, flags);
+		}
+		hvcsd = NULL;
+	}
+
+	spin_unlock_irqrestore(&hvcs_structs_lock, structs_flags);
+	return hvcsd;
+}
+
+/*
+ * This is invoked via the tty_open interface when a user app connects to the
+ * /dev node.
+ */
+static int hvcs_open(struct tty_struct *tty, struct file *filp)
+{
+	struct hvcs_struct *hvcsd = NULL;
+	int retval = 0;
+	unsigned long flags;
+	unsigned int irq;
+	struct vio_dev *vdev;
+	unsigned long unit_address;
+
+	if (tty->driver_data)
+		goto fast_open;
+
+	/*
+	 * Is there a vty-server that shares the same index?
+	 * This function increments the kobject index.
+	 */
+	if (!(hvcsd = hvcs_get_by_index(tty->index))) {
+		printk(KERN_WARNING "HVCS: open failed, no index.\n");
+		return -ENODEV;
+	}
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+
+	if (hvcsd->connected == 0)
+		if ((retval = hvcs_partner_connect(hvcsd)))
+			goto error_release;
+
+	hvcsd->open_count = 1;
+	hvcsd->tty = tty;
+	tty->driver_data = hvcsd;
+
+	/*
+	 * Set this driver to low latency so that we actually have a chance at
+	 * catching a throttled TTY after we flip_buffer_push.  Otherwise the
+	 * flush_to_async may not execute until after the kernel_thread has
+	 * yielded and resumed the next flip_buffer_push resulting in data
+	 * loss.
+	 */
+	tty->low_latency = 1;
+
+	memset(&hvcsd->buffer[0], 0x3F, HVCS_BUFF_LEN);
+
+	/*
+	 * Save these in the spinlock for the enable operations that need them
+	 * outside of the spinlock.
+	 */
+	irq = hvcsd->vdev->irq;
+	vdev = hvcsd->vdev;
+	unit_address = hvcsd->vdev->unit_address;
+
+	hvcsd->todo_mask |= HVCS_SCHED_READ;
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+
+	/*
+	 * This must be done outside of the spinlock because it requests irqs
+	 * and will grab the spinlcok and free the connection if it fails.
+	 */
+	if ((hvcs_enable_device(hvcsd, unit_address, irq, vdev))) {
+		kobject_put(&hvcsd->kobj);
+		printk(KERN_WARNING "HVCS: enable device failed.\n");
+		return -ENODEV;
+	}
+
+	goto open_success;
+
+fast_open:
+	hvcsd = tty->driver_data;
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+	if (!kobject_get(&hvcsd->kobj)) {
+		spin_unlock_irqrestore(&hvcsd->lock, flags);
+		printk(KERN_ERR "HVCS: Kobject of open"
+			" hvcs doesn't exist.\n");
+		return -EFAULT; /* Is this the right return value? */
+	}
+
+	hvcsd->open_count++;
+
+	hvcsd->todo_mask |= HVCS_SCHED_READ;
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+open_success:
+	hvcs_kick();
+
+	printk(KERN_INFO "HVCS: vty-server@%X opened.\n",
+		hvcsd->vdev->unit_address );
+
+	return 0;
+
+error_release:
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+	kobject_put(&hvcsd->kobj);
+
+	printk(KERN_WARNING "HVCS: HVCS partner connect failed.\n");
+	return retval;
+}
+
+static void hvcs_close(struct tty_struct *tty, struct file *filp)
+{
+	struct hvcs_struct *hvcsd;
+	unsigned long flags;
+	struct kobject *kobjp;
+
+	/*
+	 * Is someone trying to close the file associated with this device after
+	 * we have hung up?  If so tty->driver_data wouldn't be valid.
+	 */
+	if (tty_hung_up_p(filp))
+		return;
+
+	/*
+	 * No driver_data means that this close was probably issued after a
+	 * failed hvcs_open by the tty layer's release_dev() api and we can just
+	 * exit cleanly.
+	 */
+	if (!tty->driver_data)
+		return;
+
+	hvcsd = tty->driver_data;
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+	if (--hvcsd->open_count == 0) {
+
+		/*
+		 * This line is important because it tells hvcs_open that this
+		 * device needs to be re-configured the next time hvcs_open is
+		 * called.
+		 */
+		hvcsd->tty->driver_data = NULL;
+
+		/*
+		 * NULL this early so that the kernel_thread doesn't try to
+		 * execute any operations on the TTY even though it is obligated
+		 * to deliver any pending I/O to the hypervisor.
+		 */
+		hvcsd->tty = NULL;
+
+		/*
+		 * Block the close until all the buffered data has been
+		 * delivered.
+		 */
+		while(hvcsd->chars_in_buffer) {
+			spin_unlock_irqrestore(&hvcsd->lock, flags);
+
+			/*
+			 * Give the kernel thread the hvcs_struct so that it can
+			 * try to deliver the remaining data but block the close
+			 * operation by spinning in this function so that other
+			 * tty operations have to wait.
+			 */
+			yield();
+			spin_lock_irqsave(&hvcsd->lock, flags);
+		}
+
+		hvcs_final_close(hvcsd);
+
+	} else if (hvcsd->open_count < 0) {
+		printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
+				" is missmanaged.\n",
+			hvcsd->vdev->unit_address, hvcsd->open_count);
+	}
+	kobjp = &hvcsd->kobj;
+
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+
+	kobject_put(kobjp);
+}
+
+static void hvcs_hangup(struct tty_struct * tty)
+{
+	struct hvcs_struct *hvcsd = tty->driver_data;
+	unsigned long flags;
+	int temp_open_count;
+	struct kobject *kobjp;
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+	/* Preserve this so that we know how many kobject refs to put */
+	temp_open_count = hvcsd->open_count;
+
+	/*
+	 * Don't kobject put inside the spinlock because the destruction
+	 * callback may use the spinlock and it may get called before the
+	 * spinlock has been released.  Get a pointer to the kobject and
+	 * kobject_put on that instead.
+	 */
+	kobjp = &hvcsd->kobj;
+
+	/* Calling this will drop any buffered data on the floor. */
+	hvcs_final_close(hvcsd);
+
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+
+	/*
+	 * We need to kobject_put() for every open_count we have since the
+	 * tty_hangup() function doesn't invoke a close per open connection on a
+	 * non-console device.
+	 */
+	while(temp_open_count) {
+		--temp_open_count;
+		/*
+		 * The final put will trigger destruction of the hvcs_struct.
+		 * NOTE:  If this hangup was signaled from user space then the
+		 * final put will never happen.
+		 */
+		kobject_put(kobjp);
+	}
+}
+
+/*
+ * NOTE: This is almost always from_user since user level apps interact with the
+ * /dev nodes. I'm trusting that if hvcs_write gets called and interrupted by
+ * hvcs_remove (which removes the target device and executes tty_hangup()) that
+ * tty_hangup will allow hvcs_write time to complete execution before it
+ * terminates our device.
+ */
+static int hvcs_write(struct tty_struct *tty, int from_user,
+		const unsigned char *buf, int count)
+{
+	struct hvcs_struct *hvcsd = tty->driver_data;
+	unsigned int unit_address;
+	unsigned char *charbuf;
+	unsigned long flags;
+	int total_sent = 0;
+	int tosend = 0;
+	int result = 0;
+
+	/*
+	 * If they don't check the return code off of their open they may
+	 * attempt this even if there is no connected device.
+	 */
+	if (!hvcsd)
+		return -ENODEV;
+
+	/* Reasonable size to prevent user level flooding */
+	if (count > HVCS_MAX_FROM_USER) {
+		printk(KERN_WARNING "HVCS write: count being truncated to"
+				" HVCS_MAX_FROM_USER.\n");
+		count = HVCS_MAX_FROM_USER;
+	}
+
+	if (!from_user)
+		charbuf = (unsigned char *)buf;
+	else {
+		charbuf = kmalloc(count, GFP_KERNEL);
+		if (!charbuf) {
+			printk(KERN_WARNING "HVCS: write -ENOMEM.\n");
+			return -ENOMEM;
+		}
+
+		if (copy_from_user(charbuf, buf, count)) {
+			kfree(charbuf);
+			printk(KERN_WARNING "HVCS: write -EFAULT.\n");
+			return -EFAULT;
+		}
+	}
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+
+	/*
+	 * Somehow an open succedded but the device was removed or the
+	 * connection terminated between the vty-server and partner vty during
+	 * the middle of a write operation?  This is a crummy place to do this
+	 * but we want to keep it all in the spinlock.
+	 */
+	if (hvcsd->open_count <= 0) {
+		spin_unlock_irqrestore(&hvcsd->lock, flags);
+		if (from_user)
+			kfree(charbuf);
+		return -ENODEV;
+	}
+
+	unit_address = hvcsd->vdev->unit_address;
+
+	while (count > 0) {
+		tosend = min(count, (HVCS_BUFF_LEN - hvcsd->chars_in_buffer));
+		/*
+		 * No more space, this probably means that the last call to
+		 * hvcs_write() didn't succeed and the buffer was filled up.
+		 */
+		if (!tosend)
+			break;
+
+		memcpy(&hvcsd->buffer[hvcsd->chars_in_buffer],
+				&charbuf[total_sent],
+				tosend);
+
+		hvcsd->chars_in_buffer += tosend;
+
+		result = 0;
+
+		/*
+		 * If this is true then we don't want to try writing to the
+		 * hypervisor because that is the kernel_threads job now.  We'll
+		 * just add to the buffer.
+		 */
+		if (!(hvcsd->todo_mask & HVCS_TRY_WRITE))
+			/* won't send partial writes */
+			result = hvc_put_chars(unit_address,
+					&hvcsd->buffer[0],
+					hvcsd->chars_in_buffer);
+
+		/*
+		 * Since we know we have enough room in hvcsd->buffer for
+		 * tosend we record that it was sent regardless of whether the
+		 * hypervisor actually took it because we have it buffered.
+		 */
+		total_sent+=tosend;
+		count-=tosend;
+		if (result == 0) {
+			hvcsd->todo_mask |= HVCS_TRY_WRITE;
+			hvcs_kick();
+			break;
+		}
+
+		hvcsd->chars_in_buffer = 0;
+		/*
+		 * Test after the chars_in_buffer reset otherwise this could
+		 * deadlock our writes if hvc_put_chars fails.
+		 */
+		if (result < 0)
+			break;
+	}
+
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+	if (from_user)
+		kfree(charbuf);
+
+	if (result == -1)
+		return -EIO;
+	else
+		return total_sent;
+}
+
+/*
+ * This is really asking how much can we guarentee that we can send or that we
+ * absolutely WILL BUFFER if we can't send it.  This driver MUST honor the
+ * return value, hence the reason for hvcs_struct buffering.
+ */
+static int hvcs_write_room(struct tty_struct *tty)
+{
+	struct hvcs_struct *hvcsd = tty->driver_data;
+	unsigned long flags;
+	int retval;
+
+	if (!hvcsd || hvcsd->open_count <= 0)
+		return 0;
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+	retval = HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+	return retval;
+}
+
+static int hvcs_chars_in_buffer(struct tty_struct *tty)
+{
+	struct hvcs_struct *hvcsd = tty->driver_data;
+	unsigned long flags;
+	int retval;
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+	retval = hvcsd->chars_in_buffer;
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+	return retval;
+}
+
+static struct tty_operations hvcs_ops = {
+	.open = hvcs_open,
+	.close = hvcs_close,
+	.hangup = hvcs_hangup,
+	.write = hvcs_write,
+	.write_room = hvcs_write_room,
+	.chars_in_buffer = hvcs_chars_in_buffer,
+	.unthrottle = hvcs_unthrottle,
+	.throttle = hvcs_throttle,
+};
+
+static int __init hvcs_module_init(void)
+{
+	int rc;
+	int num_ttys_to_alloc;
+
+	printk(KERN_INFO "Initializing %s\n", hvcs_driver_string);
+
+	/* Has the user specified an overload with an insmod param? */
+	if (hvcs_parm_num_devs <= 0 ||
+		(hvcs_parm_num_devs > HVCS_MAX_SERVER_ADAPTERS)) {
+		num_ttys_to_alloc = HVCS_DEFAULT_SERVER_ADAPTERS;
+	} else
+		num_ttys_to_alloc = hvcs_parm_num_devs;
+
+	hvcs_tty_driver = alloc_tty_driver(num_ttys_to_alloc);
+	if (!hvcs_tty_driver)
+		return -ENOMEM;
+
+	hvcs_tty_driver->owner = THIS_MODULE;
+
+	hvcs_tty_driver->driver_name = hvcs_driver_name;
+	hvcs_tty_driver->name = hvcs_device_node;
+
+	/*
+	 * We'll let the system assign us a major number, indicated by leaving
+	 * it blank.
+	 */
+
+	hvcs_tty_driver->minor_start = HVCS_MINOR_START;
+	hvcs_tty_driver->type = TTY_DRIVER_TYPE_SYSTEM;
+
+	/*
+	 * We role our own so that we DONT ECHO.  We can't echo because the
+	 * device we are connecting to already echoes by default and this would
+	 * throw us into a horrible recursive echo-echo-echo loop.
+	 */
+	hvcs_tty_driver->init_termios = hvcs_tty_termios;
+	hvcs_tty_driver->flags = TTY_DRIVER_REAL_RAW;
+
+	tty_set_operations(hvcs_tty_driver, &hvcs_ops);
+
+	/*
+	 * The following call will result in sysfs entries that denote the
+	 * dynamically assigned major and minor numbers for our devices.
+	 */
+	if (tty_register_driver(hvcs_tty_driver)) {
+		printk(KERN_ERR "HVCS: registration "
+			" as a tty driver failed.\n");
+		put_tty_driver(hvcs_tty_driver);
+		return rc;
+	}
+
+	hvcs_structs_lock = SPIN_LOCK_UNLOCKED;
+
+	hvcs_pi_lock = SPIN_LOCK_UNLOCKED;
+	hvcs_pi_buff = kmalloc(PAGE_SIZE, GFP_KERNEL);
+
+	hvcs_task = kthread_run(khvcsd, NULL, "khvcsd");
+	if (IS_ERR(hvcs_task)) {
+		printk("khvcsd creation failed.  Driver not loaded.\n");
+		kfree(hvcs_pi_buff);
+		put_tty_driver(hvcs_tty_driver);
+		return -EIO;
+	}
+
+	rc = vio_register_driver(&hvcs_vio_driver);
+
+	/*
+	 * This needs to be done AFTER the vio_register_driver() call or else
+	 * the kobjects won't be initialized properly.
+	 */
+	hvcs_create_driver_attrs();
+
+	printk(KERN_INFO "HVCS: driver module inserted.\n");
+
+	return rc;
+}
+
+static void __exit hvcs_module_exit(void)
+{
+	unsigned long flags;
+
+	/*
+	 * This driver receives hvcs_remove callbacks for each device upon
+	 * module removal.
+	 */
+
+	/*
+	 * This synchronous operation  will wake the khvcsd kthread if it is
+	 * asleep and will return when khvcsd has terminated.
+	 */
+	kthread_stop(hvcs_task);
+
+	spin_lock_irqsave(&hvcs_pi_lock, flags);
+	kfree(hvcs_pi_buff);
+	hvcs_pi_buff = NULL;
+	spin_unlock_irqrestore(&hvcs_pi_lock, flags);
+
+	hvcs_remove_driver_attrs();
+
+	vio_unregister_driver(&hvcs_vio_driver);
+
+	tty_unregister_driver(hvcs_tty_driver);
+
+	put_tty_driver(hvcs_tty_driver);
+
+	printk(KERN_INFO "HVCS: driver module removed.\n");
+}
+
+module_init(hvcs_module_init);
+module_exit(hvcs_module_exit);
+
+static inline struct hvcs_struct *from_vio_dev(struct vio_dev *viod)
+{
+	return viod->dev.driver_data;
+}
+/* The sysfs interface for the driver and devices */
+
+static ssize_t hvcs_partner_vtys_show(struct device *dev, char *buf)
+{
+	struct vio_dev *viod = to_vio_dev(dev);
+	struct hvcs_struct *hvcsd = from_vio_dev(viod);
+	unsigned long flags;
+	int retval;
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+	retval = sprintf(buf, "%X\n", hvcsd->p_unit_address);
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+	return retval;
+}
+static DEVICE_ATTR(partner_vtys, S_IRUGO, hvcs_partner_vtys_show, NULL);
+
+static ssize_t hvcs_partner_clcs_show(struct device *dev, char *buf)
+{
+	struct vio_dev *viod = to_vio_dev(dev);
+	struct hvcs_struct *hvcsd = from_vio_dev(viod);
+	unsigned long flags;
+	int retval;
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+	retval = sprintf(buf, "%s\n", &hvcsd->p_location_code[0]);
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+	return retval;
+}
+static DEVICE_ATTR(partner_clcs, S_IRUGO, hvcs_partner_clcs_show, NULL);
+
+static ssize_t hvcs_current_vty_store(struct device *dev, const char * buf,
+		size_t count)
+{
+	/*
+	 * Don't need this feature at the present time because firmware doesn't
+	 * yet support multiple partners.
+	 */
+	printk(KERN_INFO "HVCS: Denied current_vty change: -EPERM.\n");
+	return -EPERM;
+}
+
+static ssize_t hvcs_current_vty_show(struct device *dev, char *buf)
+{
+	struct vio_dev *viod = to_vio_dev(dev);
+	struct hvcs_struct *hvcsd = from_vio_dev(viod);
+	unsigned long flags;
+	int retval;
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+	retval = sprintf(buf, "%s\n", &hvcsd->p_location_code[0]);
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+	return retval;
+}
+
+static DEVICE_ATTR(current_vty,
+	S_IRUGO | S_IWUSR, hvcs_current_vty_show, hvcs_current_vty_store);
+
+static ssize_t hvcs_vterm_state_store(struct device *dev, const char *buf,
+		size_t count)
+{
+	struct vio_dev *viod = to_vio_dev(dev);
+	struct hvcs_struct *hvcsd = from_vio_dev(viod);
+	unsigned long flags;
+
+	/* writing a '0' to this sysfs entry will result in the disconnect. */
+	if (simple_strtol(buf, NULL, 0) != 0)
+		return -EINVAL;
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+
+	if (hvcsd->open_count > 0) {
+		spin_unlock_irqrestore(&hvcsd->lock, flags);
+		printk(KERN_INFO "HVCS: vterm state unchanged.  "
+				"The hvcs device node is still in use.\n");
+		return -EPERM;
+	}
+
+	if (hvcsd->connected == 0) {
+		spin_unlock_irqrestore(&hvcsd->lock, flags);
+		printk(KERN_INFO "HVCS: vterm state unchanged. The"
+				" vty-server is not connected to a vty.\n");
+		return -EPERM;
+	}
+
+	hvcs_partner_free(hvcsd);
+	printk(KERN_INFO "HVCS: Closed vty-server@%X and"
+			" partner vty@%X:%d connection.\n",
+			hvcsd->vdev->unit_address,
+			hvcsd->p_unit_address,
+			(unsigned int)hvcsd->p_partition_ID);
+
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+	return count;
+}
+
+static ssize_t hvcs_vterm_state_show(struct device *dev, char *buf)
+{
+	struct vio_dev *viod = to_vio_dev(dev);
+	struct hvcs_struct *hvcsd = from_vio_dev(viod);
+	unsigned long flags;
+	int retval;
+
+	spin_lock_irqsave(&hvcsd->lock, flags);
+	retval = sprintf(buf, "%d\n", hvcsd->connected);
+	spin_unlock_irqrestore(&hvcsd->lock, flags);
+	return retval;
+}
+static DEVICE_ATTR(vterm_state, S_IRUGO | S_IWUSR,
+		hvcs_vterm_state_show, hvcs_vterm_state_store);
+
+static struct attribute *hvcs_attrs[] = {
+	&dev_attr_partner_vtys.attr,
+	&dev_attr_partner_clcs.attr,
+	&dev_attr_current_vty.attr,
+	&dev_attr_vterm_state.attr,
+	NULL,
+};
+
+static struct attribute_group hvcs_attr_group = {
+	.attrs = hvcs_attrs,
+};
+
+static void hvcs_create_device_attrs(struct hvcs_struct *hvcsd)
+{
+	struct vio_dev *vdev = hvcsd->vdev;
+	sysfs_create_group(&vdev->dev.kobj, &hvcs_attr_group);
+}
+
+static void hvcs_remove_device_attrs(struct vio_dev *vdev)
+{
+	sysfs_remove_group(&vdev->dev.kobj, &hvcs_attr_group);
+}
+
+static ssize_t hvcs_rescan_show(struct device_driver *ddp, char *buf)
+{
+	/* A 1 means it is updating, a 0 means it is done updating */
+	return snprintf(buf, PAGE_SIZE, "%d\n", hvcs_rescan_status);
+}
+
+static ssize_t hvcs_rescan_store(struct device_driver *ddp, const char * buf,
+		size_t count)
+{
+	if ((simple_strtol(buf, NULL, 0) != 1)
+		&& (hvcs_rescan_status != 0))
+		return -EINVAL;
+
+	hvcs_rescan_status = 1;
+	printk(KERN_INFO "HVCS: rescanning partner info for all"
+		" vty-servers.\n");
+	hvcs_rescan_devices_list();
+	hvcs_rescan_status = 0;
+	return count;
+}
+static DRIVER_ATTR(rescan,
+	S_IRUGO | S_IWUSR, hvcs_rescan_show, hvcs_rescan_store);
+
+static void hvcs_create_driver_attrs(void)
+{
+	struct device_driver *driverfs = &(hvcs_vio_driver.driver);
+	driver_create_file(driverfs, &driver_attr_rescan);
+}
+
+static void hvcs_remove_driver_attrs(void)
+{
+	struct device_driver *driverfs = &(hvcs_vio_driver.driver);
+	driver_remove_file(driverfs, &driver_attr_rescan);
+}
diff -urN linux-2.6.8-rc2/drivers/char/ip2main.c linux-2.6.8-rc3/drivers/char/ip2main.c
--- linux-2.6.8-rc2/drivers/char/ip2main.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/ip2main.c	2004-08-03 15:21:38.249789062 -0700
@@ -203,16 +203,16 @@
 
 static void set_params (i2ChanStrPtr, struct termios *);
 static int set_modem_info(i2ChanStrPtr, unsigned int, unsigned int *);
-static int get_serial_info(i2ChanStrPtr, struct serial_struct *);
-static int set_serial_info(i2ChanStrPtr, struct serial_struct *);
+static int get_serial_info(i2ChanStrPtr, struct serial_struct __user *);
+static int set_serial_info(i2ChanStrPtr, struct serial_struct __user *);
 
-static ssize_t ip2_ipl_read(struct file *, char *, size_t, loff_t *);
-static ssize_t ip2_ipl_write(struct file *, const char *, size_t, loff_t *);
+static ssize_t ip2_ipl_read(struct file *, char __user *, size_t, loff_t *);
+static ssize_t ip2_ipl_write(struct file *, const char __user *, size_t, loff_t *);
 static int ip2_ipl_ioctl(struct inode *, struct file *, UINT, ULONG);
 static int ip2_ipl_open(struct inode *, struct file *);
 
-static int DumpTraceBuffer(char *, int);
-static int DumpFifoBuffer( char *, int);
+static int DumpTraceBuffer(char __user *, int);
+static int DumpFifoBuffer( char __user *, int);
 
 static void ip2_init_board(int);
 static unsigned short find_eisa_board(int);
@@ -1121,7 +1121,7 @@
 /******************************************************************************/
 
 static inline void
-service_all_boards()
+service_all_boards(void)
 {
 	int i;
 	i2eBordStrPtr  pB;
@@ -2082,9 +2082,10 @@
 	wait_queue_t wait;
 	i2ChanStrPtr pCh = DevTable[tty->index];
 	struct async_icount cprev, cnow;	/* kernel counter temps */
-	struct serial_icounter_struct *p_cuser;	/* user space */
+	struct serial_icounter_struct __user *p_cuser;
 	int rc = 0;
 	unsigned long flags;
+	void __user *argp = (void __user *)arg;
 
 	if ( pCh == NULL ) {
 		return -ENODEV;
@@ -2101,7 +2102,7 @@
 
 		ip2trace (CHANN, ITRC_IOCTL, 2, 1, rc );
 
-		rc = get_serial_info(pCh, (struct serial_struct *) arg);
+		rc = get_serial_info(pCh, argp);
 		if (rc)
 			return rc;
 		break;
@@ -2110,7 +2111,7 @@
 
 		ip2trace (CHANN, ITRC_IOCTL, 3, 1, rc );
 
-		rc = set_serial_info(pCh, (struct serial_struct *) arg);
+		rc = set_serial_info(pCh, argp);
 		if (rc)
 			return rc;
 		break;
@@ -2174,7 +2175,7 @@
 
 		ip2trace (CHANN, ITRC_IOCTL, 6, 1, rc );
 
-			rc = put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long *) arg);
+			rc = put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long __user *)argp);
 		if (rc)	
 			return rc;
 	break;
@@ -2183,7 +2184,7 @@
 
 		ip2trace (CHANN, ITRC_IOCTL, 7, 1, rc );
 
-		rc = get_user(arg,(unsigned long *) arg);
+		rc = get_user(arg,(unsigned long __user *) argp);
 		if (rc) 
 			return rc;
 		tty->termios->c_cflag = ((tty->termios->c_cflag & ~CLOCAL)
@@ -2262,7 +2263,7 @@
 		save_flags(flags);cli();
 		cnow = pCh->icount;
 		restore_flags(flags);
-		p_cuser = (struct serial_icounter_struct *) arg;
+		p_cuser = argp;
 		rc = put_user(cnow.cts, &p_cuser->cts);
 		rc = put_user(cnow.dsr, &p_cuser->dsr);
 		rc = put_user(cnow.rng, &p_cuser->rng);
@@ -2311,14 +2312,9 @@
 /* standard Linux serial structure.                                           */
 /******************************************************************************/
 static int
-get_serial_info ( i2ChanStrPtr pCh, struct serial_struct *retinfo )
+get_serial_info ( i2ChanStrPtr pCh, struct serial_struct __user *retinfo )
 {
 	struct serial_struct tmp;
-	int rc;
-
-	if ( !retinfo ) {
-		return -EFAULT;
-	}
 
 	memset ( &tmp, 0, sizeof(tmp) );
 	tmp.type = pCh->pMyBord->channelBtypes.bid_value[(pCh->port_index & (IP2_PORTS_PER_BOARD-1))/16];
@@ -2335,8 +2331,7 @@
 	tmp.close_delay = pCh->ClosingDelay;
 	tmp.closing_wait = pCh->ClosingWaitTime;
 	tmp.custom_divisor = pCh->BaudDivisor;
-   	rc = copy_to_user(retinfo,&tmp,sizeof(*retinfo));
-   return rc;
+   	return copy_to_user(retinfo,&tmp,sizeof(*retinfo));
 }
 
 /******************************************************************************/
@@ -2351,18 +2346,13 @@
 /* change the IRQ, address or type of the port the ioctl fails.               */
 /******************************************************************************/
 static int
-set_serial_info( i2ChanStrPtr pCh, struct serial_struct *new_info )
+set_serial_info( i2ChanStrPtr pCh, struct serial_struct __user *new_info )
 {
 	struct serial_struct ns;
 	int   old_flags, old_baud_divisor;
 
-	if ( !new_info ) {
+	if (copy_from_user(&ns, new_info, sizeof (ns)))
 		return -EFAULT;
-	}
-
-	if (copy_from_user(&ns, new_info, sizeof (ns))) {
-		return -EFAULT;
-	}
 
 	/*
 	 * We don't allow setserial to change IRQ, board address, type or baud
@@ -2727,7 +2717,7 @@
 
 static 
 ssize_t
-ip2_ipl_read(struct file *pFile, char *pData, size_t count, loff_t *off )
+ip2_ipl_read(struct file *pFile, char __user *pData, size_t count, loff_t *off )
 {
 	unsigned int minor = iminor(pFile->f_dentry->d_inode);
 	int rc = 0;
@@ -2760,7 +2750,7 @@
 }
 
 static int
-DumpFifoBuffer ( char *pData, int count )
+DumpFifoBuffer ( char __user *pData, int count )
 {
 #ifdef DEBUG_FIFO
 	int rc;
@@ -2774,13 +2764,13 @@
 }
 
 static int
-DumpTraceBuffer ( char *pData, int count )
+DumpTraceBuffer ( char __user *pData, int count )
 {
 #ifdef IP2DEBUG_TRACE
 	int rc;
 	int dumpcount;
 	int chunk;
-	int *pIndex = (int*)pData;
+	int *pIndex = (int __user *)pData;
 
 	if ( count < (sizeof(int) * 6) ) {
 		return -EIO;
@@ -2836,7 +2826,7 @@
 /*                                                                            */
 /******************************************************************************/
 static ssize_t
-ip2_ipl_write(struct file *pFile, const char *pData, size_t count, loff_t *off)
+ip2_ipl_write(struct file *pFile, const char __user *pData, size_t count, loff_t *off)
 {
 #ifdef IP2DEBUG_IPL
 	printk (KERN_DEBUG "IP2IPL: write %p, %d bytes\n", pData, count );
@@ -2861,7 +2851,8 @@
 {
 	unsigned int iplminor = iminor(pInode);
 	int rc = 0;
-	ULONG *pIndex = (ULONG*)arg;
+	void __user *argp = (void __user *)arg;
+	ULONG __user *pIndex = argp;
 	i2eBordStrPtr pB = i2BoardPtrTable[iplminor / 4];
 	i2ChanStrPtr pCh;
 
@@ -2886,9 +2877,9 @@
 
 		case 65:	/* Board  - ip2stat */
 			if ( pB ) {
-				rc = copy_to_user((char*)arg, (char*)pB, sizeof(i2eBordStr) );
+				rc = copy_to_user(argp, pB, sizeof(i2eBordStr));
 				rc = put_user(INB(pB->i2eStatus),
-					(ULONG*)(arg + (ULONG)(&pB->i2eStatus) - (ULONG)pB ) );
+					(ULONG __user *)(arg + (ULONG)(&pB->i2eStatus) - (ULONG)pB ) );
 			} else {
 				rc = -ENODEV;
 			}
@@ -2899,7 +2890,7 @@
 				pCh = DevTable[cmd];
 				if ( pCh )
 				{
-					rc = copy_to_user((char*)arg, (char*)pCh, sizeof(i2ChanStr) );
+					rc = copy_to_user(argp, pCh, sizeof(i2ChanStr));
 				} else {
 					rc = -ENODEV;
 				}
diff -urN linux-2.6.8-rc2/drivers/char/ipmi/ipmi_devintf.c linux-2.6.8-rc3/drivers/char/ipmi/ipmi_devintf.c
--- linux-2.6.8-rc2/drivers/char/ipmi/ipmi_devintf.c	2004-08-03 15:21:06.970506058 -0700
+++ linux-2.6.8-rc3/drivers/char/ipmi/ipmi_devintf.c	2004-08-03 15:21:38.252789185 -0700
@@ -174,7 +174,7 @@
 {
 	int              rv;
 	struct ipmi_addr addr;
-	unsigned char    *msgdata;
+	struct kernel_ipmi_msg msg;
 
 	if (req->addr_len > sizeof(struct ipmi_addr))
 		return -EINVAL;
@@ -182,8 +182,11 @@
 	if (copy_from_user(&addr, req->addr, req->addr_len))
 		return -EFAULT;
 
-	msgdata = kmalloc(IPMI_MAX_MSG_LENGTH, GFP_KERNEL);
-	if (!msgdata)
+	msg.netfn = req->msg.netfn;
+	msg.cmd = req->msg.cmd;
+	msg.data_len = req->msg.data_len;
+	msg.data = kmalloc(IPMI_MAX_MSG_LENGTH, GFP_KERNEL);
+	if (!msg.data)
 		return -ENOMEM;
 
 	/* From here out we cannot return, we must jump to "out" for
@@ -199,7 +202,7 @@
 			goto out;
 		}
 
-		if (copy_from_user(msgdata,
+		if (copy_from_user(msg.data,
 				   req->msg.data,
 				   req->msg.data_len))
 		{
@@ -207,20 +210,19 @@
 			goto out;
 		}
 	} else {
-		req->msg.data_len = 0;
+		msg.data_len = 0;
 	}
-	req->msg.data = msgdata;
 
 	rv = ipmi_request_settime(user,
 				  &addr,
 				  req->msgid,
-				  &(req->msg),
+				  &msg,
 				  NULL,
 				  0,
 				  retries,
 				  retry_time_ms);
  out:
-	kfree(msgdata);
+	kfree(msg.data);
 	return rv;
 }
 
diff -urN linux-2.6.8-rc2/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.8-rc3/drivers/char/ipmi/ipmi_msghandler.c
--- linux-2.6.8-rc2/drivers/char/ipmi/ipmi_msghandler.c	2004-08-03 15:21:06.973506180 -0700
+++ linux-2.6.8-rc3/drivers/char/ipmi/ipmi_msghandler.c	2004-08-03 15:21:38.284790497 -0700
@@ -907,7 +907,7 @@
 }
 
 static inline void format_ipmb_msg(struct ipmi_smi_msg   *smi_msg,
-				   struct ipmi_msg       *msg,
+				   struct kernel_ipmi_msg *msg,
 				   struct ipmi_ipmb_addr *ipmb_addr,
 				   long                  msgid,
 				   unsigned char         ipmb_seq,
@@ -949,7 +949,7 @@
 }
 
 static inline void format_lan_msg(struct ipmi_smi_msg   *smi_msg,
-				  struct ipmi_msg       *msg,
+				  struct kernel_ipmi_msg *msg,
 				  struct ipmi_lan_addr  *lan_addr,
 				  long                  msgid,
 				  unsigned char         ipmb_seq,
@@ -993,7 +993,7 @@
 				 ipmi_smi_t           intf,
 				 struct ipmi_addr     *addr,
 				 long                 msgid,
-				 struct ipmi_msg      *msg,
+				 struct kernel_ipmi_msg *msg,
 				 void                 *user_msg_data,
 				 void                 *supplied_smi,
 				 struct ipmi_recv_msg *supplied_recv,
@@ -1335,7 +1335,7 @@
 		goto out_err;
 	}
 
-#if DEBUG_MSGING
+#ifdef DEBUG_MSGING
 	{
 		int m;
 		for (m=0; m<smi_msg->data_size; m++)
@@ -1356,7 +1356,7 @@
 int ipmi_request(ipmi_user_t      user,
 		 struct ipmi_addr *addr,
 		 long             msgid,
-		 struct ipmi_msg  *msg,
+		 struct kernel_ipmi_msg  *msg,
 		 void             *user_msg_data,
 		 int              priority)
 {
@@ -1376,7 +1376,7 @@
 int ipmi_request_settime(ipmi_user_t      user,
 			 struct ipmi_addr *addr,
 			 long             msgid,
-			 struct ipmi_msg  *msg,
+			 struct kernel_ipmi_msg  *msg,
 			 void             *user_msg_data,
 			 int              priority,
 			 int              retries,
@@ -1399,7 +1399,7 @@
 int ipmi_request_supply_msgs(ipmi_user_t          user,
 			     struct ipmi_addr     *addr,
 			     long                 msgid,
-			     struct ipmi_msg      *msg,
+			     struct kernel_ipmi_msg *msg,
 			     void                 *user_msg_data,
 			     void                 *supplied_smi,
 			     struct ipmi_recv_msg *supplied_recv,
@@ -1422,7 +1422,7 @@
 int ipmi_request_with_source(ipmi_user_t      user,
 			     struct ipmi_addr *addr,
 			     long             msgid,
-			     struct ipmi_msg  *msg,
+			     struct kernel_ipmi_msg  *msg,
 			     void             *user_msg_data,
 			     int              priority,
 			     unsigned char    source_address,
@@ -1609,7 +1609,7 @@
 static int
 send_channel_info_cmd(ipmi_smi_t intf, int chan)
 {
-	struct ipmi_msg                   msg;
+	struct kernel_ipmi_msg            msg;
 	unsigned char                     data[1];
 	struct ipmi_system_interface_addr si;
 
@@ -2033,7 +2033,7 @@
 		msg->data[10] = ipmb_checksum(&(msg->data[6]), 4);
 		msg->data_size = 11;
 
-#if DEBUG_MSGING
+#ifdef DEBUG_MSGING
 	{
 		int m;
 		printk("Invalid command:");
@@ -2424,7 +2424,7 @@
 	int requeue;
 	int chan;
 
-#if DEBUG_MSGING
+#ifdef DEBUG_MSGING
 	int m;
 	printk("Recv:");
 	for (m=0; m<msg->rsp_size; m++)
@@ -2639,7 +2639,7 @@
 	   MC, which don't get resent. */
 	intf->handlers->sender(intf->send_info, smi_msg, 0);
 
-#if DEBUG_MSGING
+#ifdef DEBUG_MSGING
 	{
 		int m;
 		printk("Resend: ");
@@ -2873,7 +2873,7 @@
 
 static void send_panic_events(char *str)
 {
-	struct ipmi_msg                   msg;
+	struct kernel_ipmi_msg            msg;
 	ipmi_smi_t                        intf;
 	unsigned char                     data[16];
 	int                               i;
@@ -3098,7 +3098,7 @@
 	200   /* priority: INT_MAX >= x >= 0 */
 };
 
-static __init int ipmi_init_msghandler(void)
+static int ipmi_init_msghandler(void)
 {
 	int i;
 
@@ -3133,6 +3133,12 @@
 	return 0;
 }
 
+static __init int ipmi_init_msghandler_mod(void)
+{
+	ipmi_init_msghandler();
+	return 0;
+}
+
 static __exit void cleanup_ipmi(void)
 {
 	int count;
@@ -3169,7 +3175,7 @@
 }
 module_exit(cleanup_ipmi);
 
-module_init(ipmi_init_msghandler);
+module_init(ipmi_init_msghandler_mod);
 MODULE_LICENSE("GPL");
 
 EXPORT_SYMBOL(ipmi_alloc_recv_msg);
diff -urN linux-2.6.8-rc2/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.8-rc3/drivers/char/ipmi/ipmi_si_intf.c
--- linux-2.6.8-rc2/drivers/char/ipmi/ipmi_si_intf.c	2004-08-03 15:21:06.975506262 -0700
+++ linux-2.6.8-rc3/drivers/char/ipmi/ipmi_si_intf.c	2004-08-03 15:21:38.287790620 -0700
@@ -51,7 +51,7 @@
 #include <linux/list.h>
 #include <linux/pci.h>
 #include <linux/ioport.h>
-#include <linux/irq.h>
+#include <asm/irq.h>
 #ifdef CONFIG_HIGH_RES_TIMERS
 #include <linux/hrtime.h>
 # if defined(schedule_next_int)
@@ -1132,7 +1132,7 @@
 static int acpi_failure = 0;
 
 /* For GPE-type interrupts. */
-u32 ipmi_acpi_gpe(void *context)
+void ipmi_acpi_gpe(void *context)
 {
 	struct smi_info *smi_info = context;
 	unsigned long   flags;
@@ -1156,7 +1156,6 @@
 	smi_event_handler(smi_info, 0);
  out:
 	spin_unlock_irqrestore(&(smi_info->si_lock), flags);
-	return 0;
 }
 
 static int acpi_gpe_irq_setup(struct smi_info *info)
diff -urN linux-2.6.8-rc2/drivers/char/ipmi/ipmi_watchdog.c linux-2.6.8-rc3/drivers/char/ipmi/ipmi_watchdog.c
--- linux-2.6.8-rc2/drivers/char/ipmi/ipmi_watchdog.c	2004-08-03 15:21:06.976506303 -0700
+++ linux-2.6.8-rc3/drivers/char/ipmi/ipmi_watchdog.c	2004-08-03 15:21:38.307791441 -0700
@@ -129,6 +129,12 @@
 #define	WDIOC_GET_PRETIMEOUT     _IOW(WATCHDOG_IOCTL_BASE, 22, int)
 #endif
 
+#ifdef CONFIG_WATCHDOG_NOWAYOUT
+static int nowayout = 1;
+#else
+static int nowayout;
+#endif
+
 static ipmi_user_t watchdog_user = NULL;
 
 /* Default the timeout to 10 seconds. */
@@ -175,6 +181,8 @@
 module_param(start_now, int, 0);
 MODULE_PARM_DESC(start_now, "Set to 1 to start the watchdog as"
 		 "soon as the driver is loaded.");
+module_param(nowayout, int, 0);
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
 /* Default state of the timer. */
 static unsigned char ipmi_watchdog_state = WDOG_TIMEOUT_NONE;
@@ -229,7 +237,7 @@
 			      struct ipmi_recv_msg *recv_msg,
 			      int                  *send_heartbeat_now)
 {
-	struct ipmi_msg                   msg;
+	struct kernel_ipmi_msg            msg;
 	unsigned char                     data[6];
 	int                               rv;
 	struct ipmi_system_interface_addr addr;
@@ -406,7 +414,7 @@
  
 static int ipmi_heartbeat(void)
 {
-	struct ipmi_msg                   msg;
+	struct kernel_ipmi_msg            msg;
 	int                               rv;
 	struct ipmi_system_interface_addr addr;
 
@@ -478,7 +486,7 @@
 
 static void panic_halt_ipmi_heartbeat(void)
 {
-	struct ipmi_msg                   msg;
+	struct kernel_ipmi_msg             msg;
 	struct ipmi_system_interface_addr addr;
 
 
@@ -704,10 +712,10 @@
 {
 	if (iminor(ino)==WATCHDOG_MINOR)
 	{
-#ifndef CONFIG_WATCHDOG_NOWAYOUT	
-		ipmi_watchdog_state = WDOG_TIMEOUT_NONE;
-		ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB);
-#endif		
+		if (!nowayout) {
+			ipmi_watchdog_state = WDOG_TIMEOUT_NONE;
+			ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB);
+		}
 	        ipmi_wdog_open = 0;
 	}
 
diff -urN linux-2.6.8-rc2/drivers/char/isicom.c linux-2.6.8-rc3/drivers/char/isicom.c
--- linux-2.6.8-rc2/drivers/char/isicom.c	2004-06-15 22:18:55.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/isicom.c	2004-08-03 15:21:38.310791564 -0700
@@ -90,7 +90,7 @@
 static void isicom_tx(unsigned long _data);
 static void isicom_start(struct tty_struct * tty);
 
-static unsigned char * tmp_buf = 0;
+static unsigned char * tmp_buf;
 static DECLARE_MUTEX(tmp_buf_sem);
 
 /*   baud index mappings from linux defns to isi */
@@ -132,9 +132,10 @@
 	unsigned long t;
 	unsigned short word_count, base;
 	bin_frame frame;
+	void __user *argp = (void __user *)arg;
 	/* exec_record exec_rec; */
 	
-	if(get_user(card, (int *)arg))
+	if(get_user(card, (int __user *)argp))
 		return -EFAULT;
 		
 	if(card < 0 || card >= BOARD_COUNT)
@@ -208,13 +209,13 @@
 				 return -EIO;
 			}
 			printk("-Done\n");
-			return put_user(signature,(unsigned int*)arg);
+			return put_user(signature,(unsigned __user *)argp);
 						
 	case	MIOCTL_LOAD_FIRMWARE:
 			if (!capable(CAP_SYS_ADMIN))
 				return -EPERM;
 				
-			if(copy_from_user(&frame, (void *) arg, sizeof(bin_frame)))
+			if(copy_from_user(&frame, argp, sizeof(bin_frame)))
 				return -EFAULT;
 			
 			if (WaitTillCardIsFree(base))
@@ -257,7 +258,7 @@
 			if (!capable(CAP_SYS_ADMIN))
 				return -EPERM;
 				
-			if(copy_from_user(&frame, (void *) arg, sizeof(bin_header)))
+			if(copy_from_user(&frame, argp, sizeof(bin_header)))
 				return -EFAULT;
 			
 			if (WaitTillCardIsFree(base))
@@ -296,7 +297,7 @@
 				return -EIO;
 			}	
 			
-			if(copy_to_user((void *) arg, &frame, sizeof(bin_frame)))
+			if(copy_to_user(argp, &frame, sizeof(bin_frame)))
 				return -EFAULT;
 			return 0;
 	
@@ -1121,7 +1122,7 @@
 	if (tty->ldisc.flush_buffer)
 		tty->ldisc.flush_buffer(tty);
 	tty->closing = 0;
-	port->tty = 0;
+	port->tty = NULL;
 	if (port->blocked_open) {
 		if (port->close_delay) {
 			set_current_state(TASK_INTERRUPTIBLE);
@@ -1334,7 +1335,7 @@
 }			
 
 static int isicom_set_serial_info(struct isi_port * port,
-					struct serial_struct * info)
+					struct serial_struct __user *info)
 {
 	struct serial_struct newinfo;
 	unsigned long flags;
@@ -1370,7 +1371,7 @@
 }		
 
 static int isicom_get_serial_info(struct isi_port * port, 
-					struct serial_struct * info)
+					struct serial_struct __user *info)
 {
 	struct serial_struct out_info;
 	
@@ -1392,6 +1393,7 @@
 			unsigned int cmd, unsigned long arg) 
 {
 	struct isi_port * port = (struct isi_port *) tty->driver_data;
+	void __user *argp = (void __user *)arg;
 	int retval;
 
 	if (isicom_paranoia_check(port, tty->name, "isicom_ioctl"))
@@ -1416,10 +1418,10 @@
 			return 0;
 			
 		case TIOCGSOFTCAR:
-			return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long *) arg);
+			return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long __user *)argp);
 			
 		case TIOCSSOFTCAR:
-			if(get_user(arg, (unsigned long *) arg))
+			if(get_user(arg, (unsigned long __user *) argp))
 				return -EFAULT;
 			tty->termios->c_cflag =
 				((tty->termios->c_cflag & ~CLOCAL) |
@@ -1427,12 +1429,10 @@
 			return 0;	
 			
 		case TIOCGSERIAL:
-			return isicom_get_serial_info(port, 
-					(struct serial_struct *) arg);
+			return isicom_get_serial_info(port, argp);
 		
 		case TIOCSSERIAL:
-			return isicom_set_serial_info(port,
-					(struct serial_struct *) arg);
+			return isicom_set_serial_info(port, argp);
 					
 		default:
 			return -ENOIOCTLCMD;						
@@ -1545,7 +1545,7 @@
 	isicom_shutdown_port(port);
 	port->count = 0;
 	port->flags &= ~ASYNC_NORMAL_ACTIVE;
-	port->tty = 0;
+	port->tty = NULL;
 	wake_up_interruptible(&port->open_wait);
 }
 
diff -urN linux-2.6.8-rc2/drivers/char/istallion.c linux-2.6.8-rc3/drivers/char/istallion.c
--- linux-2.6.8-rc2/drivers/char/istallion.c	2004-08-03 15:21:06.980506467 -0700
+++ linux-2.6.8-rc3/drivers/char/istallion.c	2004-08-03 15:21:38.371794066 -0700
@@ -680,8 +680,8 @@
 
 static int	stli_brdinit(stlibrd_t *brdp);
 static int	stli_startbrd(stlibrd_t *brdp);
-static ssize_t	stli_memread(struct file *fp, char *buf, size_t count, loff_t *offp);
-static ssize_t	stli_memwrite(struct file *fp, const char *buf, size_t count, loff_t *offp);
+static ssize_t	stli_memread(struct file *fp, char __user *buf, size_t count, loff_t *offp);
+static ssize_t	stli_memwrite(struct file *fp, const char __user *buf, size_t count, loff_t *offp);
 static int	stli_memioctl(struct inode *ip, struct file *fp, unsigned int cmd, unsigned long arg);
 static void	stli_brdpoll(stlibrd_t *brdp, volatile cdkhdr_t *hdrp);
 static void	stli_poll(unsigned long arg);
@@ -700,14 +700,14 @@
 static void	stli_mkasysigs(asysigs_t *sp, int dtr, int rts);
 static long	stli_mktiocm(unsigned long sigvalue);
 static void	stli_read(stlibrd_t *brdp, stliport_t *portp);
-static int	stli_getserial(stliport_t *portp, struct serial_struct *sp);
-static int	stli_setserial(stliport_t *portp, struct serial_struct *sp);
-static int	stli_getbrdstats(combrd_t *bp);
-static int	stli_getportstats(stliport_t *portp, comstats_t *cp);
+static int	stli_getserial(stliport_t *portp, struct serial_struct __user *sp);
+static int	stli_setserial(stliport_t *portp, struct serial_struct __user *sp);
+static int	stli_getbrdstats(combrd_t __user *bp);
+static int	stli_getportstats(stliport_t *portp, comstats_t __user *cp);
 static int	stli_portcmdstats(stliport_t *portp);
-static int	stli_clrportstats(stliport_t *portp, comstats_t *cp);
-static int	stli_getportstruct(unsigned long arg);
-static int	stli_getbrdstruct(unsigned long arg);
+static int	stli_clrportstats(stliport_t *portp, comstats_t __user *cp);
+static int	stli_getportstruct(stliport_t __user *arg);
+static int	stli_getbrdstruct(stlibrd_t __user *arg);
 static void	*stli_memalloc(int len);
 static stlibrd_t *stli_allocbrd(void);
 
@@ -808,7 +808,7 @@
 {
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("init_module()\n");
 #endif
 
@@ -829,7 +829,7 @@
 	unsigned long	flags;
 	int		i, j;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("cleanup_module()\n");
 #endif
 
@@ -901,13 +901,13 @@
  *	Check for any arguments passed in on the module load command line.
  */
 
-static void stli_argbrds()
+static void stli_argbrds(void)
 {
 	stlconf_t	conf;
 	stlibrd_t	*brdp;
 	int		nrargs, i;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_argbrds()\n");
 #endif
 
@@ -975,7 +975,7 @@
 	char	*sp;
 	int	nrbrdnames, i;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_parsebrd(confp=%x,argp=%x)\n", (int) confp, (int) argp);
 #endif
 
@@ -1025,7 +1025,7 @@
 	unsigned int	minordev;
 	int		brdnr, portnr, rc;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_open(tty=%x,filp=%x): device=%s\n", (int) tty,
 		(int) filp, tty->name);
 #endif
@@ -1125,7 +1125,7 @@
 	stliport_t	*portp;
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_close(tty=%x,filp=%x)\n", (int) tty, (int) filp);
 #endif
 
@@ -1210,7 +1210,7 @@
 	asyport_t		aport;
 	int			rc;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_initopen(brdp=%x,portp=%x)\n", (int) brdp, (int) portp);
 #endif
 
@@ -1263,7 +1263,7 @@
 	unsigned long		flags;
 	int			rc;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_rawopen(brdp=%x,portp=%x,arg=%x,wait=%d)\n",
 		(int) brdp, (int) portp, (int) arg, wait);
 #endif
@@ -1344,7 +1344,7 @@
 	unsigned long		flags;
 	int			rc;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_rawclose(brdp=%x,portp=%x,arg=%x,wait=%d)\n",
 		(int) brdp, (int) portp, (int) arg, wait);
 #endif
@@ -1417,7 +1417,7 @@
 {
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_cmdwait(brdp=%x,portp=%x,cmd=%x,arg=%x,size=%d,"
 		"copyback=%d)\n", (int) brdp, (int) portp, (int) cmd,
 		(int) arg, size, copyback);
@@ -1461,7 +1461,7 @@
 	stlibrd_t	*brdp;
 	asyport_t	aport;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_setport(portp=%x)\n", (int) portp);
 #endif
 
@@ -1489,7 +1489,7 @@
 
 static void stli_delay(int len)
 {
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_delay(len=%d)\n", len);
 #endif
 	if (len > 0) {
@@ -1510,7 +1510,7 @@
 	unsigned long	flags;
 	int		rc, doclocal;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_waitcarrier(brdp=%x,portp=%x,filp=%x)\n",
 		(int) brdp, (int) portp, (int) filp);
 #endif
@@ -1578,7 +1578,7 @@
 	unsigned int		len, stlen, head, tail, size;
 	unsigned long		flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_write(tty=%x,from_user=%d,buf=%x,count=%d)\n",
 		(int) tty, from_user, (int) buf, count);
 #endif
@@ -1699,7 +1699,7 @@
 
 static void stli_putchar(struct tty_struct *tty, unsigned char ch)
 {
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_putchar(tty=%x,ch=%x)\n", (int) tty, (int) ch);
 #endif
 
@@ -1736,7 +1736,7 @@
 	unsigned char		*buf, *shbuf;
 	unsigned long		flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_flushchars(tty=%x)\n", (int) tty);
 #endif
 
@@ -1827,7 +1827,7 @@
 	unsigned int		head, tail, len;
 	unsigned long		flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_writeroom(tty=%x)\n", (int) tty);
 #endif
 
@@ -1887,7 +1887,7 @@
 	unsigned int		head, tail, len;
 	unsigned long		flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_charsinbuffer(tty=%x)\n", (int) tty);
 #endif
 
@@ -1927,12 +1927,12 @@
  *	Generate the serial struct info.
  */
 
-static int stli_getserial(stliport_t *portp, struct serial_struct *sp)
+static int stli_getserial(stliport_t *portp, struct serial_struct __user *sp)
 {
 	struct serial_struct	sio;
 	stlibrd_t		*brdp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_getserial(portp=%x,sp=%x)\n", (int) portp, (int) sp);
 #endif
 
@@ -1964,13 +1964,13 @@
  *	just quietly ignore any requests to change irq, etc.
  */
 
-static int stli_setserial(stliport_t *portp, struct serial_struct *sp)
+static int stli_setserial(stliport_t *portp, struct serial_struct __user *sp)
 {
 	struct serial_struct	sio;
 	int			rc;
 
-#if DEBUG
-	printk("stli_setserial(portp=%x,sp=%x)\n", (int) portp, (int) sp);
+#ifdef DEBUG
+	printk("stli_setserial(portp=%p,sp=%p)\n", portp, sp);
 #endif
 
 	if (copy_from_user(&sio, sp, sizeof(struct serial_struct)))
@@ -2058,8 +2058,9 @@
 	stlibrd_t	*brdp;
 	unsigned int	ival;
 	int		rc;
+	void __user *argp = (void __user *)arg;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_ioctl(tty=%x,file=%x,cmd=%x,arg=%x)\n",
 		(int) tty, (int) file, cmd, (int) arg);
 #endif
@@ -2086,40 +2087,32 @@
 	switch (cmd) {
 	case TIOCGSOFTCAR:
 		rc = put_user(((tty->termios->c_cflag & CLOCAL) ? 1 : 0),
-			(unsigned int *) arg);
+			(unsigned __user *) arg);
 		break;
 	case TIOCSSOFTCAR:
-		if ((rc = get_user(ival, (unsigned int *) arg)) == 0)
+		if ((rc = get_user(ival, (unsigned __user *) arg)) == 0)
 			tty->termios->c_cflag =
 				(tty->termios->c_cflag & ~CLOCAL) |
 				(ival ? CLOCAL : 0);
 		break;
 	case TIOCGSERIAL:
-		if ((rc = verify_area(VERIFY_WRITE, (void *) arg,
-		    sizeof(struct serial_struct))) == 0)
-			rc = stli_getserial(portp, (struct serial_struct *) arg);
+		rc = stli_getserial(portp, argp);
 		break;
 	case TIOCSSERIAL:
-		if ((rc = verify_area(VERIFY_READ, (void *) arg,
-		    sizeof(struct serial_struct))) == 0)
-			rc = stli_setserial(portp, (struct serial_struct *)arg);
+		rc = stli_setserial(portp, argp);
 		break;
 	case STL_GETPFLAG:
-		rc = put_user(portp->pflag, (unsigned int *) arg);
+		rc = put_user(portp->pflag, (unsigned __user *)argp);
 		break;
 	case STL_SETPFLAG:
-		if ((rc = get_user(portp->pflag, (unsigned int *) arg)) == 0)
+		if ((rc = get_user(portp->pflag, (unsigned __user *)argp)) == 0)
 			stli_setport(portp);
 		break;
 	case COM_GETPORTSTATS:
-		if ((rc = verify_area(VERIFY_WRITE, (void *) arg,
-		    sizeof(comstats_t))) == 0)
-			rc = stli_getportstats(portp, (comstats_t *) arg);
+		rc = stli_getportstats(portp, argp);
 		break;
 	case COM_CLRPORTSTATS:
-		if ((rc = verify_area(VERIFY_WRITE, (void *) arg,
-		    sizeof(comstats_t))) == 0)
-			rc = stli_clrportstats(portp, (comstats_t *) arg);
+		rc = stli_clrportstats(portp, argp);
 		break;
 	case TIOCSERCONFIG:
 	case TIOCSERGWILD:
@@ -2150,7 +2143,7 @@
 	struct termios	*tiosp;
 	asyport_t	aport;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_settermios(tty=%x,old=%x)\n", (int) tty, (int) old);
 #endif
 
@@ -2197,7 +2190,7 @@
 {
 	stliport_t	*portp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_throttle(tty=%x)\n", (int) tty);
 #endif
 
@@ -2222,7 +2215,7 @@
 {
 	stliport_t	*portp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_unthrottle(tty=%x)\n", (int) tty);
 #endif
 
@@ -2248,7 +2241,7 @@
 	stliport_t	*portp;
 	asyctrl_t	actrl;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_stop(tty=%x)\n", (int) tty);
 #endif
 
@@ -2282,7 +2275,7 @@
 	stlibrd_t	*brdp;
 	asyctrl_t	actrl;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_start(tty=%x)\n", (int) tty);
 #endif
 
@@ -2319,7 +2312,7 @@
 {
 	stliport_t	*portp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_dohangup(portp=%x)\n", (int) arg);
 #endif
 
@@ -2351,7 +2344,7 @@
 	stlibrd_t	*brdp;
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_hangup(tty=%x)\n", (int) tty);
 #endif
 
@@ -2409,7 +2402,7 @@
 	stlibrd_t	*brdp;
 	unsigned long	ftype, flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_flushbuffer(tty=%x)\n", (int) tty);
 #endif
 
@@ -2459,7 +2452,7 @@
 	long		arg;
 	/* long savestate, savetime; */
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_breakctl(tty=%x,state=%d)\n", (int) tty, state);
 #endif
 
@@ -2498,7 +2491,7 @@
 	stliport_t	*portp;
 	unsigned long	tend;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_waituntilsent(tty=%x,timeout=%x)\n", (int) tty, timeout);
 #endif
 
@@ -2529,7 +2522,7 @@
 	stliport_t	*portp;
 	asyctrl_t	actrl;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_sendxchar(tty=%x,ch=%x)\n", (int) tty, ch);
 #endif
 
@@ -2636,7 +2629,7 @@
 	int		curoff, maxoff;
 	char		*pos;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_readproc(page=%x,start=%x,off=%x,count=%d,eof=%x,"
 		"data=%x\n", (int) page, (int) start, (int) off, count,
 		(int) eof, (int) data);
@@ -2712,7 +2705,7 @@
 	volatile unsigned char	*bits;
 	unsigned long		flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_sendcmd(brdp=%x,portp=%x,cmd=%x,arg=%x,size=%d,"
 		"copyback=%d)\n", (int) brdp, (int) portp, (int) cmd,
 		(int) arg, size, copyback);
@@ -2766,7 +2759,7 @@
 	unsigned int		head, tail, size;
 	unsigned int		len, stlen;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_read(brdp=%x,portp=%d)\n",
 			(int) brdp, (int) portp);
 #endif
@@ -2883,7 +2876,7 @@
 	unsigned long		oldsigs;
 	int			rc, donerx;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_hostcmd(brdp=%x,channr=%d)\n",
 			(int) brdp, channr);
 #endif
@@ -3135,7 +3128,7 @@
 
 static void stli_mkasyport(stliport_t *portp, asyport_t *pp, struct termios *tiosp)
 {
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_mkasyport(portp=%x,pp=%x,tiosp=%d)\n",
 		(int) portp, (int) pp, (int) tiosp);
 #endif
@@ -3258,7 +3251,7 @@
 
 static void stli_mkasysigs(asysigs_t *sp, int dtr, int rts)
 {
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_mkasysigs(sp=%x,dtr=%d,rts=%d)\n",
 			(int) sp, dtr, rts);
 #endif
@@ -3285,7 +3278,7 @@
 {
 	long	tiocm;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_mktiocm(sigvalue=%x)\n", (int) sigvalue);
 #endif
 
@@ -3311,7 +3304,7 @@
 	stliport_t	*portp;
 	int		i, panelnr, panelport;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_initports(brdp=%x)\n", (int) brdp);
 #endif
 
@@ -3355,7 +3348,7 @@
 {
 	unsigned long	memconf;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_ecpinit(brdp=%d)\n", (int) brdp);
 #endif
 
@@ -3372,7 +3365,7 @@
 
 static void stli_ecpenable(stlibrd_t *brdp)
 {	
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_ecpenable(brdp=%x)\n", (int) brdp);
 #endif
 	outb(ECP_ATENABLE, (brdp->iobase + ECP_ATCONFR));
@@ -3382,7 +3375,7 @@
 
 static void stli_ecpdisable(stlibrd_t *brdp)
 {	
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_ecpdisable(brdp=%x)\n", (int) brdp);
 #endif
 	outb(ECP_ATDISABLE, (brdp->iobase + ECP_ATCONFR));
@@ -3395,7 +3388,7 @@
 	void		*ptr;
 	unsigned char	val;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_ecpgetmemptr(brdp=%x,offset=%x)\n", (int) brdp,
 		(int) offset);
 #endif
@@ -3404,7 +3397,7 @@
 		printk(KERN_ERR "STALLION: shared memory pointer=%x out of "
 				"range at line=%d(%d), brd=%d\n",
 			(int) offset, line, __LINE__, brdp->brdnr);
-		ptr = 0;
+		ptr = NULL;
 		val = 0;
 	} else {
 		ptr = brdp->membase + (offset % ECP_ATPAGESIZE);
@@ -3418,7 +3411,7 @@
 
 static void stli_ecpreset(stlibrd_t *brdp)
 {	
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_ecpreset(brdp=%x)\n", (int) brdp);
 #endif
 
@@ -3432,7 +3425,7 @@
 
 static void stli_ecpintr(stlibrd_t *brdp)
 {	
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_ecpintr(brdp=%x)\n", (int) brdp);
 #endif
 	outb(0x1, brdp->iobase);
@@ -3448,7 +3441,7 @@
 {
 	unsigned long	memconf;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_ecpeiinit(brdp=%x)\n", (int) brdp);
 #endif
 
@@ -3485,7 +3478,7 @@
 	void		*ptr;
 	unsigned char	val;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_ecpeigetmemptr(brdp=%x,offset=%x,line=%d)\n",
 		(int) brdp, (int) offset, line);
 #endif
@@ -3494,7 +3487,7 @@
 		printk(KERN_ERR "STALLION: shared memory pointer=%x out of "
 				"range at line=%d(%d), brd=%d\n",
 			(int) offset, line, __LINE__, brdp->brdnr);
-		ptr = 0;
+		ptr = NULL;
 		val = 0;
 	} else {
 		ptr = brdp->membase + (offset % ECP_EIPAGESIZE);
@@ -3546,7 +3539,7 @@
 		printk(KERN_ERR "STALLION: shared memory pointer=%x out of "
 				"range at line=%d(%d), brd=%d\n",
 			(int) offset, line, __LINE__, brdp->brdnr);
-		ptr = 0;
+		ptr = NULL;
 		val = 0;
 	} else {
 		ptr = brdp->membase + (offset % ECP_MCPAGESIZE);
@@ -3574,7 +3567,7 @@
 
 static void stli_ecppciinit(stlibrd_t *brdp)
 {
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_ecppciinit(brdp=%x)\n", (int) brdp);
 #endif
 
@@ -3591,7 +3584,7 @@
 	void		*ptr;
 	unsigned char	val;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_ecppcigetmemptr(brdp=%x,offset=%x,line=%d)\n",
 		(int) brdp, (int) offset, line);
 #endif
@@ -3600,7 +3593,7 @@
 		printk(KERN_ERR "STALLION: shared memory pointer=%x out of "
 				"range at line=%d(%d), board=%d\n",
 				(int) offset, line, __LINE__, brdp->brdnr);
-		ptr = 0;
+		ptr = NULL;
 		val = 0;
 	} else {
 		ptr = brdp->membase + (offset % ECP_PCIPAGESIZE);
@@ -3630,7 +3623,7 @@
 {
 	unsigned long	memconf;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_onbinit(brdp=%d)\n", (int) brdp);
 #endif
 
@@ -3649,7 +3642,7 @@
 
 static void stli_onbenable(stlibrd_t *brdp)
 {	
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_onbenable(brdp=%x)\n", (int) brdp);
 #endif
 	outb((brdp->enabval | ONB_ATENABLE), (brdp->iobase + ONB_ATCONFR));
@@ -3659,7 +3652,7 @@
 
 static void stli_onbdisable(stlibrd_t *brdp)
 {	
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_onbdisable(brdp=%x)\n", (int) brdp);
 #endif
 	outb((brdp->enabval | ONB_ATDISABLE), (brdp->iobase + ONB_ATCONFR));
@@ -3671,7 +3664,7 @@
 {	
 	void	*ptr;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_onbgetmemptr(brdp=%x,offset=%x)\n", (int) brdp,
 		(int) offset);
 #endif
@@ -3680,7 +3673,7 @@
 		printk(KERN_ERR "STALLION: shared memory pointer=%x out of "
 				"range at line=%d(%d), brd=%d\n",
 				(int) offset, line, __LINE__, brdp->brdnr);
-		ptr = 0;
+		ptr = NULL;
 	} else {
 		ptr = brdp->membase + (offset % ONB_ATPAGESIZE);
 	}
@@ -3692,7 +3685,7 @@
 static void stli_onbreset(stlibrd_t *brdp)
 {	
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_onbreset(brdp=%x)\n", (int) brdp);
 #endif
 
@@ -3712,7 +3705,7 @@
 {
 	unsigned long	memconf;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_onbeinit(brdp=%d)\n", (int) brdp);
 #endif
 
@@ -3734,7 +3727,7 @@
 
 static void stli_onbeenable(stlibrd_t *brdp)
 {	
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_onbeenable(brdp=%x)\n", (int) brdp);
 #endif
 	outb(ONB_EIENABLE, (brdp->iobase + ONB_EICONFR));
@@ -3744,7 +3737,7 @@
 
 static void stli_onbedisable(stlibrd_t *brdp)
 {	
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_onbedisable(brdp=%x)\n", (int) brdp);
 #endif
 	outb(ONB_EIDISABLE, (brdp->iobase + ONB_EICONFR));
@@ -3757,7 +3750,7 @@
 	void		*ptr;
 	unsigned char	val;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_onbegetmemptr(brdp=%x,offset=%x,line=%d)\n",
 		(int) brdp, (int) offset, line);
 #endif
@@ -3766,7 +3759,7 @@
 		printk(KERN_ERR "STALLION: shared memory pointer=%x out of "
 				"range at line=%d(%d), brd=%d\n",
 			(int) offset, line, __LINE__, brdp->brdnr);
-		ptr = 0;
+		ptr = NULL;
 		val = 0;
 	} else {
 		ptr = brdp->membase + (offset % ONB_EIPAGESIZE);
@@ -3784,7 +3777,7 @@
 static void stli_onbereset(stlibrd_t *brdp)
 {	
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_ERR "stli_onbereset(brdp=%x)\n", (int) brdp);
 #endif
 
@@ -3803,7 +3796,7 @@
 static void stli_bbyinit(stlibrd_t *brdp)
 {
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_ERR "stli_bbyinit(brdp=%d)\n", (int) brdp);
 #endif
 
@@ -3822,7 +3815,7 @@
 	void		*ptr;
 	unsigned char	val;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_ERR "stli_bbygetmemptr(brdp=%x,offset=%x)\n", (int) brdp,
 		(int) offset);
 #endif
@@ -3831,7 +3824,7 @@
 		printk(KERN_ERR "STALLION: shared memory pointer=%x out of "
 				"range at line=%d(%d), brd=%d\n",
 				(int) offset, line, __LINE__, brdp->brdnr);
-		ptr = 0;
+		ptr = NULL;
 		val = 0;
 	} else {
 		ptr = brdp->membase + (offset % BBY_PAGESIZE);
@@ -3846,7 +3839,7 @@
 static void stli_bbyreset(stlibrd_t *brdp)
 {	
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_bbyreset(brdp=%x)\n", (int) brdp);
 #endif
 
@@ -3865,7 +3858,7 @@
 static void stli_stalinit(stlibrd_t *brdp)
 {
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_stalinit(brdp=%d)\n", (int) brdp);
 #endif
 
@@ -3879,7 +3872,7 @@
 {	
 	void	*ptr;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_stalgetmemptr(brdp=%x,offset=%x)\n", (int) brdp,
 		(int) offset);
 #endif
@@ -3888,7 +3881,7 @@
 		printk(KERN_ERR "STALLION: shared memory pointer=%x out of "
 				"range at line=%d(%d), brd=%d\n",
 				(int) offset, line, __LINE__, brdp->brdnr);
-		ptr = 0;
+		ptr = NULL;
 	} else {
 		ptr = brdp->membase + (offset % STAL_PAGESIZE);
 	}
@@ -3901,7 +3894,7 @@
 {	
 	volatile unsigned long	*vecp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_stalreset(brdp=%x)\n", (int) brdp);
 #endif
 
@@ -3926,7 +3919,7 @@
 	char		*name;
 	int		panelnr, nrports;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_initecp(brdp=%x)\n", (int) brdp);
 #endif
 
@@ -4086,7 +4079,7 @@
 	char		*name;
 	int		i;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_initonb(brdp=%x)\n", (int) brdp);
 #endif
 
@@ -4254,7 +4247,7 @@
 	stliport_t		*portp;
 	int			portnr, nrdevs, i, rc;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_startbrd(brdp=%x)\n", (int) brdp);
 #endif
 
@@ -4360,7 +4353,7 @@
 
 static int __init stli_brdinit(stlibrd_t *brdp)
 {
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_brdinit(brdp=%x)\n", (int) brdp);
 #endif
 
@@ -4427,7 +4420,7 @@
 	cdkonbsig_t	onbsig, *onbsigp;
 	int		i, foundit;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_eisamemprobe(brdp=%x)\n", (int) brdp);
 #endif
 
@@ -4504,7 +4497,7 @@
 
 	if (! foundit) {
 		brdp->memaddr = 0;
-		brdp->membase = 0;
+		brdp->membase = NULL;
 		printk(KERN_ERR "STALLION: failed to probe shared memory "
 				"region for %s in EISA slot=%d\n",
 			stli_brdnames[brdp->brdtype], (brdp->iobase >> 12));
@@ -4513,6 +4506,20 @@
 	return(0);
 }
 
+static inline int stli_getbrdnr(void)
+{
+	int i;
+
+	for (i = 0; i < STL_MAXBRDS; i++) {
+		if (!stli_brds[i]) {
+			if (i >= stli_nrbrds)
+				stli_nrbrds = i + 1;
+			return i;
+		}
+	}
+	return -1;
+}
+
 /*****************************************************************************/
 
 /*
@@ -4525,13 +4532,13 @@
  *	do is go probing around in the usual places hoping we can find it.
  */
 
-static inline int stli_findeisabrds()
+static inline int stli_findeisabrds(void)
 {
 	stlibrd_t	*brdp;
 	unsigned int	iobase, eid;
 	int		i;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_findeisabrds()\n");
 #endif
 
@@ -4599,20 +4606,6 @@
  *	Find the next available board number that is free.
  */
 
-static inline int stli_getbrdnr()
-{
-	int	i;
-
-	for (i = 0; (i < STL_MAXBRDS); i++) {
-		if (stli_brds[i] == (stlibrd_t *) NULL) {
-			if (i >= stli_nrbrds)
-				stli_nrbrds = i + 1;
-			return(i);
-		}
-	}
-	return(-1);
-}
-
 /*****************************************************************************/
 
 #ifdef	CONFIG_PCI
@@ -4627,7 +4620,7 @@
 {
 	stlibrd_t	*brdp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_initpcibrd(brdtype=%d,busnr=%x,devnr=%x)\n",
 		brdtype, dev->bus->number, dev->devfn);
 #endif
@@ -4643,7 +4636,7 @@
 	}
 	brdp->brdtype = brdtype;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "%s(%d): BAR[]=%lx,%lx,%lx,%lx\n", __FILE__, __LINE__,
 		pci_resource_start(devp, 0),
 		pci_resource_start(devp, 1),
@@ -4669,12 +4662,12 @@
  *	one as it is found.
  */
 
-static inline int stli_findpcibrds()
+static inline int stli_findpcibrds(void)
 {
 	struct pci_dev	*dev = NULL;
 	int		rc;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stli_findpcibrds()\n");
 #endif
 
@@ -4695,7 +4688,7 @@
  *	Allocate a new board structure. Fill out the basic info in it.
  */
 
-static stlibrd_t *stli_allocbrd()
+static stlibrd_t *stli_allocbrd(void)
 {
 	stlibrd_t	*brdp;
 
@@ -4718,13 +4711,13 @@
  *	can find.
  */
 
-static inline int stli_initbrds()
+static inline int stli_initbrds(void)
 {
 	stlibrd_t	*brdp, *nxtbrdp;
 	stlconf_t	*confp;
 	int		i, j;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_initbrds()\n");
 #endif
 
@@ -4815,14 +4808,14 @@
  *	the slave image (and debugging :-)
  */
 
-static ssize_t stli_memread(struct file *fp, char *buf, size_t count, loff_t *offp)
+static ssize_t stli_memread(struct file *fp, char __user *buf, size_t count, loff_t *offp)
 {
 	unsigned long	flags;
 	void		*memptr;
 	stlibrd_t	*brdp;
 	int		brdnr, size, n;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_memread(fp=%x,buf=%x,count=%x,offp=%x)\n",
 			(int) fp, (int) buf, count, (int) offp);
 #endif
@@ -4869,15 +4862,15 @@
  *	the slave image (and debugging :-)
  */
 
-static ssize_t stli_memwrite(struct file *fp, const char *buf, size_t count, loff_t *offp)
+static ssize_t stli_memwrite(struct file *fp, const char __user *buf, size_t count, loff_t *offp)
 {
 	unsigned long	flags;
 	void		*memptr;
 	stlibrd_t	*brdp;
-	char		*chbuf;
+	char		__user *chbuf;
 	int		brdnr, size, n;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_memwrite(fp=%x,buf=%x,count=%x,offp=%x)\n",
 			(int) fp, (int) buf, count, (int) offp);
 #endif
@@ -4893,7 +4886,7 @@
 	if (fp->f_pos >= brdp->memsize)
 		return(0);
 
-	chbuf = (char *) buf;
+	chbuf = (char __user *) buf;
 	size = MIN(count, (brdp->memsize - fp->f_pos));
 
 	save_flags(flags);
@@ -4923,7 +4916,7 @@
  *	Return the board stats structure to user app.
  */
 
-static int stli_getbrdstats(combrd_t *bp)
+static int stli_getbrdstats(combrd_t __user *bp)
 {
 	stlibrd_t	*brdp;
 	int		i;
@@ -5062,26 +5055,26 @@
  *	what port to get stats for (used through board control device).
  */
 
-static int stli_getportstats(stliport_t *portp, comstats_t *cp)
+static int stli_getportstats(stliport_t *portp, comstats_t __user *cp)
 {
 	stlibrd_t	*brdp;
 	int		rc;
 
-	if (portp == (stliport_t *) NULL) {
+	if (!portp) {
 		if (copy_from_user(&stli_comstats, cp, sizeof(comstats_t)))
 			return -EFAULT;
 		portp = stli_getport(stli_comstats.brd, stli_comstats.panel,
 			stli_comstats.port);
-		if (portp == (stliport_t *) NULL)
-			return(-ENODEV);
+		if (!portp)
+			return -ENODEV;
 	}
 
 	brdp = stli_brds[portp->brdnr];
-	if (brdp == (stlibrd_t *) NULL)
-		return(-ENODEV);
+	if (!brdp)
+		return -ENODEV;
 
 	if ((rc = stli_portcmdstats(portp)) < 0)
-		return(rc);
+		return rc;
 
 	return copy_to_user(cp, &stli_comstats, sizeof(comstats_t)) ?
 			-EFAULT : 0;
@@ -5093,27 +5086,27 @@
  *	Clear the port stats structure. We also return it zeroed out...
  */
 
-static int stli_clrportstats(stliport_t *portp, comstats_t *cp)
+static int stli_clrportstats(stliport_t *portp, comstats_t __user *cp)
 {
 	stlibrd_t	*brdp;
 	int		rc;
 
-	if (portp == (stliport_t *) NULL) {
+	if (!portp) {
 		if (copy_from_user(&stli_comstats, cp, sizeof(comstats_t)))
 			return -EFAULT;
 		portp = stli_getport(stli_comstats.brd, stli_comstats.panel,
 			stli_comstats.port);
-		if (portp == (stliport_t *) NULL)
-			return(-ENODEV);
+		if (!portp)
+			return -ENODEV;
 	}
 
 	brdp = stli_brds[portp->brdnr];
-	if (brdp == (stlibrd_t *) NULL)
-		return(-ENODEV);
+	if (!brdp)
+		return -ENODEV;
 
 	if (brdp->state & BST_STARTED) {
-		if ((rc = stli_cmdwait(brdp, portp, A_CLEARSTATS, 0, 0, 0)) < 0)
-			return(rc);
+		if ((rc = stli_cmdwait(brdp, portp, A_CLEARSTATS, NULL, 0, 0)) < 0)
+			return rc;
 	}
 
 	memset(&stli_comstats, 0, sizeof(comstats_t));
@@ -5123,7 +5116,7 @@
 
 	if (copy_to_user(cp, &stli_comstats, sizeof(comstats_t)))
 		return -EFAULT;
-	return(0);
+	return 0;
 }
 
 /*****************************************************************************/
@@ -5132,19 +5125,19 @@
  *	Return the entire driver ports structure to a user app.
  */
 
-static int stli_getportstruct(unsigned long arg)
+static int stli_getportstruct(stliport_t __user *arg)
 {
 	stliport_t	*portp;
 
-	if (copy_from_user(&stli_dummyport, (void *)arg, sizeof(stliport_t)))
+	if (copy_from_user(&stli_dummyport, arg, sizeof(stliport_t)))
 		return -EFAULT;
 	portp = stli_getport(stli_dummyport.brdnr, stli_dummyport.panelnr,
 		 stli_dummyport.portnr);
-	if (portp == (stliport_t *) NULL)
-		return(-ENODEV);
-	if (copy_to_user((void *) arg, portp, sizeof(stliport_t)))
+	if (!portp)
+		return -ENODEV;
+	if (copy_to_user(arg, portp, sizeof(stliport_t)))
 		return -EFAULT;
-	return(0);
+	return 0;
 }
 
 /*****************************************************************************/
@@ -5153,20 +5146,20 @@
  *	Return the entire driver board structure to a user app.
  */
 
-static int stli_getbrdstruct(unsigned long arg)
+static int stli_getbrdstruct(stlibrd_t __user *arg)
 {
 	stlibrd_t	*brdp;
 
-	if (copy_from_user(&stli_dummybrd, (void *)arg, sizeof(stlibrd_t)))
+	if (copy_from_user(&stli_dummybrd, arg, sizeof(stlibrd_t)))
 		return -EFAULT;
 	if ((stli_dummybrd.brdnr < 0) || (stli_dummybrd.brdnr >= STL_MAXBRDS))
-		return(-ENODEV);
+		return -ENODEV;
 	brdp = stli_brds[stli_dummybrd.brdnr];
-	if (brdp == (stlibrd_t *) NULL)
-		return(-ENODEV);
-	if (copy_to_user((void *) arg, brdp, sizeof(stlibrd_t)))
+	if (!brdp)
+		return -ENODEV;
+	if (copy_to_user(arg, brdp, sizeof(stlibrd_t)))
 		return -EFAULT;
-	return(0);
+	return 0;
 }
 
 /*****************************************************************************/
@@ -5181,8 +5174,9 @@
 {
 	stlibrd_t	*brdp;
 	int		brdnr, rc, done;
+	void __user *argp = (void __user *)arg;
 
-#if DEBUG
+#ifdef DEBUG
 	printk(KERN_DEBUG "stli_memioctl(ip=%x,fp=%x,cmd=%x,arg=%x)\n",
 			(int) ip, (int) fp, cmd, (int) arg);
 #endif
@@ -5195,23 +5189,23 @@
 
 	switch (cmd) {
 	case COM_GETPORTSTATS:
-		rc = stli_getportstats((stliport_t *)NULL, (comstats_t *)arg);
+		rc = stli_getportstats(NULL, argp);
 		done++;
 		break;
 	case COM_CLRPORTSTATS:
-		rc = stli_clrportstats((stliport_t *)NULL, (comstats_t *)arg);
+		rc = stli_clrportstats(NULL, argp);
 		done++;
 		break;
 	case COM_GETBRDSTATS:
-		rc = stli_getbrdstats((combrd_t *) arg);
+		rc = stli_getbrdstats(argp);
 		done++;
 		break;
 	case COM_READPORT:
-		rc = stli_getportstruct(arg);
+		rc = stli_getportstruct(argp);
 		done++;
 		break;
 	case COM_READBOARD:
-		rc = stli_getbrdstruct(arg);
+		rc = stli_getbrdstruct(argp);
 		done++;
 		break;
 	}
@@ -5227,7 +5221,7 @@
 	if (brdnr >= STL_MAXBRDS)
 		return(-ENODEV);
 	brdp = stli_brds[brdnr];
-	if (brdp == (stlibrd_t *) NULL)
+	if (!brdp)
 		return(-ENODEV);
 	if (brdp->state == 0)
 		return(-ENODEV);
diff -urN linux-2.6.8-rc2/drivers/char/moxa.c linux-2.6.8-rc3/drivers/char/moxa.c
--- linux-2.6.8-rc2/drivers/char/moxa.c	2004-06-15 22:20:03.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/moxa.c	2004-08-03 15:21:38.426796323 -0700
@@ -104,6 +104,7 @@
 	"CP-204J series",
 };
 
+#ifdef CONFIG_PCI
 static struct pci_device_id moxa_pcibrds[] = {
 	{ PCI_VENDOR_ID_MOXA, PCI_DEVICE_ID_C218, PCI_ANY_ID, PCI_ANY_ID, 
 	  0, 0, MOXA_BOARD_C218_PCI },
@@ -114,6 +115,7 @@
 	{ 0 }
 };
 MODULE_DEVICE_TABLE(pci, moxa_pcibrds);
+#endif /* CONFIG_PCI */
 
 typedef struct _moxa_isa_board_conf {
 	int boardType;
@@ -190,9 +192,11 @@
 static int verbose = 0;
 static int ttymajor = MOXAMAJOR;
 /* Variables for insmod */
+#ifdef MODULE
 static int baseaddr[] 	= 	{0, 0, 0, 0};
 static int type[]	=	{0, 0, 0, 0};
 static int numports[] 	=	{0, 0, 0, 0};
+#endif
 
 MODULE_AUTHOR("William Chen");
 MODULE_DESCRIPTION("MOXA Intellio Family Multiport Board Device Driver");
@@ -215,7 +219,6 @@
 /*
  * static functions:
  */
-static int moxa_get_PCI_conf(struct pci_dev *, int, moxa_board_conf *);
 static void do_moxa_softint(void *);
 static int moxa_open(struct tty_struct *, struct file *);
 static void moxa_close(struct tty_struct *, struct file *);
@@ -272,8 +275,8 @@
 static void MoxaPortTxEnable(int);
 static int MoxaPortResetBrkCnt(int);
 static void MoxaPortSendBreak(int, int);
-static int moxa_get_serial_info(struct moxa_str *, struct serial_struct *);
-static int moxa_set_serial_info(struct moxa_str *, struct serial_struct *);
+static int moxa_get_serial_info(struct moxa_str *, struct serial_struct __user *);
+static int moxa_set_serial_info(struct moxa_str *, struct serial_struct __user *);
 static void MoxaSetFifo(int port, int enable);
 
 static struct tty_operations moxa_ops = {
@@ -296,6 +299,32 @@
 	.tiocmset = moxa_tiocmset,
 };
 
+#ifdef CONFIG_PCI
+static int moxa_get_PCI_conf(struct pci_dev *p, int board_type, moxa_board_conf * board)
+{
+	board->baseAddr = pci_resource_start (p, 2);
+	board->boardType = board_type;
+	switch (board_type) {
+	case MOXA_BOARD_C218_ISA:
+	case MOXA_BOARD_C218_PCI:
+		board->numPorts = 8;
+		break;
+
+	case MOXA_BOARD_CP204J:
+		board->numPorts = 4;
+		break;
+	default:
+		board->numPorts = 0;
+		break;
+	}
+	board->busType = MOXA_BUS_TYPE_PCI;
+	board->pciInfo.busNum = p->bus->number;
+	board->pciInfo.devNum = p->devfn >> 3;
+
+	return (0);
+}
+#endif /* CONFIG_PCI */
+
 static int __init moxa_init(void)
 {
 	int i, numBoards;
@@ -322,13 +351,13 @@
 	moxaDriver->flags = TTY_DRIVER_REAL_RAW;
 	tty_set_operations(moxaDriver, &moxa_ops);
 
-	moxaXmitBuff = 0;
+	moxaXmitBuff = NULL;
 
 	for (i = 0, ch = moxaChannels; i < MAX_PORTS; i++, ch++) {
 		ch->type = PORT_16550A;
 		ch->port = i;
 		INIT_WORK(&ch->tqueue, do_moxa_softint, ch);
-		ch->tty = 0;
+		ch->tty = NULL;
 		ch->close_delay = 5 * HZ / 10;
 		ch->closing_wait = 30 * HZ;
 		ch->count = 0;
@@ -469,30 +498,6 @@
 module_init(moxa_init);
 module_exit(moxa_exit);
 
-static int moxa_get_PCI_conf(struct pci_dev *p, int board_type, moxa_board_conf * board)
-{
-	board->baseAddr = pci_resource_start (p, 2);
-	board->boardType = board_type;
-	switch (board_type) {
-	case MOXA_BOARD_C218_ISA:
-	case MOXA_BOARD_C218_PCI:
-		board->numPorts = 8;
-		break;
-
-	case MOXA_BOARD_CP204J:
-		board->numPorts = 4;
-		break;
-	default:
-		board->numPorts = 0;
-		break;
-	}
-	board->busType = MOXA_BUS_TYPE_PCI;
-	board->pciInfo.busNum = p->bus->number;
-	board->pciInfo.devNum = p->devfn >> 3;
-
-	return (0);
-}
-
 static void do_moxa_softint(void *private_)
 {
 	struct moxa_str *ch = (struct moxa_str *) private_;
@@ -617,7 +622,7 @@
 		tty->ldisc.flush_buffer(tty);
 	tty->closing = 0;
 	ch->event = 0;
-	ch->tty = 0;
+	ch->tty = NULL;
 	if (ch->blocked_open) {
 		if (ch->close_delay) {
 			set_current_state(TASK_INTERRUPTIBLE);
@@ -802,6 +807,7 @@
 {
 	struct moxa_str *ch = (struct moxa_str *) tty->driver_data;
 	register int port;
+	void __user *argp = (void __user *)arg;
 	int retval;
 
 	port = PORTNO(tty);
@@ -827,9 +833,9 @@
 		MoxaPortSendBreak(ch->port, arg);
 		return (0);
 	case TIOCGSOFTCAR:
-		return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long *) arg);
+		return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long __user *) argp);
 	case TIOCSSOFTCAR:
-		if(get_user(retval, (unsigned long *) arg))
+		if(get_user(retval, (unsigned long __user *) argp))
 			return -EFAULT;
 		arg = retval;
 		tty->termios->c_cflag = ((tty->termios->c_cflag & ~CLOCAL) |
@@ -840,10 +846,10 @@
 			ch->asyncflags |= ASYNC_CHECK_CD;
 		return (0);
 	case TIOCGSERIAL:
-		return (moxa_get_serial_info(ch, (struct serial_struct *) arg));
+		return moxa_get_serial_info(ch, argp);
 
 	case TIOCSSERIAL:
-		return (moxa_set_serial_info(ch, (struct serial_struct *) arg));
+		return moxa_set_serial_info(ch, argp);
 	default:
 		retval = MoxaDriverIoctl(cmd, arg, port);
 	}
@@ -911,7 +917,7 @@
 	ch->event = 0;
 	ch->count = 0;
 	ch->asyncflags &= ~ASYNC_NORMAL_ACTIVE;
-	ch->tty = 0;
+	ch->tty = NULL;
 	wake_up_interruptible(&ch->open_wait);
 }
 
@@ -1158,7 +1164,7 @@
 	unsigned char *charptr, *flagptr;
 	unsigned long flags;
 
-	ts = 0;
+	ts = NULL;
 	tp = ch->tty;
 	if (tp)
 		ts = tp->termios;
@@ -1517,10 +1523,10 @@
 static void moxafunc(unsigned long, int, ushort);
 static void wait_finish(unsigned long);
 static void low_water_check(unsigned long);
-static int moxaloadbios(int, unsigned char *, int);
+static int moxaloadbios(int, unsigned char __user *, int);
 static int moxafindcard(int);
-static int moxaload320b(int, unsigned char *, int);
-static int moxaloadcode(int, unsigned char *, int);
+static int moxaload320b(int, unsigned char __user *, int);
+static int moxaloadcode(int, unsigned char __user *, int);
 static int moxaloadc218(int, unsigned long, int);
 static int moxaloadc320(int, unsigned long, int, int *);
 
@@ -1570,7 +1576,7 @@
 };
 
 struct dl_str {
-	char *buf;
+	char __user *buf;
 	int len;
 	int cardno;
 };
@@ -1596,6 +1602,7 @@
 	int i;
 	int status;
 	int MoxaPortTxQueue(int), MoxaPortRxQueue(int);
+	void __user *argp = (void __user *)arg;
 
 	if (port == QueryPort) {
 		if ((cmd != MOXA_GET_CONF) && (cmd != MOXA_INIT_DRIVER) &&
@@ -1607,7 +1614,7 @@
 	}
 	switch (cmd) {
 	case MOXA_GET_CONF:
-		if(copy_to_user((void *)arg, &moxa_boards, MAX_BOARDS * sizeof(moxa_board_conf)))
+		if(copy_to_user(argp, &moxa_boards, MAX_BOARDS * sizeof(moxa_board_conf)))
 			return -EFAULT;
 		return (0);
 	case MOXA_INIT_DRIVER:
@@ -1616,7 +1623,7 @@
 		return (0);
 	case MOXA_GETDATACOUNT:
 		moxaLog.tick = jiffies;
-		if(copy_to_user((void *)arg, &moxaLog, sizeof(mon_st)))
+		if(copy_to_user(argp, &moxaLog, sizeof(mon_st)))
 			return -EFAULT;
 		return (0);
 	case MOXA_FLUSH_QUEUE:
@@ -1629,22 +1636,22 @@
 				temp_queue[i].outq = MoxaPortTxQueue(i);
 			}
 		}
-		if(copy_to_user((void *)arg, temp_queue, sizeof(struct moxaq_str) * MAX_PORTS))
+		if(copy_to_user(argp, temp_queue, sizeof(struct moxaq_str) * MAX_PORTS))
 			return -EFAULT;
 		return (0);
 	case MOXA_GET_OQUEUE:
 		i = MoxaPortTxQueue(port);
-		return put_user(i, (unsigned long *) arg);
+		return put_user(i, (unsigned long __user *)argp);
 	case MOXA_GET_IQUEUE:
 		i = MoxaPortRxQueue(port);
-		return put_user(i, (unsigned long *) arg);
+		return put_user(i, (unsigned long __user *)argp);
 	case MOXA_GET_MAJOR:
-		if(copy_to_user((void *)arg, &ttymajor, sizeof(int)))
+		if(copy_to_user(argp, &ttymajor, sizeof(int)))
 			return -EFAULT;
 		return 0;
 	case MOXA_GET_CUMAJOR:
 		i = 0;
-		if(copy_to_user((void *)arg, &i, sizeof(int)))
+		if(copy_to_user(argp, &i, sizeof(int)))
 			return -EFAULT;
 		return 0;
 	case MOXA_GETMSTATUS:
@@ -1670,7 +1677,7 @@
 			else
 				GMStatus[i].cflag = moxaChannels[i].tty->termios->c_cflag;
 		}
-		if(copy_to_user((void *)arg, GMStatus, sizeof(struct mxser_mstatus) * MAX_PORTS))
+		if(copy_to_user(argp, GMStatus, sizeof(struct mxser_mstatus) * MAX_PORTS))
 			return -EFAULT;
 		return 0;
 	default:
@@ -1682,7 +1689,7 @@
 		break;
 	}
 
-	if(copy_from_user(&dltmp, (void *)arg, sizeof(struct dl_str)))
+	if(copy_from_user(&dltmp, argp, sizeof(struct dl_str)))
 		return -EFAULT;
 	if(dltmp.cardno < 0 || dltmp.cardno >= MAX_BOARDS)
 		return -EINVAL;
@@ -2677,12 +2684,10 @@
 }
 
 static int moxa_get_serial_info(struct moxa_str *info,
-				struct serial_struct *retinfo)
+				struct serial_struct __user *retinfo)
 {
 	struct serial_struct tmp;
 
-	if (!retinfo)
-		return (-EFAULT);
 	memset(&tmp, 0, sizeof(tmp));
 	tmp.type = info->type;
 	tmp.line = info->port;
@@ -2701,7 +2706,7 @@
 
 
 static int moxa_set_serial_info(struct moxa_str *info,
-				struct serial_struct *new_info)
+				struct serial_struct __user *new_info)
 {
 	struct serial_struct new_serial;
 
@@ -2790,7 +2795,7 @@
 	}
 }
 
-static int moxaloadbios(int cardno, unsigned char *tmp, int len)
+static int moxaloadbios(int cardno, unsigned char __user *tmp, int len)
 {
 	unsigned long baseAddr;
 	int i;
@@ -2837,7 +2842,7 @@
 	return (0);
 }
 
-static int moxaload320b(int cardno, unsigned char * tmp, int len)
+static int moxaload320b(int cardno, unsigned char __user *tmp, int len)
 {
 	unsigned long baseAddr;
 	int i;
@@ -2857,7 +2862,7 @@
 	return (0);
 }
 
-static int moxaloadcode(int cardno, unsigned char * tmp, int len)
+static int moxaloadcode(int cardno, unsigned char __user *tmp, int len)
 {
 	unsigned long baseAddr, ofsAddr;
 	int retval, port, i;
diff -urN linux-2.6.8-rc2/drivers/char/mwave/mwavedd.c linux-2.6.8-rc3/drivers/char/mwave/mwavedd.c
--- linux-2.6.8-rc2/drivers/char/mwave/mwavedd.c	2004-08-03 15:21:06.997507164 -0700
+++ linux-2.6.8-rc3/drivers/char/mwave/mwavedd.c	2004-08-03 15:21:38.430796487 -0700
@@ -94,8 +94,8 @@
 	unsigned int retval = 0;
 
 	PRINTK_3(TRACE_MWAVE,
-		"mwavedd::mwave_open, entry inode %x file %x\n",
-		(int) inode, (int) file);
+		"mwavedd::mwave_open, entry inode %p file %p\n",
+		 inode, file);
 	PRINTK_2(TRACE_MWAVE,
 		"mwavedd::mwave_open, exit return retval %x\n", retval);
 
@@ -107,8 +107,8 @@
 	unsigned int retval = 0;
 
 	PRINTK_3(TRACE_MWAVE,
-		"mwavedd::mwave_close, entry inode %x file %x\n",
-		(int) inode, (int) file);
+		"mwavedd::mwave_close, entry inode %p file %p\n",
+		 inode,  file);
 
 	PRINTK_2(TRACE_MWAVE, "mwavedd::mwave_close, exit retval %x\n",
 		retval);
@@ -124,8 +124,8 @@
 	void __user *arg = (void __user *)ioarg;
 
 	PRINTK_5(TRACE_MWAVE,
-		"mwavedd::mwave_ioctl, entry inode %x file %x cmd %x arg %x\n",
-		(int) inode, (int) file, iocmd, (int) ioarg);
+		"mwavedd::mwave_ioctl, entry inode %p file %p cmd %x arg %x\n",
+		 inode,  file, iocmd, (int) ioarg);
 
 	switch (iocmd) {
 
@@ -389,7 +389,7 @@
                           loff_t * ppos)
 {
 	PRINTK_5(TRACE_MWAVE,
-		"mwavedd::mwave_read entry file %p, buf %p, count %x ppos %p\n",
+		"mwavedd::mwave_read entry file %p, buf %p, count %zx ppos %p\n",
 		file, buf, count, ppos);
 
 	return -EINVAL;
@@ -401,7 +401,7 @@
 {
 	PRINTK_5(TRACE_MWAVE,
 		"mwavedd::mwave_write entry file %p, buf %p,"
-		" count %x ppos %p\n",
+		" count %zx ppos %p\n",
 		file, buf, count, ppos);
 
 	return -EINVAL;
diff -urN linux-2.6.8-rc2/drivers/char/mwave/tp3780i.c linux-2.6.8-rc3/drivers/char/mwave/tp3780i.c
--- linux-2.6.8-rc2/drivers/char/mwave/tp3780i.c	2004-08-03 15:21:06.998507205 -0700
+++ linux-2.6.8-rc3/drivers/char/mwave/tp3780i.c	2004-08-03 15:21:38.431796528 -0700
@@ -99,7 +99,7 @@
 static irqreturn_t UartInterrupt(int irq, void *dev_id, struct pt_regs *regs)
 {
 	PRINTK_3(TRACE_TP3780I,
-		"tp3780i::UartInterrupt entry irq %x dev_id %x\n", irq, (int) dev_id);
+		"tp3780i::UartInterrupt entry irq %x dev_id %p\n", irq, dev_id);
 	return IRQ_HANDLED;
 }
 
@@ -111,7 +111,7 @@
 	unsigned short usIPCSource = 0, usIsolationMask, usPCNum;
 
 	PRINTK_3(TRACE_TP3780I,
-		"tp3780i::DspInterrupt entry irq %x dev_id %x\n", irq, (int) dev_id);
+		"tp3780i::DspInterrupt entry irq %x dev_id %p\n", irq, dev_id);
 
 	if (dsp3780I_GetIPCSource(usDspBaseIO, &usIPCSource) == 0) {
 		PRINTK_2(TRACE_TP3780I,
@@ -368,14 +368,14 @@
 	pSettings->bPllBypass = TP_CFG_PllBypass;
 	pSettings->usChipletEnable = TP_CFG_ChipletEnable;
 
-	if (request_irq(pSettings->usUartIrq, &UartInterrupt, 0, "mwave_uart", 0)) {
+	if (request_irq(pSettings->usUartIrq, &UartInterrupt, 0, "mwave_uart", NULL)) {
 		PRINTK_ERROR(KERN_ERR_MWAVE "tp3780i::tp3780I_EnableDSP: Error: Could not get UART IRQ %x\n", pSettings->usUartIrq);
 		goto exit_cleanup;
 	} else {		/* no conflict just release */
 		free_irq(pSettings->usUartIrq, NULL);
 	}
 
-	if (request_irq(pSettings->usDspIrq, &DspInterrupt, 0, "mwave_3780i", 0)) {
+	if (request_irq(pSettings->usDspIrq, &DspInterrupt, 0, "mwave_3780i", NULL)) {
 		PRINTK_ERROR("tp3780i::tp3780I_EnableDSP: Error: Could not get 3780i IRQ %x\n", pSettings->usDspIrq);
 		goto exit_cleanup;
 	} else {
diff -urN linux-2.6.8-rc2/drivers/char/mxser.c linux-2.6.8-rc3/drivers/char/mxser.c
--- linux-2.6.8-rc2/drivers/char/mxser.c	2004-08-03 15:21:07.000507287 -0700
+++ linux-2.6.8-rc3/drivers/char/mxser.c	2004-08-03 15:21:38.434796651 -0700
@@ -198,6 +198,7 @@
 #define         MOXA_GET_CUMAJOR      (MOXA + 64)
 #define         MOXA_GETMSTATUS       (MOXA + 65)
 
+#ifdef CONFIG_PCI
 static struct pci_device_id mxser_pcibrds[] = {
 	{ PCI_VENDOR_ID_MOXA, PCI_DEVICE_ID_C168, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 
 	  MXSER_BOARD_C168_PCI },
@@ -214,6 +215,7 @@
 	{ 0 }
 };
 MODULE_DEVICE_TABLE(pci, mxser_pcibrds);
+#endif /* CONFIG_PCI */
 
 static int ioaddr[MXSER_BOARDS];
 static int ttymajor = MXSERMAJOR;
@@ -330,7 +332,6 @@
 
 static void mxser_getcfg(int board, struct mxser_hwconf *hwconf);
 static int mxser_get_ISA_conf(int, struct mxser_hwconf *);
-static int mxser_get_PCI_conf(struct pci_dev *, int, struct mxser_hwconf *);
 static void mxser_do_softint(void *);
 static int mxser_open(struct tty_struct *, struct file *);
 static void mxser_close(struct tty_struct *, struct file *);
@@ -356,9 +357,9 @@
 static int mxser_startup(struct mxser_struct *);
 static void mxser_shutdown(struct mxser_struct *);
 static int mxser_change_speed(struct mxser_struct *, struct termios *old_termios);
-static int mxser_get_serial_info(struct mxser_struct *, struct serial_struct *);
-static int mxser_set_serial_info(struct mxser_struct *, struct serial_struct *);
-static int mxser_get_lsr_info(struct mxser_struct *, unsigned int *);
+static int mxser_get_serial_info(struct mxser_struct *, struct serial_struct __user *);
+static int mxser_set_serial_info(struct mxser_struct *, struct serial_struct __user *);
+static int mxser_get_lsr_info(struct mxser_struct *, unsigned int __user *);
 static void mxser_send_break(struct mxser_struct *, int);
 static int mxser_tiocmget(struct tty_struct *, struct file *);
 static int mxser_tiocmset(struct tty_struct *, struct file *, unsigned int, unsigned int);
@@ -461,6 +462,7 @@
 	mxsercfg[board] = *hwconf;
 }
 
+#ifdef CONFIG_PCI
 static int mxser_get_PCI_conf(struct pci_dev *pdev, int board_type, struct mxser_hwconf *hwconf)
 {
 	int i;
@@ -485,6 +487,7 @@
 	}
 	return (0);
 }
+#endif /* CONFIG_PCI */
 
 static struct tty_operations mxser_ops = {
 	.open = mxser_open,
@@ -818,7 +821,7 @@
 		tty->ldisc.flush_buffer(tty);
 	tty->closing = 0;
 	info->event = 0;
-	info->tty = 0;
+	info->tty = NULL;
 	if (info->blocked_open) {
 		if (info->close_delay) {
 			set_current_state(TASK_INTERRUPTIBLE);
@@ -985,8 +988,9 @@
 	struct mxser_struct *info = (struct mxser_struct *) tty->driver_data;
 	int retval;
 	struct async_icount cprev, cnow;	/* kernel counter temps */
-	struct serial_icounter_struct *p_cuser;		/* user space */
+	struct serial_icounter_struct __user *p_cuser;
 	unsigned long templ;
+	void __user *argp = (void __user *)arg;
 
 	if (PORTNO(tty) == MXSER_PORTS)
 		return (mxser_ioctl_special(cmd, arg));
@@ -1012,20 +1016,20 @@
 		mxser_send_break(info, arg ? arg * (HZ / 10) : HZ / 4);
 		return (0);
 	case TIOCGSOFTCAR:
-		return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long *) arg);
+		return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long __user *)argp);
 	case TIOCSSOFTCAR:
-		if(get_user(templ, (unsigned long *) arg))
+		if(get_user(templ, (unsigned long __user *) arg))
 			return -EFAULT;
 		arg = templ;
 		tty->termios->c_cflag = ((tty->termios->c_cflag & ~CLOCAL) |
 					 (arg ? CLOCAL : 0));
 		return (0);
 	case TIOCGSERIAL:
-		return (mxser_get_serial_info(info, (struct serial_struct *) arg));
+		return mxser_get_serial_info(info, argp);
 	case TIOCSSERIAL:
-		return (mxser_set_serial_info(info, (struct serial_struct *) arg));
+		return mxser_set_serial_info(info, argp);
 	case TIOCSERGETLSR:	/* Get line status register */
-		return (mxser_get_lsr_info(info, (unsigned int *) arg));
+		return mxser_get_lsr_info(info, argp);
 		/*
 		 * Wait for any of the 4 modem inputs (DCD,RI,DSR,CTS) to change
 		 * - mask passed in arg for lines of interest
@@ -1069,7 +1073,7 @@
 		cli();
 		cnow = info->icount;
 		restore_flags(flags);
-		p_cuser = (struct serial_icounter_struct *) arg;
+		p_cuser = argp;
 		if(put_user(cnow.cts, &p_cuser->cts))
 			return -EFAULT;
 		if(put_user(cnow.dsr, &p_cuser->dsr))
@@ -1078,7 +1082,7 @@
 			return -EFAULT;
 		return put_user(cnow.dcd, &p_cuser->dcd);
 	case MOXA_HighSpeedOn:
-		return put_user(info->baud_base != 115200 ? 1 : 0, (int *) arg);
+		return put_user(info->baud_base != 115200 ? 1 : 0, (int __user *)argp);
 	default:
 		return (-ENOIOCTLCMD);
 	}
@@ -1088,21 +1092,22 @@
 static int mxser_ioctl_special(unsigned int cmd, unsigned long arg)
 {
 	int i, result, status;
+	void __user *argp = (void __user *)arg;
 
 	switch (cmd) {
 	case MOXA_GET_CONF:
-		if(copy_to_user((struct mxser_hwconf *) arg, mxsercfg,
+		if(copy_to_user(argp, mxsercfg,
 			     sizeof(struct mxser_hwconf) * 4))
 			     	return -EFAULT;
 		return 0;
 	case MOXA_GET_MAJOR:
-		if(copy_to_user((int *) arg, &ttymajor, sizeof(int)))
+		if(copy_to_user(argp, &ttymajor, sizeof(int)))
 			return -EFAULT;
 		return 0;
 
 	case MOXA_GET_CUMAJOR:
 		result = 0;
-		if(copy_to_user((int *) arg, &result, sizeof(int)))
+		if(copy_to_user(argp, &result, sizeof(int)))
 			return -EFAULT;
 		return 0;
 
@@ -1112,9 +1117,9 @@
 			if (mxvar_table[i].base)
 				result |= (1 << i);
 		}
-		return put_user(result, (unsigned long *) arg);
+		return put_user(result, (unsigned long __user *) argp);
 	case MOXA_GETDATACOUNT:
-		if(copy_to_user((struct mxser_log *) arg, &mxvar_log, sizeof(mxvar_log)))
+		if (copy_to_user(argp, &mxvar_log, sizeof(mxvar_log)))
 			return -EFAULT;
 		return (0);
 	case MOXA_GETMSTATUS:
@@ -1148,7 +1153,7 @@
 			else
 				GMStatus[i].cts = 0;
 		}
-		if(copy_to_user((struct mxser_mstatus *) arg, GMStatus,
+		if(copy_to_user(argp, GMStatus,
 			     sizeof(struct mxser_mstatus) * MXSER_PORTS))
 			return -EFAULT;
 		return 0;
@@ -1298,7 +1303,7 @@
 	info->event = 0;
 	info->count = 0;
 	info->flags &= ~ASYNC_NORMAL_ACTIVE;
-	info->tty = 0;
+	info->tty = NULL;
 	wake_up_interruptible(&info->open_wait);
 }
 
@@ -1314,7 +1319,7 @@
 	int pass_counter = 0;
 	int handled = 0;
 
-	port = 0;
+	port = NULL;
 	for (i = 0; i < MXSER_BOARDS; i++) {
 		if (dev_id == &(mxvar_table[i * MXSER_PORTS_PER_BOARD])) {
 			port = dev_id;
@@ -1662,7 +1667,7 @@
 	/*
 	 * and set the speed of the serial port
 	 */
-	mxser_change_speed(info, 0);
+	mxser_change_speed(info, NULL);
 
 	info->flags |= ASYNC_INITIALIZED;
 	restore_flags(flags);
@@ -1694,7 +1699,7 @@
 	 */
 	if (info->xmit_buf) {
 		free_page((unsigned long) info->xmit_buf);
-		info->xmit_buf = 0;
+		info->xmit_buf = NULL;
 	}
 	info->IER = 0;
 	outb(0x00, info->base + UART_IER);	/* disable all intrs */
@@ -2045,7 +2050,7 @@
  * ------------------------------------------------------------
  */
 static int mxser_get_serial_info(struct mxser_struct *info,
-				 struct serial_struct *retinfo)
+				 struct serial_struct __user *retinfo)
 {
 	struct serial_struct tmp;
 
@@ -2066,7 +2071,7 @@
 }
 
 static int mxser_set_serial_info(struct mxser_struct *info,
-				 struct serial_struct *new_info)
+				 struct serial_struct __user *new_info)
 {
 	struct serial_struct new_serial;
 	unsigned int flags;
@@ -2107,7 +2112,7 @@
 
 	if (info->flags & ASYNC_INITIALIZED) {
 		if (flags != (info->flags & ASYNC_SPD_MASK)) {
-			mxser_change_speed(info, 0);
+			mxser_change_speed(info, NULL);
 		}
 	} else
 		retval = mxser_startup(info);
@@ -2124,7 +2129,7 @@
  *          transmit holding register is empty.  This functionality
  *          allows an RS485 driver to be written in user space.
  */
-static int mxser_get_lsr_info(struct mxser_struct *info, unsigned int *value)
+static int mxser_get_lsr_info(struct mxser_struct *info, unsigned int __user *value)
 {
 	unsigned char status;
 	unsigned int result;
diff -urN linux-2.6.8-rc2/drivers/char/n_hdlc.c linux-2.6.8-rc3/drivers/char/n_hdlc.c
--- linux-2.6.8-rc2/drivers/char/n_hdlc.c	2004-08-03 15:21:07.001507328 -0700
+++ linux-2.6.8-rc3/drivers/char/n_hdlc.c	2004-08-03 15:21:38.453797430 -0700
@@ -294,7 +294,7 @@
 #endif
 		tty->disc_data = NULL;
 		if (tty == n_hdlc->backup_tty)
-			n_hdlc->backup_tty = 0;
+			n_hdlc->backup_tty = NULL;
 		if (tty != n_hdlc->tty)
 			return;
 		if (n_hdlc->backup_tty) {
@@ -829,7 +829,7 @@
 	struct n_hdlc *n_hdlc = kmalloc(sizeof(*n_hdlc), GFP_KERNEL);
 
 	if (!n_hdlc)
-		return 0;
+		return NULL;
 
 	memset(n_hdlc, 0, sizeof(*n_hdlc));
 
diff -urN linux-2.6.8-rc2/drivers/char/n_tty.c linux-2.6.8-rc3/drivers/char/n_tty.c
--- linux-2.6.8-rc2/drivers/char/n_tty.c	2004-08-03 15:21:07.003507410 -0700
+++ linux-2.6.8-rc3/drivers/char/n_tty.c	2004-08-03 15:21:38.469798087 -0700
@@ -62,17 +62,12 @@
 
 static inline unsigned char *alloc_buf(void)
 {
-	unsigned char *p;
 	int prio = in_interrupt() ? GFP_ATOMIC : GFP_KERNEL;
 
-	if (PAGE_SIZE != N_TTY_BUF_SIZE) {
-		p = kmalloc(N_TTY_BUF_SIZE, prio);
-		if (p)
-			memset(p, 0, N_TTY_BUF_SIZE);
-	} else
-		p = (unsigned char *)get_zeroed_page(prio);
-
-	return p;
+	if (PAGE_SIZE != N_TTY_BUF_SIZE)
+		return kmalloc(N_TTY_BUF_SIZE, prio);
+	else
+		return (unsigned char *)__get_free_page(prio);
 }
 
 static inline void free_buf(unsigned char *buf)
diff -urN linux-2.6.8-rc2/drivers/char/nvram.c linux-2.6.8-rc3/drivers/char/nvram.c
--- linux-2.6.8-rc2/drivers/char/nvram.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/nvram.c	2004-08-03 15:21:38.470798128 -0700
@@ -467,7 +467,7 @@
 		    NVRAM_MINOR);
 		goto out;
 	}
-	if (!create_proc_read_entry("driver/nvram", 0, 0, nvram_read_proc,
+	if (!create_proc_read_entry("driver/nvram", 0, NULL, nvram_read_proc,
 		NULL)) {
 		printk(KERN_ERR "nvram: can't create /proc/driver/nvram\n");
 		ret = -ENOMEM;
@@ -485,7 +485,7 @@
 static void __exit
 nvram_cleanup_module(void)
 {
-	remove_proc_entry("driver/nvram", 0);
+	remove_proc_entry("driver/nvram", NULL);
 	misc_deregister(&nvram_dev);
 }
 
diff -urN linux-2.6.8-rc2/drivers/char/pcmcia/synclink_cs.c linux-2.6.8-rc3/drivers/char/pcmcia/synclink_cs.c
--- linux-2.6.8-rc2/drivers/char/pcmcia/synclink_cs.c	2004-08-03 15:21:07.006507532 -0700
+++ linux-2.6.8-rc3/drivers/char/pcmcia/synclink_cs.c	2004-08-03 15:21:38.475798333 -0700
@@ -257,6 +257,11 @@
     
 #define CHA     0x00   /* channel A offset */
 #define CHB     0x40   /* channel B offset */
+
+/*
+ *  FIXME: PPC has PVR defined in asm/reg.h.  For now we just undef it.
+ */
+#undef PVR
     
 #define RXFIFO  0
 #define TXFIFO  0
@@ -849,9 +854,8 @@
 static BOOLEAN wait_command_complete(MGSLPC_INFO *info, unsigned char channel) 
 {
 	int i = 0;
-	unsigned char status;
 	/* wait for command completion */ 
-	while ((status = read_reg(info, (unsigned char)(channel+STAR)) & BIT2)) {
+	while (read_reg(info, (unsigned char)(channel+STAR)) & BIT2) {
 		udelay(1);
 		if (i++ == 1000)
 			return FALSE;
diff -urN linux-2.6.8-rc2/drivers/char/riscom8.c linux-2.6.8-rc3/drivers/char/riscom8.c
--- linux-2.6.8-rc2/drivers/char/riscom8.c	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/riscom8.c	2004-08-03 15:21:38.509799728 -0700
@@ -1131,7 +1131,7 @@
 		tty->ldisc.flush_buffer(tty);
 	tty->closing = 0;
 	port->event = 0;
-	port->tty = 0;
+	port->tty = NULL;
 	if (port->blocked_open) {
 		if (port->close_delay) {
 			current->state = TASK_INTERRUPTIBLE;
@@ -1380,7 +1380,7 @@
 }
 
 static inline int rc_set_serial_info(struct riscom_port * port,
-				     struct serial_struct * newinfo)
+				     struct serial_struct __user * newinfo)
 {
 	struct serial_struct tmp;
 	struct riscom_board *bp = port_Board(port);
@@ -1427,7 +1427,7 @@
 }
 
 static inline int rc_get_serial_info(struct riscom_port * port,
-				     struct serial_struct * retinfo)
+				     struct serial_struct __user *retinfo)
 {
 	struct serial_struct tmp;
 	struct riscom_board *bp = port_Board(port);
@@ -1450,6 +1450,7 @@
 		    
 {
 	struct riscom_port *port = (struct riscom_port *)tty->driver_data;
+	void __user *argp = (void __user *)arg;
 	int retval;
 				
 	if (rc_paranoia_check(port, tty->name, "rc_ioctl"))
@@ -1472,18 +1473,18 @@
 		rc_send_break(port, arg ? arg*(HZ/10) : HZ/4);
 		break;
 	 case TIOCGSOFTCAR:
-		return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned int *) arg);
+		return put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned __user *)argp);
 	 case TIOCSSOFTCAR:
-		if (get_user(arg,(unsigned int *) arg))
+		if (get_user(arg,(unsigned __user *) argp))
 			return -EFAULT;
 		tty->termios->c_cflag =
 			((tty->termios->c_cflag & ~CLOCAL) |
 			(arg ? CLOCAL : 0));
 		break;
 	 case TIOCGSERIAL:	
-		return rc_get_serial_info(port, (struct serial_struct *) arg);
+		return rc_get_serial_info(port, argp);
 	 case TIOCSSERIAL:	
-		return rc_set_serial_info(port, (struct serial_struct *) arg);
+		return rc_set_serial_info(port, argp);
 	 default:
 		return -ENOIOCTLCMD;
 	}
@@ -1607,7 +1608,7 @@
 	port->event = 0;
 	port->count = 0;
 	port->flags &= ~ASYNC_NORMAL_ACTIVE;
-	port->tty = 0;
+	port->tty = NULL;
 	wake_up_interruptible(&port->open_wait);
 }
 
diff -urN linux-2.6.8-rc2/drivers/char/ser_a2232.c linux-2.6.8-rc3/drivers/char/ser_a2232.c
--- linux-2.6.8-rc2/drivers/char/ser_a2232.c	2004-06-15 22:19:03.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/ser_a2232.c	2004-08-03 15:21:38.540801000 -0700
@@ -109,12 +109,6 @@
 /************************* End of Includes **************************/
 
 /***************************** Prototypes ***************************/
-/* Helper functions */
-static __inline__ volatile struct a2232status *a2232stat(unsigned int board,
-						unsigned int portonboard);
-static __inline__ volatile struct a2232memory *a2232mem (unsigned int board); 
-static __inline__ void a2232_receive_char(	struct a2232_port *port,
-						int ch, int err );
 /* The interrupt service routine */
 static irqreturn_t a2232_vbl_inter(int irq, void *data, struct pt_regs *fp);
 /* Initialize the port structures */
@@ -178,6 +172,51 @@
 static struct zorro_dev *zd_a2232[MAX_A2232_BOARDS]; 
 /***************************** End of Global variables **************/
 
+/* Helper functions */
+
+static inline volatile struct a2232memory *a2232mem(unsigned int board)
+{
+	return (volatile struct a2232memory *)ZTWO_VADDR(zd_a2232[board]->resource.start);
+}
+
+static inline volatile struct a2232status *a2232stat(unsigned int board,
+						     unsigned int portonboard)
+{
+	volatile struct a2232memory *mem = a2232mem(board);
+	return &(mem->Status[portonboard]);
+}
+
+static inline void a2232_receive_char(struct a2232_port *port, int ch, int err)
+{
+/* 	Mostly stolen from other drivers.
+	Maybe one could implement a more efficient version by not only
+	transferring one character at a time.
+*/
+	struct tty_struct *tty = port->gs.tty;
+
+	if (tty->flip.count >= TTY_FLIPBUF_SIZE)
+		return;
+
+	tty->flip.count++;
+
+#if 0
+	switch(err) {
+	case TTY_BREAK:
+		break;
+	case TTY_PARITY:
+		break;
+	case TTY_OVERRUN:
+		break;
+	case TTY_FRAME:
+		break;
+	}
+#endif
+
+	*tty->flip.flag_buf_ptr++ = err;
+	*tty->flip.char_buf_ptr++ = ch;
+	tty_flip_buffer_push(tty);
+}
+
 /***************************** Functions ****************************/
 /*** BEGIN OF REAL_DRIVER FUNCTIONS ***/
 
@@ -470,49 +509,6 @@
 }
 /*** END OF FUNCTIONS EXPECTED BY TTY DRIVER STRUCTS ***/
 
-static __inline__ volatile struct a2232status *a2232stat(unsigned int board, unsigned int portonboard)
-{
-	volatile struct a2232memory *mem = a2232mem(board);
-	return &(mem->Status[portonboard]);
-}
-
-static __inline__ volatile struct a2232memory *a2232mem (unsigned int board)
-{
-	return (volatile struct a2232memory *) ZTWO_VADDR( zd_a2232[board]->resource.start );
-}
-
-static __inline__ void a2232_receive_char(	struct a2232_port *port,
-						int ch, int err )
-{
-/* 	Mostly stolen from other drivers.
-	Maybe one could implement a more efficient version by not only
-	transferring one character at a time.
-*/
-	struct tty_struct *tty = port->gs.tty;
-	
-	if (tty->flip.count >= TTY_FLIPBUF_SIZE)
-		return;
-
-	tty->flip.count++;
-
-#if 0
-	switch(err) {
-	case TTY_BREAK:
-		break;
-	case TTY_PARITY:
-		break;
-	case TTY_OVERRUN:
-		break;
-	case TTY_FRAME:
-		break;
-	}
-#endif
-
-	*tty->flip.flag_buf_ptr++ = err;
-	*tty->flip.char_buf_ptr++ = ch;
-	tty_flip_buffer_push(tty);
-}
-
 static irqreturn_t a2232_vbl_inter(int irq, void *data, struct pt_regs *fp)
 {
 #if A2232_IOBUFLEN != 256
diff -urN linux-2.6.8-rc2/drivers/char/sonypi.h linux-2.6.8-rc3/drivers/char/sonypi.h
--- linux-2.6.8-rc2/drivers/char/sonypi.h	2004-08-03 15:21:07.017507983 -0700
+++ linux-2.6.8-rc3/drivers/char/sonypi.h	2004-08-03 15:21:38.568802148 -0700
@@ -336,7 +336,7 @@
 	{ SONYPI_DEVICE_MODEL_TYPE2, 0x41, SONYPI_BATTERY_MASK, sonypi_batteryev },
 	{ SONYPI_DEVICE_MODEL_TYPE2, 0x31, SONYPI_PKEY_MASK, sonypi_pkeyev },
 
-	{ 0, 0, 0, 0 }
+	{ 0 }
 };
 
 #define SONYPI_BUF_SIZE	128
diff -urN linux-2.6.8-rc2/drivers/char/specialix.c linux-2.6.8-rc3/drivers/char/specialix.c
--- linux-2.6.8-rc2/drivers/char/specialix.c	2004-06-15 22:19:53.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/specialix.c	2004-08-03 15:21:38.583802764 -0700
@@ -72,7 +72,7 @@
 /*
  * There is a bunch of documentation about the card, jumpers, config
  * settings, restrictions, cables, device names and numbers in
- * ../../Documentation/specialix.txt 
+ * Documentation/specialix.txt
  */
 
 #include <linux/config.h>
@@ -1472,7 +1472,7 @@
 		tty->ldisc.flush_buffer(tty);
 	tty->closing = 0;
 	port->event = 0;
-	port->tty = 0;
+	port->tty = NULL;
 	if (port->blocked_open) {
 		if (port->close_delay) {
 			current->state = TASK_INTERRUPTIBLE;
@@ -1757,18 +1757,13 @@
 
 
 static inline int sx_set_serial_info(struct specialix_port * port,
-                                     struct serial_struct * newinfo)
+                                     struct serial_struct __user * newinfo)
 {
 	struct serial_struct tmp;
 	struct specialix_board *bp = port_Board(port);
 	int change_speed;
 	unsigned long flags;
-	int error;
 	
-	error = verify_area(VERIFY_READ, (void *) newinfo, sizeof(tmp));
-	if (error)
-		return error;
-
 	if (copy_from_user(&tmp, newinfo, sizeof(tmp)))
 		return -EFAULT;
 	
@@ -1813,16 +1808,11 @@
 
 
 static inline int sx_get_serial_info(struct specialix_port * port,
-				     struct serial_struct * retinfo)
+				     struct serial_struct __user *retinfo)
 {
 	struct serial_struct tmp;
 	struct specialix_board *bp = port_Board(port);
-	int error;
 	
-	error = verify_area(VERIFY_WRITE, (void *) retinfo, sizeof(tmp));
-	if (error)
-		return error;
-
 	memset(&tmp, 0, sizeof(tmp));
 	tmp.type = PORT_CIRRUS;
 	tmp.line = port - sx_port;
@@ -1844,8 +1834,8 @@
                     unsigned int cmd, unsigned long arg)
 {
 	struct specialix_port *port = (struct specialix_port *)tty->driver_data;
-	int error;
 	int retval;
+	void __user *argp = (void __user *)arg;
 				
 	if (sx_paranoia_check(port, tty->name, "sx_ioctl"))
 		return -ENODEV;
@@ -1867,22 +1857,20 @@
 		sx_send_break(port, arg ? arg*(HZ/10) : HZ/4);
 		return 0;
 	 case TIOCGSOFTCAR:
-		error = verify_area(VERIFY_WRITE, (void *) arg, sizeof(long));
-		if (error)
-			return error;
-		put_user(C_CLOCAL(tty) ? 1 : 0,
-		         (unsigned long *) arg);
+		if (put_user(C_CLOCAL(tty)?1:0, (unsigned long __user *)argp))
+			return -EFAULT;
 		return 0;
 	 case TIOCSSOFTCAR:
-		get_user(arg, (unsigned long *) arg);
+		if (get_user(arg, (unsigned long __user *) argp))
+			return -EFAULT;
 		tty->termios->c_cflag =
 			((tty->termios->c_cflag & ~CLOCAL) |
 			(arg ? CLOCAL : 0));
 		return 0;
 	 case TIOCGSERIAL:	
-		return sx_get_serial_info(port, (struct serial_struct *) arg);
+		return sx_get_serial_info(port, argp);
 	 case TIOCSSERIAL:	
-		return sx_set_serial_info(port, (struct serial_struct *) arg);
+		return sx_set_serial_info(port, argp);
 	 default:
 		return -ENOIOCTLCMD;
 	}
@@ -2027,7 +2015,7 @@
 	port->event = 0;
 	port->count = 0;
 	port->flags &= ~ASYNC_NORMAL_ACTIVE;
-	port->tty = 0;
+	port->tty = NULL;
 	wake_up_interruptible(&port->open_wait);
 }
 
diff -urN linux-2.6.8-rc2/drivers/char/stallion.c linux-2.6.8-rc3/drivers/char/stallion.c
--- linux-2.6.8-rc2/drivers/char/stallion.c	2004-08-03 15:21:07.020508106 -0700
+++ linux-2.6.8-rc3/drivers/char/stallion.c	2004-08-03 15:21:38.603803584 -0700
@@ -504,13 +504,13 @@
 static int	stl_brdinit(stlbrd_t *brdp);
 static int	stl_initports(stlbrd_t *brdp, stlpanel_t *panelp);
 static int	stl_mapirq(int irq, char *name);
-static int	stl_getserial(stlport_t *portp, struct serial_struct *sp);
-static int	stl_setserial(stlport_t *portp, struct serial_struct *sp);
-static int	stl_getbrdstats(combrd_t *bp);
-static int	stl_getportstats(stlport_t *portp, comstats_t *cp);
-static int	stl_clrportstats(stlport_t *portp, comstats_t *cp);
-static int	stl_getportstruct(unsigned long arg);
-static int	stl_getbrdstruct(unsigned long arg);
+static int	stl_getserial(stlport_t *portp, struct serial_struct __user *sp);
+static int	stl_setserial(stlport_t *portp, struct serial_struct __user *sp);
+static int	stl_getbrdstats(combrd_t __user *bp);
+static int	stl_getportstats(stlport_t *portp, comstats_t __user *cp);
+static int	stl_clrportstats(stlport_t *portp, comstats_t __user *cp);
+static int	stl_getportstruct(stlport_t __user *arg);
+static int	stl_getbrdstruct(stlbrd_t __user *arg);
 static int	stl_waitcarrier(stlport_t *portp, struct file *filp);
 static void	stl_delay(int len);
 static void	stl_eiointr(stlbrd_t *brdp);
@@ -745,7 +745,7 @@
 {
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("init_module()\n");
 #endif
 
@@ -767,7 +767,7 @@
 	unsigned long	flags;
 	int		i, j, k;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("cleanup_module()\n");
 #endif
 
@@ -847,13 +847,13 @@
  *	Check for any arguments passed in on the module load command line.
  */
 
-static void stl_argbrds()
+static void stl_argbrds(void)
 {
 	stlconf_t	conf;
 	stlbrd_t	*brdp;
 	int		nrargs, i;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_argbrds()\n");
 #endif
 
@@ -923,7 +923,7 @@
 	char	*sp;
 	int	nrbrdnames, i;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_parsebrd(confp=%x,argp=%x)\n", (int) confp, (int) argp);
 #endif
 
@@ -978,7 +978,7 @@
  *	Allocate a new board structure. Fill out the basic info in it.
  */
 
-static stlbrd_t *stl_allocbrd()
+static stlbrd_t *stl_allocbrd(void)
 {
 	stlbrd_t	*brdp;
 
@@ -1003,7 +1003,7 @@
 	unsigned int	minordev;
 	int		brdnr, panelnr, portnr, rc;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_open(tty=%x,filp=%x): device=%s\n", (int) tty,
 		(int) filp, tty->name);
 #endif
@@ -1096,7 +1096,7 @@
 	unsigned long	flags;
 	int		rc, doclocal;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_waitcarrier(portp=%x,filp=%x)\n", (int) portp, (int) filp);
 #endif
 
@@ -1148,7 +1148,7 @@
 	stlport_t	*portp;
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_close(tty=%x,filp=%x)\n", (int) tty, (int) filp);
 #endif
 
@@ -1224,7 +1224,7 @@
 
 static void stl_delay(int len)
 {
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_delay(len=%d)\n", len);
 #endif
 	if (len > 0) {
@@ -1247,7 +1247,7 @@
 	unsigned char	*chbuf;
 	char		*head, *tail;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_write(tty=%x,from_user=%d,buf=%x,count=%d)\n",
 		(int) tty, from_user, (int) buf, count);
 #endif
@@ -1324,7 +1324,7 @@
 	unsigned int	len;
 	char		*head, *tail;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_putchar(tty=%x,ch=%x)\n", (int) tty, (int) ch);
 #endif
 
@@ -1362,7 +1362,7 @@
 {
 	stlport_t	*portp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_flushchars(tty=%x)\n", (int) tty);
 #endif
 
@@ -1389,7 +1389,7 @@
 	stlport_t	*portp;
 	char		*head, *tail;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_writeroom(tty=%x)\n", (int) tty);
 #endif
 
@@ -1423,7 +1423,7 @@
 	unsigned int	size;
 	char		*head, *tail;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_charsinbuffer(tty=%x)\n", (int) tty);
 #endif
 
@@ -1449,12 +1449,12 @@
  *	Generate the serial struct info.
  */
 
-static int stl_getserial(stlport_t *portp, struct serial_struct *sp)
+static int stl_getserial(stlport_t *portp, struct serial_struct __user *sp)
 {
 	struct serial_struct	sio;
 	stlbrd_t		*brdp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_getserial(portp=%x,sp=%x)\n", (int) portp, (int) sp);
 #endif
 
@@ -1490,11 +1490,11 @@
  *	just quietly ignore any requests to change irq, etc.
  */
 
-static int stl_setserial(stlport_t *portp, struct serial_struct *sp)
+static int stl_setserial(stlport_t *portp, struct serial_struct __user *sp)
 {
 	struct serial_struct	sio;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_setserial(portp=%x,sp=%x)\n", (int) portp, (int) sp);
 #endif
 
@@ -1567,8 +1567,9 @@
 	stlport_t	*portp;
 	unsigned int	ival;
 	int		rc;
+	void __user *argp = (void __user *)arg;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_ioctl(tty=%x,file=%x,cmd=%x,arg=%x)\n",
 		(int) tty, (int) file, cmd, (int) arg);
 #endif
@@ -1590,36 +1591,26 @@
 	switch (cmd) {
 	case TIOCGSOFTCAR:
 		rc = put_user(((tty->termios->c_cflag & CLOCAL) ? 1 : 0),
-			(unsigned int *) arg);
+			(unsigned __user *) argp);
 		break;
 	case TIOCSSOFTCAR:
-		if ((rc = verify_area(VERIFY_READ, (void *) arg,
-		    sizeof(int))) == 0) {
-			get_user(ival, (unsigned int *) arg);
-			tty->termios->c_cflag =
+		if (get_user(ival, (unsigned int __user *) arg))
+			return -EFAULT;
+		tty->termios->c_cflag =
 				(tty->termios->c_cflag & ~CLOCAL) |
 				(ival ? CLOCAL : 0);
-		}
 		break;
 	case TIOCGSERIAL:
-		if ((rc = verify_area(VERIFY_WRITE, (void *) arg,
-		    sizeof(struct serial_struct))) == 0)
-			rc = stl_getserial(portp, (struct serial_struct *) arg);
+		rc = stl_getserial(portp, argp);
 		break;
 	case TIOCSSERIAL:
-		if ((rc = verify_area(VERIFY_READ, (void *) arg,
-		    sizeof(struct serial_struct))) == 0)
-			rc = stl_setserial(portp, (struct serial_struct *) arg);
+		rc = stl_setserial(portp, argp);
 		break;
 	case COM_GETPORTSTATS:
-		if ((rc = verify_area(VERIFY_WRITE, (void *) arg,
-		    sizeof(comstats_t))) == 0)
-			rc = stl_getportstats(portp, (comstats_t *) arg);
+		rc = stl_getportstats(portp, argp);
 		break;
 	case COM_CLRPORTSTATS:
-		if ((rc = verify_area(VERIFY_WRITE, (void *) arg,
-		    sizeof(comstats_t))) == 0)
-			rc = stl_clrportstats(portp, (comstats_t *) arg);
+		rc = stl_clrportstats(portp, argp);
 		break;
 	case TIOCSERCONFIG:
 	case TIOCSERGWILD:
@@ -1643,7 +1634,7 @@
 	stlport_t	*portp;
 	struct termios	*tiosp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_settermios(tty=%x,old=%x)\n", (int) tty, (int) old);
 #endif
 
@@ -1680,7 +1671,7 @@
 {
 	stlport_t	*portp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_throttle(tty=%x)\n", (int) tty);
 #endif
 
@@ -1702,7 +1693,7 @@
 {
 	stlport_t	*portp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_unthrottle(tty=%x)\n", (int) tty);
 #endif
 
@@ -1725,7 +1716,7 @@
 {
 	stlport_t	*portp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_stop(tty=%x)\n", (int) tty);
 #endif
 
@@ -1747,7 +1738,7 @@
 {
 	stlport_t	*portp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_start(tty=%x)\n", (int) tty);
 #endif
 
@@ -1771,7 +1762,7 @@
 {
 	stlport_t	*portp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_hangup(tty=%x)\n", (int) tty);
 #endif
 
@@ -1807,7 +1798,7 @@
 {
 	stlport_t	*portp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_flushbuffer(tty=%x)\n", (int) tty);
 #endif
 
@@ -1830,7 +1821,7 @@
 {
 	stlport_t	*portp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_breakctl(tty=%x,state=%d)\n", (int) tty, state);
 #endif
 
@@ -1850,7 +1841,7 @@
 	stlport_t	*portp;
 	unsigned long	tend;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_waituntilsent(tty=%x,timeout=%d)\n", (int) tty, timeout);
 #endif
 
@@ -1879,7 +1870,7 @@
 {
 	stlport_t	*portp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_sendxchar(tty=%x,ch=%x)\n", (int) tty, ch);
 #endif
 
@@ -1960,7 +1951,7 @@
 	int		curoff, maxoff;
 	char		*pos;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_readproc(page=%x,start=%x,off=%x,count=%d,eof=%x,"
 		"data=%x\n", (int) page, (int) start, (int) off, count,
 		(int) eof, (int) data);
@@ -2043,7 +2034,7 @@
 	int		i;
 	int handled = 0;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_intr(irq=%d,regs=%x)\n", irq, (int) regs);
 #endif
 
@@ -2189,7 +2180,7 @@
 
 	portp = private;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_offintr(portp=%x)\n", (int) portp);
 #endif
 
@@ -2233,7 +2224,7 @@
 {
 	int	rc, i;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_mapirq(irq=%d,name=%s)\n", irq, name);
 #endif
 
@@ -2265,7 +2256,7 @@
 	stlport_t	*portp;
 	int		chipmask, i;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_initports(brdp=%x,panelp=%x)\n", (int) brdp, (int) panelp);
 #endif
 
@@ -2319,7 +2310,7 @@
 	char		*name;
 	int		rc;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_initeio(brdp=%x)\n", (int) brdp);
 #endif
 
@@ -2457,7 +2448,7 @@
 	int		panelnr, banknr, i;
 	char		*name;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_initech(brdp=%x)\n", (int) brdp);
 #endif
 
@@ -2661,7 +2652,7 @@
 {
 	int	i;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_brdinit(brdp=%x)\n", (int) brdp);
 #endif
 
@@ -2707,7 +2698,7 @@
  *	Find the next available board number that is free.
  */
 
-static inline int stl_getbrdnr()
+static inline int stl_getbrdnr(void)
 {
 	int	i;
 
@@ -2735,7 +2726,7 @@
 {
 	stlbrd_t	*brdp;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_initpcibrd(brdtype=%d,busnr=%x,devnr=%x)\n", brdtype,
 		devp->bus->number, devp->devfn);
 #endif
@@ -2755,7 +2746,7 @@
  *	Different Stallion boards use the BAR registers in different ways,
  *	so set up io addresses based on board type.
  */
-#if DEBUG
+#ifdef DEBUG
 	printk("%s(%d): BAR[]=%x,%x,%x,%x IRQ=%x\n", __FILE__, __LINE__,
 		pci_resource_start(devp, 0), pci_resource_start(devp, 1),
 		pci_resource_start(devp, 2), pci_resource_start(devp, 3), devp->irq);
@@ -2797,12 +2788,12 @@
  */
 
 
-static inline int stl_findpcibrds()
+static inline int stl_findpcibrds(void)
 {
 	struct pci_dev	*dev = NULL;
 	int		i, rc;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_findpcibrds()\n");
 #endif
 
@@ -2835,13 +2826,13 @@
  *	since the initial search and setup is too different.
  */
 
-static inline int stl_initbrds()
+static inline int stl_initbrds(void)
 {
 	stlbrd_t	*brdp;
 	stlconf_t	*confp;
 	int		i;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_initbrds()\n");
 #endif
 
@@ -2891,7 +2882,7 @@
  *	Return the board stats structure to user app.
  */
 
-static int stl_getbrdstats(combrd_t *bp)
+static int stl_getbrdstats(combrd_t __user *bp)
 {
 	stlbrd_t	*brdp;
 	stlpanel_t	*panelp;
@@ -2959,12 +2950,12 @@
  *	what port to get stats for (used through board control device).
  */
 
-static int stl_getportstats(stlport_t *portp, comstats_t *cp)
+static int stl_getportstats(stlport_t *portp, comstats_t __user *cp)
 {
 	unsigned char	*head, *tail;
 	unsigned long	flags;
 
-	if (portp == (stlport_t *) NULL) {
+	if (!portp) {
 		if (copy_from_user(&stl_comstats, cp, sizeof(comstats_t)))
 			return -EFAULT;
 		portp = stl_getport(stl_comstats.brd, stl_comstats.panel,
@@ -3017,9 +3008,9 @@
  *	Clear the port stats structure. We also return it zeroed out...
  */
 
-static int stl_clrportstats(stlport_t *portp, comstats_t *cp)
+static int stl_clrportstats(stlport_t *portp, comstats_t __user *cp)
 {
-	if (portp == (stlport_t *) NULL) {
+	if (!portp) {
 		if (copy_from_user(&stl_comstats, cp, sizeof(comstats_t)))
 			return -EFAULT;
 		portp = stl_getport(stl_comstats.brd, stl_comstats.panel,
@@ -3042,18 +3033,17 @@
  *	Return the entire driver ports structure to a user app.
  */
 
-static int stl_getportstruct(unsigned long arg)
+static int stl_getportstruct(stlport_t __user *arg)
 {
 	stlport_t	*portp;
 
-	if (copy_from_user(&stl_dummyport, (void *) arg, sizeof(stlport_t)))
+	if (copy_from_user(&stl_dummyport, arg, sizeof(stlport_t)))
 		return -EFAULT;
 	portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
 		 stl_dummyport.portnr);
-	if (portp == (stlport_t *) NULL)
-		return(-ENODEV);
-	return copy_to_user((void *)arg, portp,
-			    sizeof(stlport_t)) ? -EFAULT : 0;
+	if (!portp)
+		return -ENODEV;
+	return copy_to_user(arg, portp, sizeof(stlport_t)) ? -EFAULT : 0;
 }
 
 /*****************************************************************************/
@@ -3062,18 +3052,18 @@
  *	Return the entire driver board structure to a user app.
  */
 
-static int stl_getbrdstruct(unsigned long arg)
+static int stl_getbrdstruct(stlbrd_t __user *arg)
 {
 	stlbrd_t	*brdp;
 
-	if (copy_from_user(&stl_dummybrd, (void *) arg, sizeof(stlbrd_t)))
+	if (copy_from_user(&stl_dummybrd, arg, sizeof(stlbrd_t)))
 		return -EFAULT;
 	if ((stl_dummybrd.brdnr < 0) || (stl_dummybrd.brdnr >= STL_MAXBRDS))
-		return(-ENODEV);
+		return -ENODEV;
 	brdp = stl_brds[stl_dummybrd.brdnr];
-	if (brdp == (stlbrd_t *) NULL)
+	if (!brdp)
 		return(-ENODEV);
-	return copy_to_user((void *)arg, brdp, sizeof(stlbrd_t)) ? -EFAULT : 0;
+	return copy_to_user(arg, brdp, sizeof(stlbrd_t)) ? -EFAULT : 0;
 }
 
 /*****************************************************************************/
@@ -3087,8 +3077,9 @@
 static int stl_memioctl(struct inode *ip, struct file *fp, unsigned int cmd, unsigned long arg)
 {
 	int	brdnr, rc;
+	void __user *argp = (void __user *)arg;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_memioctl(ip=%x,fp=%x,cmd=%x,arg=%x)\n", (int) ip,
 		(int) fp, cmd, (int) arg);
 #endif
@@ -3100,31 +3091,19 @@
 
 	switch (cmd) {
 	case COM_GETPORTSTATS:
-		if ((rc = verify_area(VERIFY_WRITE, (void *) arg,
-		    sizeof(comstats_t))) == 0)
-			rc = stl_getportstats((stlport_t *) NULL,
-				(comstats_t *) arg);
+		rc = stl_getportstats(NULL, argp);
 		break;
 	case COM_CLRPORTSTATS:
-		if ((rc = verify_area(VERIFY_WRITE, (void *) arg,
-		    sizeof(comstats_t))) == 0)
-			rc = stl_clrportstats((stlport_t *) NULL,
-				(comstats_t *) arg);
+		rc = stl_clrportstats(NULL, argp);
 		break;
 	case COM_GETBRDSTATS:
-		if ((rc = verify_area(VERIFY_WRITE, (void *) arg,
-		    sizeof(combrd_t))) == 0)
-			rc = stl_getbrdstats((combrd_t *) arg);
+		rc = stl_getbrdstats(argp);
 		break;
 	case COM_READPORT:
-		if ((rc = verify_area(VERIFY_WRITE, (void *) arg,
-		    sizeof(stlport_t))) == 0)
-			rc = stl_getportstruct(arg);
+		rc = stl_getportstruct(argp);
 		break;
 	case COM_READBOARD:
-		if ((rc = verify_area(VERIFY_WRITE, (void *) arg,
-		    sizeof(stlbrd_t))) == 0)
-			rc = stl_getbrdstruct(arg);
+		rc = stl_getbrdstruct(argp);
 		break;
 	default:
 		rc = -ENOIOCTLCMD;
@@ -3262,7 +3241,7 @@
 	int		chipmask, i, j;
 	int		nrchips, uartaddr, ioaddr;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_panelinit(brdp=%x,panelp=%x)\n", (int) brdp, (int) panelp);
 #endif
 
@@ -3314,7 +3293,7 @@
 
 static void stl_cd1400portinit(stlbrd_t *brdp, stlpanel_t *panelp, stlport_t *portp)
 {
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_cd1400portinit(brdp=%x,panelp=%x,portp=%x)\n",
 		(int) brdp, (int) panelp, (int) portp);
 #endif
@@ -3529,7 +3508,7 @@
  *	them all up.
  */
 
-#if DEBUG
+#ifdef DEBUG
 	printk("SETPORT: portnr=%d panelnr=%d brdnr=%d\n",
 		portp->portnr, portp->panelnr, portp->brdnr);
 	printk("    cor1=%x cor2=%x cor3=%x cor4=%x cor5=%x\n",
@@ -3594,7 +3573,7 @@
 	unsigned char	msvr1, msvr2;
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_cd1400setsignals(portp=%x,dtr=%d,rts=%d)\n",
 		(int) portp, dtr, rts);
 #endif
@@ -3630,7 +3609,7 @@
 	unsigned long	flags;
 	int		sigs;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_cd1400getsignals(portp=%x)\n", (int) portp);
 #endif
 
@@ -3668,7 +3647,7 @@
 	unsigned char	ccr;
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_cd1400enablerxtx(portp=%x,rx=%d,tx=%d)\n",
 		(int) portp, rx, tx);
 #endif
@@ -3705,7 +3684,7 @@
 	unsigned char	sreron, sreroff;
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_cd1400startrxtx(portp=%x,rx=%d,tx=%d)\n",
 		(int) portp, rx, tx);
 #endif
@@ -3745,7 +3724,7 @@
 {
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_cd1400disableintrs(portp=%x)\n", (int) portp);
 #endif
 	save_flags(flags);
@@ -3763,7 +3742,7 @@
 {
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_cd1400sendbreak(portp=%x,len=%d)\n", (int) portp, len);
 #endif
 
@@ -3792,7 +3771,7 @@
 	struct tty_struct	*tty;
 	unsigned long		flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_cd1400flowctrl(portp=%x,state=%x)\n", (int) portp, state);
 #endif
 
@@ -3857,7 +3836,7 @@
 	struct tty_struct	*tty;
 	unsigned long		flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_cd1400sendflow(portp=%x,state=%x)\n", (int) portp, state);
 #endif
 
@@ -3892,7 +3871,7 @@
 {
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_cd1400flush(portp=%x)\n", (int) portp);
 #endif
 
@@ -3922,7 +3901,7 @@
 
 static int stl_cd1400datastate(stlport_t *portp)
 {
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_cd1400datastate(portp=%x)\n", (int) portp);
 #endif
 
@@ -3942,7 +3921,7 @@
 {
 	unsigned char	svrtype;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_cd1400eiointr(panelp=%x,iobase=%x)\n",
 		(int) panelp, iobase);
 #endif
@@ -3972,7 +3951,7 @@
 {
 	unsigned char	svrtype;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_cd1400echintr(panelp=%x,iobase=%x)\n", (int) panelp,
 		iobase);
 #endif
@@ -4046,7 +4025,7 @@
 	char		*head, *tail;
 	unsigned char	ioack, srer;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_cd1400txisr(panelp=%x,ioaddr=%x)\n", (int) panelp, ioaddr);
 #endif
 
@@ -4128,7 +4107,7 @@
 	unsigned char		status;
 	char			ch;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_cd1400rxisr(panelp=%x,ioaddr=%x)\n", (int) panelp, ioaddr);
 #endif
 
@@ -4237,7 +4216,7 @@
 	unsigned int	ioack;
 	unsigned char	misr;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_cd1400mdmisr(panelp=%x)\n", (int) panelp);
 #endif
 
@@ -4326,7 +4305,7 @@
 	int	chipmask, i;
 	int	nrchips, ioaddr;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_sc26198panelinit(brdp=%x,panelp=%x)\n",
 		(int) brdp, (int) panelp);
 #endif
@@ -4371,7 +4350,7 @@
 
 static void stl_sc26198portinit(stlbrd_t *brdp, stlpanel_t *panelp, stlport_t *portp)
 {
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_sc26198portinit(brdp=%x,panelp=%x,portp=%x)\n",
 		(int) brdp, (int) panelp, (int) portp);
 #endif
@@ -4548,7 +4527,7 @@
  *	them all up.
  */
 
-#if DEBUG
+#ifdef DEBUG
 	printk("SETPORT: portnr=%d panelnr=%d brdnr=%d\n",
 		portp->portnr, portp->panelnr, portp->brdnr);
 	printk("    mr0=%x mr1=%x mr2=%x clk=%x\n", mr0, mr1, mr2, clk);
@@ -4600,7 +4579,7 @@
 	unsigned char	iopioron, iopioroff;
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_sc26198setsignals(portp=%x,dtr=%d,rts=%d)\n",
 		(int) portp, dtr, rts);
 #endif
@@ -4637,7 +4616,7 @@
 	unsigned long	flags;
 	int		sigs;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_sc26198getsignals(portp=%x)\n", (int) portp);
 #endif
 
@@ -4668,7 +4647,7 @@
 	unsigned char	ccr;
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_sc26198enablerxtx(portp=%x,rx=%d,tx=%d)\n",
 		(int) portp, rx, tx);
 #endif
@@ -4703,7 +4682,7 @@
 	unsigned char	imr;
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_sc26198startrxtx(portp=%x,rx=%d,tx=%d)\n",
 		(int) portp, rx, tx);
 #endif
@@ -4739,7 +4718,7 @@
 {
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_sc26198disableintrs(portp=%x)\n", (int) portp);
 #endif
 
@@ -4758,7 +4737,7 @@
 {
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_sc26198sendbreak(portp=%x,len=%d)\n", (int) portp, len);
 #endif
 
@@ -4787,7 +4766,7 @@
 	unsigned long		flags;
 	unsigned char		mr0;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_sc26198flowctrl(portp=%x,state=%x)\n", (int) portp, state);
 #endif
 
@@ -4859,7 +4838,7 @@
 	unsigned long		flags;
 	unsigned char		mr0;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_sc26198sendflow(portp=%x,state=%x)\n", (int) portp, state);
 #endif
 
@@ -4899,7 +4878,7 @@
 {
 	unsigned long	flags;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_sc26198flush(portp=%x)\n", (int) portp);
 #endif
 
@@ -4931,7 +4910,7 @@
 	unsigned long	flags;
 	unsigned char	sr;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_sc26198datastate(portp=%x)\n", (int) portp);
 #endif
 
@@ -4961,7 +4940,7 @@
 {
 	int	i;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_sc26198wait(portp=%x)\n", (int) portp);
 #endif
 
@@ -5039,7 +5018,7 @@
 	int		len, stlen;
 	char		*head, *tail;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_sc26198txisr(portp=%x)\n", (int) portp);
 #endif
 
@@ -5100,7 +5079,7 @@
 	struct tty_struct	*tty;
 	unsigned int		len, buflen, ioaddr;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_sc26198rxisr(portp=%x,iack=%x)\n", (int) portp, iack);
 #endif
 
@@ -5256,7 +5235,7 @@
 {
 	unsigned char	cir, ipr, xisr;
 
-#if DEBUG
+#ifdef DEBUG
 	printk("stl_sc26198otherisr(portp=%x,iack=%x)\n", (int) portp, iack);
 #endif
 
diff -urN linux-2.6.8-rc2/drivers/char/sx.c linux-2.6.8-rc3/drivers/char/sx.c
--- linux-2.6.8-rc2/drivers/char/sx.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/sx.c	2004-08-03 15:21:38.611803912 -0700
@@ -251,11 +251,13 @@
 #define PCI_DEVICE_ID_SPECIALIX_SX_XIO_IO8 0x2000
 #endif
 
+#ifdef CONFIG_PCI
 static struct pci_device_id sx_pci_tbl[] = {
 	{ PCI_VENDOR_ID_SPECIALIX, PCI_DEVICE_ID_SPECIALIX_SX_XIO_IO8, PCI_ANY_ID, PCI_ANY_ID },
 	{ 0 }
 };
 MODULE_DEVICE_TABLE(pci, sx_pci_tbl);
+#endif /* CONFIG_PCI */
 
 /* Configurable options: 
    (Don't be too sure that it'll work if you toggle them) */
@@ -1592,7 +1594,8 @@
                         unsigned int cmd, unsigned long arg)
 {
 	int rc = 0;
-	int *descr = (int *)arg, i;
+	int __user *descr = (int __user *)arg;
+	int i;
 	static struct sx_board *board = NULL;
 	int nbytes, offset;
 	unsigned long data;
@@ -1668,7 +1671,7 @@
 		get_user (data,	 descr++);
 		while (nbytes && data) {
 			for (i=0;i<nbytes;i += SX_CHUNK_SIZE) {
-				if (copy_from_user(tmp, (char *)data + i, 
+				if (copy_from_user(tmp, (char __user *)data+i, 
 						   (i + SX_CHUNK_SIZE >
 						    nbytes) ? nbytes - i :
 						   	      SX_CHUNK_SIZE)) {
@@ -1774,6 +1777,7 @@
 {
 	int rc;
 	struct sx_port *port = tty->driver_data;
+	void __user *argp = (void __user *)arg;
 	int ival;
 
 	/* func_enter2(); */
@@ -1782,24 +1786,20 @@
 	switch (cmd) {
 	case TIOCGSOFTCAR:
 		rc = put_user(((tty->termios->c_cflag & CLOCAL) ? 1 : 0),
-		              (unsigned int *) arg);
+		              (unsigned __user *) argp);
 		break;
 	case TIOCSSOFTCAR:
-		if ((rc = get_user(ival, (unsigned int *) arg)) == 0) {
+		if ((rc = get_user(ival, (unsigned __user *) argp)) == 0) {
 			tty->termios->c_cflag =
 				(tty->termios->c_cflag & ~CLOCAL) |
 				(ival ? CLOCAL : 0);
 		}
 		break;
 	case TIOCGSERIAL:
-		if ((rc = verify_area(VERIFY_WRITE, (void *) arg,
-		                      sizeof(struct serial_struct))) == 0)
-			rc = gs_getserial(&port->gs, (struct serial_struct *) arg);
+		rc = gs_getserial(&port->gs, argp);
 		break;
 	case TIOCSSERIAL:
-		if ((rc = verify_area(VERIFY_READ, (void *) arg,
-		                      sizeof(struct serial_struct))) == 0)
-			rc = gs_setserial(&port->gs, (struct serial_struct *) arg);
+		rc = gs_setserial(&port->gs, argp);
 		break;
 	default:
 		rc = -ENOIOCTLCMD;
diff -urN linux-2.6.8-rc2/drivers/char/synclink.c linux-2.6.8-rc3/drivers/char/synclink.c
--- linux-2.6.8-rc2/drivers/char/synclink.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/synclink.c	2004-08-03 15:21:38.650805512 -0700
@@ -1873,7 +1873,7 @@
 
 	if (info->xmit_buf) {
 		free_page((unsigned long) info->xmit_buf);
-		info->xmit_buf = 0;
+		info->xmit_buf = NULL;
 	}
 
 	spin_lock_irqsave(&info->irq_spinlock,flags);
@@ -3260,7 +3260,7 @@
 	shutdown(info);
 	
 	tty->closing = 0;
-	info->tty = 0;
+	info->tty = NULL;
 	
 	if (info->blocked_open) {
 		if (info->close_delay) {
@@ -3381,7 +3381,7 @@
 	
 	info->count = 0;	
 	info->flags &= ~ASYNC_NORMAL_ACTIVE;
-	info->tty = 0;
+	info->tty = NULL;
 
 	wake_up_interruptible(&info->open_wait);
 	
@@ -3592,7 +3592,7 @@
 cleanup:			
 	if (retval) {
 		if (tty->count == 1)
-			info->tty = 0; /* tty layer will release tty struct */
+			info->tty = NULL;/* tty layer will release tty struct */
 		if(info->count)
 			info->count--;
 	}
@@ -4341,11 +4341,11 @@
 	}
 	if (info->memory_base){
 		iounmap(info->memory_base);
-		info->memory_base = 0;
+		info->memory_base = NULL;
 	}
 	if (info->lcr_base){
 		iounmap(info->lcr_base - info->lcr_offset);
-		info->lcr_base = 0;
+		info->lcr_base = NULL;
 	}
 	
 	if ( debug_level >= DEBUG_LEVEL_INFO )
diff -urN linux-2.6.8-rc2/drivers/char/synclinkmp.c linux-2.6.8-rc3/drivers/char/synclinkmp.c
--- linux-2.6.8-rc2/drivers/char/synclinkmp.c	2004-08-03 15:21:07.024508270 -0700
+++ linux-2.6.8-rc3/drivers/char/synclinkmp.c	2004-08-03 15:21:38.656805758 -0700
@@ -361,6 +361,10 @@
 #define TMCS	0x64
 #define TEPR	0x65
 
+/*
+ *  FIXME: DAR here clashed with asm-ppc/reg.h and asm-sh/.../dma.h
+ */
+#undef DAR
 /* DMA Controller Register macros */
 #define DAR	0x80
 #define DARL	0x80
@@ -796,7 +800,7 @@
 cleanup:
 	if (retval) {
 		if (tty->count == 1)
-			info->tty = 0; /* tty layer will release tty struct */
+			info->tty = NULL;/* tty layer will release tty struct */
 		if(info->count)
 			info->count--;
 	}
@@ -871,7 +875,7 @@
 	shutdown(info);
 
 	tty->closing = 0;
-	info->tty = 0;
+	info->tty = NULL;
 
 	if (info->blocked_open) {
 		if (info->close_delay) {
@@ -910,7 +914,7 @@
 
 	info->count = 0;
 	info->flags &= ~ASYNC_NORMAL_ACTIVE;
-	info->tty = 0;
+	info->tty = NULL;
 
 	wake_up_interruptible(&info->open_wait);
 }
@@ -2607,7 +2611,7 @@
 
 	if (info->tx_buf) {
 		kfree(info->tx_buf);
-		info->tx_buf = 0;
+		info->tx_buf = NULL;
 	}
 
 	spin_lock_irqsave(&info->lock,flags);
@@ -3548,22 +3552,22 @@
 
 	if (info->memory_base){
 		iounmap(info->memory_base);
-		info->memory_base = 0;
+		info->memory_base = NULL;
 	}
 
 	if (info->sca_base) {
 		iounmap(info->sca_base - info->sca_offset);
-		info->sca_base=0;
+		info->sca_base=NULL;
 	}
 
 	if (info->statctrl_base) {
 		iounmap(info->statctrl_base - info->statctrl_offset);
-		info->statctrl_base=0;
+		info->statctrl_base=NULL;
 	}
 
 	if (info->lcr_base){
 		iounmap(info->lcr_base - info->lcr_offset);
-		info->lcr_base = 0;
+		info->lcr_base = NULL;
 	}
 
 	if ( debug_level >= DEBUG_LEVEL_INFO )
@@ -5143,7 +5147,7 @@
 	u32 speed = info->params.clock_speed;
 
 	info->params.clock_speed = 3686400;
-	info->tty = 0;
+	info->tty = NULL;
 
 	/* assume failure */
 	info->init_error = DiagStatus_DmaFailure;
diff -urN linux-2.6.8-rc2/drivers/char/tpqic02.c linux-2.6.8-rc3/drivers/char/tpqic02.c
--- linux-2.6.8-rc2/drivers/char/tpqic02.c	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/tpqic02.c	2004-08-03 15:21:38.660805923 -0700
@@ -898,7 +898,7 @@
 		printk(TPQIC02_NAME ": ll_do_qic_cmd(%x, %ld) failed\n", cmd, (long) timeout);
 		return -EIO;
 	}
-#if OBSOLETE
+#ifdef OBSOLETE
 	/* wait for ready since it may not be active immediately after reading status */
 	while ((inb_p(QIC02_STAT_PORT) & QIC02_STAT_READY) != 0)
 		cpu_relax();
@@ -1419,7 +1419,7 @@
 		if (stat != TE_OK)
 			return stat;
 
-#if OBSOLETE
+#ifdef OBSOLETE
 		/************* not needed iff rd_status() would wait for ready!!!!!! **********/
 		if (wait_for_ready(TIM_S) != TE_OK) {	/*** not sure this is needed ***/
 			tpqputs(TPQD_ALWAYS, "wait_for_ready failed in start_dma");
@@ -2589,7 +2589,7 @@
 	release_region(QIC02_TAPE_PORT, QIC02_TAPE_PORT_RANGE);
 	if (buffaddr)
 		free_pages((unsigned long) buffaddr, get_order(TPQBUF_SIZE));
-	buffaddr = 0;		/* Better to cause a panic than overwite someone else */
+	buffaddr = NULL;	/* Better to cause a panic than overwite someone else */
 	status_zombie = YES;
 }				/* qic02_release_resources */
 
diff -urN linux-2.6.8-rc2/drivers/char/tty_io.c linux-2.6.8-rc3/drivers/char/tty_io.c
--- linux-2.6.8-rc2/drivers/char/tty_io.c	2004-08-03 15:21:07.026508352 -0700
+++ linux-2.6.8-rc3/drivers/char/tty_io.c	2004-08-03 15:21:38.664806087 -0700
@@ -1068,7 +1068,7 @@
 {
 	struct tty_struct *tty, *o_tty;
 	int	pty_master, tty_closing, o_tty_closing, do_sleep;
-	int	devpts_master;
+	int	devpts_master, devpts;
 	int	idx;
 	char	buf[64];
 	
@@ -1083,7 +1083,8 @@
 	idx = tty->index;
 	pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
 		      tty->driver->subtype == PTY_TYPE_MASTER);
-	devpts_master = pty_master && (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM);
+	devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
+	devpts_master = pty_master && devpts;
 	o_tty = tty->link;
 
 #ifdef TTY_PARANOIA_CHECK
@@ -1308,7 +1309,7 @@
 
 #ifdef CONFIG_UNIX98_PTYS
 	/* Make this pty number available for reallocation */
-	if (devpts_master) {
+	if (devpts) {
 		down(&allocated_ptys_lock);
 		idr_remove(&allocated_ptys, idx);
 		up(&allocated_ptys_lock);
diff -urN linux-2.6.8-rc2/drivers/char/vt.c linux-2.6.8-rc3/drivers/char/vt.c
--- linux-2.6.8-rc2/drivers/char/vt.c	2004-08-03 15:21:07.033508639 -0700
+++ linux-2.6.8-rc3/drivers/char/vt.c	2004-08-03 15:21:38.682806825 -0700
@@ -100,6 +100,7 @@
 #include <linux/workqueue.h>
 #include <linux/bootmem.h>
 #include <linux/pm.h>
+#include <linux/font.h>
 
 #include <asm/io.h>
 #include <asm/system.h>
@@ -3023,98 +3024,182 @@
 
 #define max_font_size 65536
 
-int con_font_op(int currcons, struct console_font_op *op)
+int con_font_get(int currcons, struct console_font_op *op)
 {
+	struct console_font font;
 	int rc = -EINVAL;
-	int size = max_font_size, set;
-	u8 *temp = NULL;
-	struct console_font_op old_op;
+	int c;
 
 	if (vt_cons[currcons]->vc_mode != KD_TEXT)
-		goto quit;
-	memcpy(&old_op, op, sizeof(old_op));
-	if (op->op == KD_FONT_OP_SET) {
-		if (!op->data)
-			return -EINVAL;
-		if (op->charcount > 512)
-			goto quit;
-		if (!op->height) {		/* Need to guess font height [compat] */
-			int h, i;
-			u8 __user *charmap = op->data;
-			u8 tmp;
-			
-			/* If from KDFONTOP ioctl, don't allow things which can be done in userland,
-			   so that we can get rid of this soon */
-			if (!(op->flags & KD_FONT_FLAG_OLD))
-				goto quit;
-			rc = -EFAULT;
-			for (h = 32; h > 0; h--)
-				for (i = 0; i < op->charcount; i++) {
-					if (get_user(tmp, &charmap[32*i+h-1]))
-						goto quit;
-					if (tmp)
-						goto nonzero;
-				}
-			rc = -EINVAL;
-			goto quit;
-		nonzero:
-			rc = -EINVAL;
-			op->height = h;
-		}
-		if (op->width > 32 || op->height > 32)
-			goto quit;
-		size = (op->width+7)/8 * 32 * op->charcount;
-		if (size > max_font_size)
-			return -ENOSPC;
-		set = 1;
-	} else if (op->op == KD_FONT_OP_GET)
-		set = 0;
-	else {
-		acquire_console_sem();
-		rc = sw->con_font_op(vc_cons[currcons].d, op);
-		release_console_sem();
-		return rc;
-	}
+		return -EINVAL;
+
 	if (op->data) {
-		temp = kmalloc(size, GFP_KERNEL);
-		if (!temp)
+		font.data = kmalloc(max_font_size, GFP_KERNEL);
+		if (!font.data)
 			return -ENOMEM;
-		if (set && copy_from_user(temp, op->data, size)) {
-			rc = -EFAULT;
-			goto quit;
-		}
-		op->data = temp;
-	}
+	} else
+		font.data = NULL;
 
 	acquire_console_sem();
-	rc = sw->con_font_op(vc_cons[currcons].d, op);
+	if (sw->con_font_get)
+		rc = sw->con_font_get(vc_cons[currcons].d, &font);
+	else
+		rc = -ENOSYS;
 	release_console_sem();
 
-	op->data = old_op.data;
-	if (!rc && !set) {
-		int c = (op->width+7)/8 * 32 * op->charcount;
-		
-		if (op->data && op->charcount > old_op.charcount)
+	if (rc)
+		goto out;
+
+	c = (font.width+7)/8 * 32 * font.charcount;
+	
+	if (op->data && font.charcount > op->charcount)
+		rc = -ENOSPC;
+	if (!(op->flags & KD_FONT_FLAG_OLD)) {
+		if (font.width > op->width || font.height > op->height) 
+			rc = -ENOSPC;
+	} else {
+		if (font.width != 8)
+			rc = -EIO;
+		else if ((op->height && font.height > op->height) ||
+			 font.height > 32)
 			rc = -ENOSPC;
-		if (!(op->flags & KD_FONT_FLAG_OLD)) {
-			if (op->width > old_op.width || 
-			    op->height > old_op.height)
-				rc = -ENOSPC;
-		} else {
-			if (op->width != 8)
-				rc = -EIO;
-			else if ((old_op.height && op->height > old_op.height) ||
-			         op->height > 32)
-				rc = -ENOSPC;
-		}
-		if (!rc && op->data && copy_to_user(op->data, temp, c))
-			rc = -EFAULT;
 	}
-quit:	if (temp)
-		kfree(temp);
+	if (rc)
+		goto out;
+
+	if (op->data && copy_to_user(op->data, font.data, c))
+		rc = -EFAULT;
+
+out:
+	kfree(font.data);
 	return rc;
 }
 
+int con_font_set(int currcons, struct console_font_op *op)
+{
+	struct console_font font;
+	int rc = -EINVAL;
+	int size;
+
+	if (vt_cons[currcons]->vc_mode != KD_TEXT)
+		return -EINVAL;
+	if (!op->data)
+		return -EINVAL;
+	if (op->charcount > 512)
+		return -EINVAL;
+	if (!op->height) {		/* Need to guess font height [compat] */
+		int h, i;
+		u8 __user *charmap = op->data;
+		u8 tmp;
+		
+		/* If from KDFONTOP ioctl, don't allow things which can be done in userland,
+		   so that we can get rid of this soon */
+		if (!(op->flags & KD_FONT_FLAG_OLD))
+			return -EINVAL;
+		for (h = 32; h > 0; h--)
+			for (i = 0; i < op->charcount; i++) {
+				if (get_user(tmp, &charmap[32*i+h-1]))
+					return -EFAULT;
+				if (tmp)
+					goto nonzero;
+			}
+		return -EINVAL;
+	nonzero:
+		op->height = h;
+	}
+	if (op->width <= 0 || op->width > 32 || op->height > 32)
+		return -EINVAL;
+	size = (op->width+7)/8 * 32 * op->charcount;
+	if (size > max_font_size)
+		return -ENOSPC;
+	font.charcount = op->charcount;
+	font.height = op->height;
+	font.width = op->width;
+	font.data = kmalloc(size, GFP_KERNEL);
+	if (!font.data)
+		return -ENOMEM;
+	if (copy_from_user(font.data, op->data, size)) {
+		kfree(font.data);
+		return -EFAULT;
+	}
+	acquire_console_sem();
+	if (sw->con_font_set)
+		rc = sw->con_font_set(vc_cons[currcons].d, &font, op->flags);
+	else
+		rc = -ENOSYS;
+	release_console_sem();
+	kfree(font.data);
+	return rc;
+}
+
+int con_font_default(int currcons, struct console_font_op *op)
+{
+	struct console_font font = {.width = op->width, .height = op->height};
+	char name[MAX_FONT_NAME];
+	char *s = name;
+	int rc;
+
+	if (vt_cons[currcons]->vc_mode != KD_TEXT)
+		return -EINVAL;
+
+	if (!op->data)
+		s = NULL;
+	else if (strncpy_from_user(name, op->data, MAX_FONT_NAME - 1) < 0)
+		return -EFAULT;
+	else
+		name[MAX_FONT_NAME - 1] = 0;
+
+	acquire_console_sem();
+	if (sw->con_font_default)
+		rc = sw->con_font_default(vc_cons[currcons].d, &font, s);
+	else
+		rc = -ENOSYS;
+	release_console_sem();
+	if (!rc) {
+		op->width = font.width;
+		op->height = font.height;
+	}
+	return rc;
+}
+
+int con_font_copy(int currcons, struct console_font_op *op)
+{
+	int con = op->height;
+	struct vc_data *vc;
+	int rc;
+
+	if (vt_cons[currcons]->vc_mode != KD_TEXT)
+		return -EINVAL;
+
+	acquire_console_sem();
+	vc = vc_cons[currcons].d;
+	if (!sw->con_font_copy)
+		rc = -ENOSYS;
+	else if (con < 0 || !vc_cons_allocated(con))
+		rc = -ENOTTY;
+	else if (con == vc->vc_num)	/* nothing to do */
+		rc = 0;
+	else
+		rc = sw->con_font_copy(vc, con);
+	release_console_sem();
+	return rc;
+}
+
+int con_font_op(int currcons, struct console_font_op *op)
+{
+	switch (op->op) {
+	case KD_FONT_OP_SET:
+		return con_font_set(currcons, op);
+	case KD_FONT_OP_GET:
+		return con_font_get(currcons, op);
+	case KD_FONT_OP_SET_DEFAULT:
+		return con_font_default(currcons, op);
+	case KD_FONT_OP_COPY:
+		return con_font_copy(currcons, op);
+	}
+	return -ENOSYS;
+}
+
 /*
  *	Interface exported to selection and vcs.
  */
diff -urN linux-2.6.8-rc2/drivers/char/vt_ioctl.c linux-2.6.8-rc3/drivers/char/vt_ioctl.c
--- linux-2.6.8-rc2/drivers/char/vt_ioctl.c	2004-08-03 15:21:07.034508680 -0700
+++ linux-2.6.8-rc3/drivers/char/vt_ioctl.c	2004-08-03 15:21:38.684806907 -0700
@@ -915,7 +915,7 @@
 		op.width = 8;
 		op.height = 0;
 		op.charcount = 256;
-		op.data = (char *) arg;
+		op.data = up;
 		return con_font_op(fg_console, &op);
 	}
 
@@ -925,7 +925,7 @@
 		op.width = 8;
 		op.height = 32;
 		op.charcount = 256;
-		op.data = (char *) arg;
+		op.data = up;
 		return con_font_op(fg_console, &op);
 	}
 
diff -urN linux-2.6.8-rc2/drivers/char/watchdog/Kconfig linux-2.6.8-rc3/drivers/char/watchdog/Kconfig
--- linux-2.6.8-rc2/drivers/char/watchdog/Kconfig	2004-08-03 15:21:07.035508721 -0700
+++ linux-2.6.8-rc3/drivers/char/watchdog/Kconfig	2004-08-03 15:21:38.698807481 -0700
@@ -95,6 +95,17 @@
 
 	  Say N if you are unsure.
 
+config IXP2000_WATCHDOG
+	tristate "IXP2000 Watchdog"
+	depends on WATCHDOG && ARCH_IXP2000
+	help
+	  Say Y here if to include support for the watchdog timer
+	  in the Intel IXP2000(2400, 2800, 2850) network processors.
+	  This driver can be built as a module by choosing M. The module
+	  will be called ixp2000_wdt.
+
+	  Say N if you are unsure.
+
 config SA1100_WATCHDOG
 	tristate "SA1100/PXA2xx watchdog"
 	depends on WATCHDOG && ( ARCH_SA1100 || ARCH_PXA )
diff -urN linux-2.6.8-rc2/drivers/char/watchdog/Makefile linux-2.6.8-rc3/drivers/char/watchdog/Makefile
--- linux-2.6.8-rc2/drivers/char/watchdog/Makefile	2004-06-15 22:19:43.000000000 -0700
+++ linux-2.6.8-rc3/drivers/char/watchdog/Makefile	2004-08-03 15:21:38.699807523 -0700
@@ -36,3 +36,4 @@
 obj-$(CONFIG_PCIPCWATCHDOG) += pcwd_pci.o
 obj-$(CONFIG_USBPCWATCHDOG) += pcwd_usb.o
 obj-$(CONFIG_IXP4XX_WATCHDOG) += ixp4xx_wdt.o
+obj-$(CONFIG_IXP2000_WATCHDOG) += ixp2000_wdt.o
diff -urN linux-2.6.8-rc2/drivers/char/watchdog/ixp2000_wdt.c linux-2.6.8-rc3/drivers/char/watchdog/ixp2000_wdt.c
--- linux-2.6.8-rc2/drivers/char/watchdog/ixp2000_wdt.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/drivers/char/watchdog/ixp2000_wdt.c	2004-08-03 15:21:38.721808425 -0700
@@ -0,0 +1,223 @@
+/*
+ * drivers/watchdog/ixp2000_wdt.c
+ *
+ * Watchdog driver for Intel IXP2000 network processors
+ *
+ * Adapted from the IXP4xx watchdog driver by Lennert Buytenhek.
+ * The original version carries these notices:
+ *
+ * Author: Deepak Saxena <dsaxena@plexity.net>
+ *
+ * Copyright 2004 (c) MontaVista, Software, Inc.
+ * Based on sa1100 driver, Copyright (C) 2000 Oleg Drokin <green@crimea.edu>
+ *
+ * This file is licensed under  the terms of the GNU General Public
+ * License version 2. This program is licensed "as is" without any
+ * warranty of any kind, whether express or implied.
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/fs.h>
+#include <linux/miscdevice.h>
+#include <linux/watchdog.h>
+#include <linux/init.h>
+
+#include <asm/hardware.h>
+#include <asm/bitops.h>
+#include <asm/uaccess.h>
+
+#ifdef CONFIG_WATCHDOG_NOWAYOUT
+static int nowayout = 1;
+#else
+static int nowayout = 0;
+#endif
+static unsigned int heartbeat = 60;	/* (secs) Default is 1 minute */
+static unsigned long wdt_status;
+
+#define	WDT_IN_USE		0
+#define	WDT_OK_TO_CLOSE		1
+
+static unsigned long wdt_tick_rate;
+
+static void
+wdt_enable(void)
+{
+	ixp2000_reg_write(IXP2000_RESET0, *(IXP2000_RESET0) | WDT_RESET_ENABLE);
+	ixp2000_reg_write(IXP2000_TWDE, WDT_ENABLE);
+	ixp2000_reg_write(IXP2000_T4_CLD, heartbeat * wdt_tick_rate);
+	ixp2000_reg_write(IXP2000_T4_CTL, TIMER_DIVIDER_256 | TIMER_ENABLE);
+}
+
+static void
+wdt_disable(void)
+{
+	ixp2000_reg_write(IXP2000_T4_CTL, 0);
+}
+
+static void
+wdt_keepalive(void)
+{
+	ixp2000_reg_write(IXP2000_T4_CLD, heartbeat * wdt_tick_rate);
+}
+
+static int
+ixp2000_wdt_open(struct inode *inode, struct file *file)
+{
+	if (test_and_set_bit(WDT_IN_USE, &wdt_status))
+		return -EBUSY;
+
+	clear_bit(WDT_OK_TO_CLOSE, &wdt_status);
+
+	wdt_enable();
+
+	return 0;
+}
+
+static ssize_t
+ixp2000_wdt_write(struct file *file, const char *data, size_t len, loff_t *ppos)
+{
+	/* Can't seek (pwrite) on this device  */
+	if (ppos != &file->f_pos)
+		return -ESPIPE;
+
+	if (len) {
+		if (!nowayout) {
+			size_t i;
+
+			clear_bit(WDT_OK_TO_CLOSE, &wdt_status);
+
+			for (i = 0; i != len; i++) {
+				char c;
+
+				if (get_user(c, data + i))
+					return -EFAULT;
+				if (c == 'V')
+					set_bit(WDT_OK_TO_CLOSE, &wdt_status);
+			}
+		}
+		wdt_keepalive();
+	}
+
+	return len;
+}
+
+
+static struct watchdog_info ident = {
+	.options	= WDIOF_MAGICCLOSE | WDIOF_SETTIMEOUT |
+				WDIOF_KEEPALIVEPING,
+	.identity	= "IXP2000 Watchdog",
+};
+
+static int
+ixp2000_wdt_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
+			unsigned long arg)
+{
+	int ret = -ENOIOCTLCMD;
+	int time;
+
+	switch (cmd) {
+	case WDIOC_GETSUPPORT:
+		ret = copy_to_user((struct watchdog_info *)arg, &ident,
+				   sizeof(ident)) ? -EFAULT : 0;
+		break;
+
+	case WDIOC_GETSTATUS:
+		ret = put_user(0, (int *)arg);
+		break;
+
+	case WDIOC_GETBOOTSTATUS:
+		ret = put_user(0, (int *)arg);
+		break;
+
+	case WDIOC_SETTIMEOUT:
+		ret = get_user(time, (int *)arg);
+		if (ret)
+			break;
+
+		if (time <= 0 || time > 60) {
+			ret = -EINVAL;
+			break;
+		}
+
+		heartbeat = time;
+		wdt_keepalive();
+		/* Fall through */
+
+	case WDIOC_GETTIMEOUT:
+		ret = put_user(heartbeat, (int *)arg);
+		break;
+
+	case WDIOC_KEEPALIVE:
+		wdt_enable();
+		ret = 0;
+		break;
+	}
+
+	return ret;
+}
+
+static int
+ixp2000_wdt_release(struct inode *inode, struct file *file)
+{
+	if (test_bit(WDT_OK_TO_CLOSE, &wdt_status)) {
+		wdt_disable();
+	} else {
+		printk(KERN_CRIT "WATCHDOG: Device closed unexpectdly - "
+					"timer will not stop\n");
+	}
+
+	clear_bit(WDT_IN_USE, &wdt_status);
+	clear_bit(WDT_OK_TO_CLOSE, &wdt_status);
+
+	return 0;
+}
+
+
+static struct file_operations ixp2000_wdt_fops =
+{
+	.owner		= THIS_MODULE,
+	.llseek		= no_llseek,
+	.write		= ixp2000_wdt_write,
+	.ioctl		= ixp2000_wdt_ioctl,
+	.open		= ixp2000_wdt_open,
+	.release	= ixp2000_wdt_release,
+};
+
+static struct miscdevice ixp2000_wdt_miscdev =
+{
+	.minor		= WATCHDOG_MINOR,
+	.name		= "IXP2000 Watchdog",
+	.fops		= &ixp2000_wdt_fops,
+};
+
+static int __init ixp2000_wdt_init(void)
+{
+	wdt_tick_rate = (*IXP2000_T1_CLD * HZ)/ 256;;
+
+	return misc_register(&ixp2000_wdt_miscdev);
+}
+
+static void __exit ixp2000_wdt_exit(void)
+{
+	misc_deregister(&ixp2000_wdt_miscdev);
+}
+
+module_init(ixp2000_wdt_init);
+module_exit(ixp2000_wdt_exit);
+
+MODULE_AUTHOR("Deepak Saxena <dsaxena@plexity.net">);
+MODULE_DESCRIPTION("IXP2000 Network Processor Watchdog");
+
+module_param(heartbeat, int, 0);
+MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds (default 60s)");
+
+module_param(nowayout, int, 0);
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started");
+
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
+
diff -urN linux-2.6.8-rc2/drivers/fc4/soc.c linux-2.6.8-rc3/drivers/fc4/soc.c
--- linux-2.6.8-rc2/drivers/fc4/soc.c	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/drivers/fc4/soc.c	2004-08-03 15:21:38.788811174 -0700
@@ -714,7 +714,7 @@
 static int __init soc_probe(void)
 {
 	struct sbus_bus *sbus;
-	struct sbus_dev *sdev = 0;
+	struct sbus_dev *sdev = NULL;
 	struct soc *s;
 	int cards = 0;
 
diff -urN linux-2.6.8-rc2/drivers/fc4/socal.c linux-2.6.8-rc3/drivers/fc4/socal.c
--- linux-2.6.8-rc2/drivers/fc4/socal.c	2004-06-15 22:19:17.000000000 -0700
+++ linux-2.6.8-rc3/drivers/fc4/socal.c	2004-08-03 15:21:38.789811215 -0700
@@ -851,7 +851,7 @@
 static int __init socal_probe(void)
 {
 	struct sbus_bus *sbus;
-	struct sbus_dev *sdev = 0;
+	struct sbus_dev *sdev = NULL;
 	struct socal *s;
 	int cards = 0;
 
diff -urN linux-2.6.8-rc2/drivers/firmware/pcdp.c linux-2.6.8-rc3/drivers/firmware/pcdp.c
--- linux-2.6.8-rc2/drivers/firmware/pcdp.c	2004-08-03 15:21:07.056509581 -0700
+++ linux-2.6.8-rc3/drivers/firmware/pcdp.c	2004-08-03 15:21:38.842813389 -0700
@@ -1,10 +1,14 @@
 /*
- * Copyright (C) 2002, 2003, 2004 Hewlett-Packard Co.
- *	Khalid Aziz <khalid_aziz@hp.com>
+ * Parse the EFI PCDP table to locate the console device.
+ *
+ * (c) Copyright 2002, 2003, 2004 Hewlett-Packard Development Company, L.P.
+ *	Khalid Aziz <khalid.aziz@hp.com>
  *	Alex Williamson <alex.williamson@hp.com>
  *	Bjorn Helgaas <bjorn.helgaas@hp.com>
  *
- * Parse the EFI PCDP table to locate the console device.
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include <linux/acpi.h>
diff -urN linux-2.6.8-rc2/drivers/firmware/pcdp.h linux-2.6.8-rc3/drivers/firmware/pcdp.h
--- linux-2.6.8-rc2/drivers/firmware/pcdp.h	2004-08-03 15:21:07.057509622 -0700
+++ linux-2.6.8-rc3/drivers/firmware/pcdp.h	2004-08-03 15:21:38.882815030 -0700
@@ -1,12 +1,16 @@
 /*
- * Copyright (C) 2002, 2004 Hewlett-Packard Co.
- *	Khalid Aziz <khalid_aziz@hp.com>
- *	Bjorn Helgaas <bjorn.helgaas@hp.com>
- *
  * Definitions for PCDP-defined console devices
  *
  * v1.0a: http://www.dig64.org/specifications/DIG64_HCDPv10a_01.pdf
  * v2.0:  http://www.dig64.org/specifications/DIG64_HCDPv20_042804.pdf
+ *
+ * (c) Copyright 2002, 2004 Hewlett-Packard Development Company, L.P.
+ *	Khalid Aziz <khalid.aziz@hp.com>
+ *	Bjorn Helgaas <bjorn.helgaas@hp.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #define PCDP_CONSOLE			0
diff -urN linux-2.6.8-rc2/drivers/i2c/busses/i2c-rpx.c linux-2.6.8-rc3/drivers/i2c/busses/i2c-rpx.c
--- linux-2.6.8-rc2/drivers/i2c/busses/i2c-rpx.c	2004-08-03 15:21:07.059509704 -0700
+++ linux-2.6.8-rc3/drivers/i2c/busses/i2c-rpx.c	2004-08-03 15:21:38.944817573 -0700
@@ -50,9 +50,8 @@
 	/* Allocate space for two transmit and two receive buffer
 	 * descriptors in the DP ram.
 	 */
-	data->dp_addr = m8xx_cpm_dpram_offset(m8xx_cpm_dpalloc(sizeof(cbd_t)
-				* 4));
-
+	data->dp_addr = cpm_dpalloc(sizeof(cbd_t) * 4, 8);
+		
 	/* ptr to i2c area */
 	data->i2c = (i2c8xx_t *)&(((immap_t *)IMAP_ADDR)->im_i2c);
 }
diff -urN linux-2.6.8-rc2/drivers/i2c/chips/Kconfig linux-2.6.8-rc3/drivers/i2c/chips/Kconfig
--- linux-2.6.8-rc2/drivers/i2c/chips/Kconfig	2004-08-03 15:21:07.077510441 -0700
+++ linux-2.6.8-rc3/drivers/i2c/chips/Kconfig	2004-08-03 15:21:38.953817943 -0700
@@ -193,7 +193,7 @@
 
 config SENSORS_VIA686A
 	tristate "VIA686A"
-	depends on I2C && EXPERIMENTAL
+	depends on I2C && PCI && EXPERIMENTAL
 	select I2C_SENSOR
 	select I2C_ISA
 	help
diff -urN linux-2.6.8-rc2/drivers/ide/Kconfig linux-2.6.8-rc3/drivers/ide/Kconfig
--- linux-2.6.8-rc2/drivers/ide/Kconfig	2004-08-03 15:21:07.098511302 -0700
+++ linux-2.6.8-rc3/drivers/ide/Kconfig	2004-08-03 15:21:39.010820281 -0700
@@ -753,7 +753,7 @@
 
 config BLK_DEV_IDE_PMAC
 	bool "Builtin PowerMac IDE support"
-	depends on PPC_PMAC
+	depends on PPC_PMAC && IDE=y
 	help
 	  This driver provides support for the built-in IDE controller on
 	  most of the recent Apple Power Macintoshes and PowerBooks.
diff -urN linux-2.6.8-rc2/drivers/ide/ide-cd.c linux-2.6.8-rc3/drivers/ide/ide-cd.c
--- linux-2.6.8-rc2/drivers/ide/ide-cd.c	2004-08-03 15:21:07.101511425 -0700
+++ linux-2.6.8-rc3/drivers/ide/ide-cd.c	2004-08-03 15:21:39.013820404 -0700
@@ -1959,13 +1959,17 @@
 	 * sg request
 	 */
 	if (rq->bio) {
-		if (rq->data_len & 3) {
-			printk("%s: block pc not aligned, len=%d\n", drive->name, rq->data_len);
-			cdrom_end_request(drive, 0);
-			return ide_stopped;
-		}
-		info->dma = drive->using_dma;
+		int mask = drive->queue->dma_alignment;
+		unsigned long addr = (unsigned long) page_address(bio_page(rq->bio));
+
 		info->cmd = rq_data_dir(rq);
+		info->dma = drive->using_dma;
+
+		/*
+		 * check if dma is safe
+		 */
+		if ((rq->data_len & mask) || (addr & mask))
+			info->dma = 0;
 	}
 
 	/* Start sending the command to the drive. */
@@ -3133,7 +3137,7 @@
 	int nslots;
 
 	blk_queue_prep_rq(drive->queue, ide_cdrom_prep_fn);
-	blk_queue_dma_alignment(drive->queue, 3);
+	blk_queue_dma_alignment(drive->queue, 31);
 	drive->queue->unplug_delay = (1 * HZ) / 1000;
 	if (!drive->queue->unplug_delay)
 		drive->queue->unplug_delay = 1;
diff -urN linux-2.6.8-rc2/drivers/ide/pci/hpt366.c linux-2.6.8-rc3/drivers/ide/pci/hpt366.c
--- linux-2.6.8-rc2/drivers/ide/pci/hpt366.c	2004-08-03 15:21:07.125512408 -0700
+++ linux-2.6.8-rc3/drivers/ide/pci/hpt366.c	2004-08-03 15:21:39.054822086 -0700
@@ -1,8 +1,9 @@
 /*
- * linux/drivers/ide/pci/hpt366.c		Version 0.34	Sept 17, 2002
+ * linux/drivers/ide/pci/hpt366.c		Version 0.36	April 25, 2003
  *
  * Copyright (C) 1999-2003		Andre Hedrick <andre@linux-ide.org>
  * Portions Copyright (C) 2001	        Sun Microsystems, Inc.
+ * Portions Copyright (C) 2003		Red Hat Inc
  *
  * Thanks to HighPoint Technologies for their assistance, and hardware.
  * Special Thanks to Jon Burchmore in SanDiego for the deep pockets, his
@@ -39,6 +40,13 @@
  * Reset the hpt366 on error, reset on dma
  * Fix disabling Fast Interrupt hpt366.
  * 	Mike Waychison <crlf@sun.com>
+ *
+ * Added support for 372N clocking and clock switching. The 372N needs
+ * different clocks on read/write. This requires overloading rw_disk and
+ * other deeply crazy things. Thanks to <http://www.hoerstreich.de> for
+ * keeping me sane. 
+ *		Alan Cox <alan@redhat.com>
+ *
  */
 
 
@@ -168,6 +176,9 @@
 	class_rev &= 0xff;
 
 	switch(dev->device) {
+		/* Remap new 372N onto 372 */
+		case PCI_DEVICE_ID_TTI_HPT372N:
+			class_rev = PCI_DEVICE_ID_TTI_HPT372; break;
 		case PCI_DEVICE_ID_TTI_HPT374:
 			class_rev = PCI_DEVICE_ID_TTI_HPT374; break;
 		case PCI_DEVICE_ID_TTI_HPT371:
@@ -217,6 +228,11 @@
 	return mode;
 }
 
+/*
+ *	Note for the future; the SATA hpt37x we must set
+ *	either PIO or UDMA modes 0,4,5
+ */
+ 
 static u8 hpt3xx_ratefilter (ide_drive_t *drive, u8 speed)
 {
 	struct pci_dev *dev	= HWIF(drive)->pci_dev;
@@ -672,6 +688,69 @@
 	return __ide_dma_end(drive);
 }
 
+/**
+ *	hpt372n_set_clock	-	perform clock switching dance
+ *	@drive: Drive to switch
+ *	@mode: Switching mode (0x21 for write, 0x23 otherwise)
+ *
+ *	Switch the DPLL clock on the HPT372N devices. This is a
+ *	right mess.
+ */
+ 
+static void hpt372n_set_clock(ide_drive_t *drive, int mode)
+{
+	ide_hwif_t *hwif	= HWIF(drive);
+	
+	/* FIXME: should we check for DMA active and BUG() */
+	/* Tristate the bus */
+	outb(0x80, hwif->dma_base+0x73);
+	outb(0x80, hwif->dma_base+0x77);
+	
+	/* Switch clock and reset channels */
+	outb(mode, hwif->dma_base+0x7B);
+	outb(0xC0, hwif->dma_base+0x79);
+	
+	/* Reset state machines */
+	outb(0x37, hwif->dma_base+0x70);
+	outb(0x37, hwif->dma_base+0x74);
+	
+	/* Complete reset */
+	outb(0x00, hwif->dma_base+0x79);
+	
+	/* Reconnect channels to bus */
+	outb(0x00, hwif->dma_base+0x73);
+	outb(0x00, hwif->dma_base+0x77);
+}
+
+/**
+ *	hpt372n_rw_disk		-	wrapper for I/O
+ *	@drive: drive for command
+ *	@rq: block request structure
+ *	@block: block number
+ *
+ *	This is called when a disk I/O is issued to the 372N instead
+ *	of the default functionality. We need it because of the clock
+ *	switching
+ *
+ */
+ 
+static ide_startstop_t hpt372n_rw_disk(ide_drive_t *drive, struct request *rq, sector_t block)
+{
+	int wantclock;
+	
+	if(rq_data_dir(rq) == READ)
+		wantclock = 0x21;
+	else
+		wantclock = 0x23;
+		
+	if(HWIF(drive)->config_data != wantclock)
+	{
+		hpt372n_set_clock(drive, wantclock);
+		HWIF(drive)->config_data = wantclock;
+	}
+	return __ide_do_rw_disk(drive, rq, block);
+}
+
 /*
  * Since SUN Cobalt is attempting to do this operation, I should disclose
  * this has been a long time ago Thu Jul 27 16:40:57 2000 was the patch date
@@ -793,13 +872,23 @@
 	u16 freq;
 	u32 pll;
 	u8 reg5bh;
-
-#if 1
 	u8 reg5ah = 0;
+	unsigned long dmabase = pci_resource_start(dev, 4);
+	u8 did, rid;	
+	int is_372n = 0;
+	
 	pci_read_config_byte(dev, 0x5a, &reg5ah);
 	/* interrupt force enable */
 	pci_write_config_byte(dev, 0x5a, (reg5ah & ~0x10));
-#endif
+
+	if(dmabase)
+	{
+		did = inb(dmabase + 0x22);
+		rid = inb(dmabase + 0x28);
+	
+		if((did == 4 && rid == 6) || (did == 5 && rid > 1))
+			is_372n = 1;
+	}
 
 	/*
 	 * default to pci clock. make sure MA15/16 are set to output
@@ -810,47 +899,86 @@
 	/*
 	 * set up the PLL. we need to adjust it so that it's stable. 
 	 * freq = Tpll * 192 / Tpci
+	 *
+	 * Todo. For non x86 should probably check the dword is
+	 * set to 0xABCDExxx indicating the BIOS saved f_CNT
 	 */
 	pci_read_config_word(dev, 0x78, &freq);
 	freq &= 0x1FF;
-	if (freq < 0xa0) {
-		pll = F_LOW_PCI_33;
-		if (hpt_minimum_revision(dev,8))
-			pci_set_drvdata(dev, (void *) thirty_three_base_hpt374);
-		else if (hpt_minimum_revision(dev,5))
-			pci_set_drvdata(dev, (void *) thirty_three_base_hpt372);
-		else if (hpt_minimum_revision(dev,4))
-			pci_set_drvdata(dev, (void *) thirty_three_base_hpt370a);
+	
+	/*
+	 * The 372N uses different PCI clock information and has
+	 * some other complications
+	 *	On PCI33 timing we must clock switch
+	 *	On PCI66 timing we must NOT use the PCI clock
+	 *
+	 * Currently we always set up the PLL for the 372N
+	 */
+	 
+	pci_set_drvdata(dev, NULL);
+	
+	if(is_372n)
+	{
+		printk(KERN_INFO "hpt: HPT372N detected, using 372N timing.\n");
+		if(freq < 0x55)
+			pll = F_LOW_PCI_33;
+		else if(freq < 0x70)
+			pll = F_LOW_PCI_40;
+		else if(freq < 0x7F)
+			pll = F_LOW_PCI_50;
 		else
-			pci_set_drvdata(dev, (void *) thirty_three_base_hpt370);
-		printk("HPT37X: using 33MHz PCI clock\n");
-	} else if (freq < 0xb0) {
-		pll = F_LOW_PCI_40;
-	} else if (freq < 0xc8) {
-		pll = F_LOW_PCI_50;
-		if (hpt_minimum_revision(dev,8))
-			pci_set_drvdata(dev, NULL);
-		else if (hpt_minimum_revision(dev,5))
-			pci_set_drvdata(dev, (void *) fifty_base_hpt372);
-		else if (hpt_minimum_revision(dev,4))
-			pci_set_drvdata(dev, (void *) fifty_base_hpt370a);
+			pll = F_LOW_PCI_66;
+			
+		printk(KERN_INFO "FREQ: %d PLL: %d\n", freq, pll);
+			
+		/* We always use the pll not the PCI clock on 372N */
+	}
+	else
+	{
+		if(freq < 0x9C)
+			pll = F_LOW_PCI_33;
+		else if(freq < 0xb0)
+			pll = F_LOW_PCI_40;
+		else if(freq <0xc8)
+			pll = F_LOW_PCI_50;
 		else
-			pci_set_drvdata(dev, (void *) fifty_base_hpt370a);
-		printk("HPT37X: using 50MHz PCI clock\n");
-	} else {
-		pll = F_LOW_PCI_66;
-		if (hpt_minimum_revision(dev,8))
-		{
-			printk(KERN_ERR "HPT37x: 66MHz timings are not supported.\n");
-			pci_set_drvdata(dev, NULL);
+			pll = F_LOW_PCI_66;
+	
+		if (pll == F_LOW_PCI_33) {
+			if (hpt_minimum_revision(dev,8))
+				pci_set_drvdata(dev, (void *) thirty_three_base_hpt374);
+			else if (hpt_minimum_revision(dev,5))
+				pci_set_drvdata(dev, (void *) thirty_three_base_hpt372);
+			else if (hpt_minimum_revision(dev,4))
+				pci_set_drvdata(dev, (void *) thirty_three_base_hpt370a);
+			else
+				pci_set_drvdata(dev, (void *) thirty_three_base_hpt370);
+			printk("HPT37X: using 33MHz PCI clock\n");
+		} else if (pll == F_LOW_PCI_40) {
+			/* Unsupported */
+		} else if (pll == F_LOW_PCI_50) {
+			if (hpt_minimum_revision(dev,8))
+				pci_set_drvdata(dev, NULL);
+			else if (hpt_minimum_revision(dev,5))
+				pci_set_drvdata(dev, (void *) fifty_base_hpt372);
+			else if (hpt_minimum_revision(dev,4))
+				pci_set_drvdata(dev, (void *) fifty_base_hpt370a);
+			else
+				pci_set_drvdata(dev, (void *) fifty_base_hpt370a);
+			printk("HPT37X: using 50MHz PCI clock\n");
+		} else {
+			if (hpt_minimum_revision(dev,8))
+			{
+				printk(KERN_ERR "HPT37x: 66MHz timings are not supported.\n");
+			}
+			else if (hpt_minimum_revision(dev,5))
+				pci_set_drvdata(dev, (void *) sixty_six_base_hpt372);
+			else if (hpt_minimum_revision(dev,4))
+				pci_set_drvdata(dev, (void *) sixty_six_base_hpt370a);
+			else
+				pci_set_drvdata(dev, (void *) sixty_six_base_hpt370);
+			printk("HPT37X: using 66MHz PCI clock\n");
 		}
-		else if (hpt_minimum_revision(dev,5))
-			pci_set_drvdata(dev, (void *) sixty_six_base_hpt372);
-		else if (hpt_minimum_revision(dev,4))
-			pci_set_drvdata(dev, (void *) sixty_six_base_hpt370a);
-		else
-			pci_set_drvdata(dev, (void *) sixty_six_base_hpt370);
-		printk("HPT37X: using 66MHz PCI clock\n");
 	}
 	
 	/*
@@ -863,6 +991,11 @@
 	if (pci_get_drvdata(dev)) 
 		goto init_hpt37X_done;
 	
+	if (hpt_minimum_revision(dev,8))
+	{
+		printk(KERN_ERR "HPT374: Only 33MHz PCI timings are supported.\n");
+		return -EOPNOTSUPP;
+	}
 	/*
 	 * adjust PLL based upon PCI clock, enable it, and wait for
 	 * stabilization.
@@ -1000,12 +1133,27 @@
 {
 	struct pci_dev *dev		= hwif->pci_dev;
 	u8 ata66 = 0, regmask		= (hwif->channel) ? 0x01 : 0x02;
-
+	u8 did, rid;
+	unsigned long dmabase		= hwif->dma_base;
+	int is_372n = 0;
+	
+	if(dmabase)
+	{
+		did = inb(dmabase + 0x22);
+		rid = inb(dmabase + 0x28);
+	
+		if((did == 4 && rid == 6) || (did == 5 && rid > 1))
+			is_372n = 1;
+	}
+		
 	hwif->tuneproc			= &hpt3xx_tune_drive;
 	hwif->speedproc			= &hpt3xx_tune_chipset;
 	hwif->quirkproc			= &hpt3xx_quirkproc;
 	hwif->intrproc			= &hpt3xx_intrproc;
 	hwif->maskproc			= &hpt3xx_maskproc;
+	
+	if(is_372n)
+		hwif->rw_disk = &hpt372n_rw_disk;
 
 	/*
 	 * The HPT37x uses the CBLID pins as outputs for MA15/MA16
@@ -1179,7 +1327,8 @@
 	u8 pin1 = 0, pin2 = 0;
 	unsigned int class_rev;
 	char *chipset_names[] = {"HPT366", "HPT366",  "HPT368",
-				 "HPT370", "HPT370A", "HPT372"};
+				 "HPT370", "HPT370A", "HPT372",
+				 "HPT372N" };
 
 	if (PCI_FUNC(dev->devfn) & 1)
 		return;
@@ -1187,9 +1336,14 @@
 	pci_read_config_dword(dev, PCI_CLASS_REVISION, &class_rev);
 	class_rev &= 0xff;
 
-	strcpy(d->name, chipset_names[class_rev]);
+	if(dev->device == PCI_DEVICE_ID_TTI_HPT372N)
+		class_rev = 6;
+		
+	if(class_rev <= 6)
+		d->name = chipset_names[class_rev];
 
 	switch(class_rev) {
+		case 6:
 		case 5:
 		case 4:
 		case 3: ide_setup_pci_device(dev, d);
@@ -1243,6 +1397,7 @@
 	{ PCI_VENDOR_ID_TTI, PCI_DEVICE_ID_TTI_HPT302, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 2},
 	{ PCI_VENDOR_ID_TTI, PCI_DEVICE_ID_TTI_HPT371, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 3},
 	{ PCI_VENDOR_ID_TTI, PCI_DEVICE_ID_TTI_HPT374, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4},
+	{ PCI_VENDOR_ID_TTI, PCI_DEVICE_ID_TTI_HPT372N, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 5},
 	{ 0, },
 };
 MODULE_DEVICE_TABLE(pci, hpt366_pci_tbl);
diff -urN linux-2.6.8-rc2/drivers/ide/ppc/pmac.c linux-2.6.8-rc3/drivers/ide/ppc/pmac.c
--- linux-2.6.8-rc2/drivers/ide/ppc/pmac.c	2004-06-15 22:18:58.000000000 -0700
+++ linux-2.6.8-rc3/drivers/ide/ppc/pmac.c	2004-08-03 15:21:39.069822702 -0700
@@ -1126,11 +1126,9 @@
 	if (!pmif->mediabay) {
 		ppc_md.feature_call(PMAC_FTR_IDE_RESET, pmif->node, pmif->aapl_bus_id, 1);
 		ppc_md.feature_call(PMAC_FTR_IDE_ENABLE, pmif->node, pmif->aapl_bus_id, 1);
-		set_current_state(TASK_UNINTERRUPTIBLE);
-		schedule_timeout(HZ/100);
+		msleep(10);
 		ppc_md.feature_call(PMAC_FTR_IDE_RESET, pmif->node, pmif->aapl_bus_id, 0);
-		set_current_state(TASK_UNINTERRUPTIBLE);
-		schedule_timeout(IDE_WAKEUP_DELAY);
+		msleep(jiffies_to_msecs(IDE_WAKEUP_DELAY));
 	}
 
 	/* Sanitize drive timings */
@@ -1208,11 +1206,9 @@
  		/* This is necessary to enable IDE when net-booting */
 		ppc_md.feature_call(PMAC_FTR_IDE_RESET, np, pmif->aapl_bus_id, 1);
 		ppc_md.feature_call(PMAC_FTR_IDE_ENABLE, np, pmif->aapl_bus_id, 1);
-		set_current_state(TASK_UNINTERRUPTIBLE);
-		schedule_timeout(HZ/100);
+		msleep(10);
 		ppc_md.feature_call(PMAC_FTR_IDE_RESET, np, pmif->aapl_bus_id, 0);
-		set_current_state(TASK_UNINTERRUPTIBLE);
-		schedule_timeout(IDE_WAKEUP_DELAY);		
+		msleep(jiffies_to_msecs(IDE_WAKEUP_DELAY));
 	}
 
 	/* Setup MMIO ops */
diff -urN linux-2.6.8-rc2/drivers/ieee1394/Kconfig linux-2.6.8-rc3/drivers/ieee1394/Kconfig
--- linux-2.6.8-rc2/drivers/ieee1394/Kconfig	2004-06-15 22:18:52.000000000 -0700
+++ linux-2.6.8-rc3/drivers/ieee1394/Kconfig	2004-08-03 15:21:39.070822743 -0700
@@ -4,6 +4,7 @@
 
 config IEEE1394
 	tristate "IEEE 1394 (FireWire) support"
+	depends on PCI || BROKEN
 	help
 	  IEEE 1394 describes a high performance serial bus, which is also
 	  known as FireWire(tm) or i.Link(tm) and is used for connecting all
@@ -113,7 +114,7 @@
 
 config IEEE1394_SBP2
 	tristate "SBP-2 support (Harddisks etc.)"
-	depends on IEEE1394 && SCSI
+	depends on IEEE1394 && SCSI && (PCI || BROKEN)
 	help
 	  This option enables you to use SBP-2 devices connected to your IEEE
 	  1394 bus.  SBP-2 devices include harddrives and DVD devices.
diff -urN linux-2.6.8-rc2/drivers/ieee1394/dv1394.c linux-2.6.8-rc3/drivers/ieee1394/dv1394.c
--- linux-2.6.8-rc2/drivers/ieee1394/dv1394.c	2004-08-03 15:21:07.166514088 -0700
+++ linux-2.6.8-rc3/drivers/ieee1394/dv1394.c	2004-08-03 15:21:39.074822907 -0700
@@ -1322,7 +1322,7 @@
 static int dv1394_fasync(int fd, struct file *file, int on)
 {
 	/* I just copied this code verbatim from Alan Cox's mouse driver example
-	   (linux/Documentation/DocBook/) */
+	   (Documentation/DocBook/) */
 
 	struct video_card *video = file_to_video_card(file);
 
@@ -2518,7 +2518,7 @@
 	if (file->f_op->ioctl != dv1394_ioctl)
 		return -EFAULT;
 
-	if (copy_from_user(&dv32, (void *)arg, sizeof(dv32)))
+	if (copy_from_user(&dv32, (void __user *)arg, sizeof(dv32)))
 		return -EFAULT;
 
 	dv.api_version = dv32.api_version;
@@ -2568,7 +2568,7 @@
 		dv32.n_clear_frames = dv.n_clear_frames;
 		dv32.dropped_frames = dv.dropped_frames;
 
-		if (copy_to_user((struct dv1394_status32 *)arg, &dv32, sizeof(dv32)))
+		if (copy_to_user((struct dv1394_status32 __user *)arg, &dv32, sizeof(dv32)))
 			ret = -EFAULT;
 	}
 
diff -urN linux-2.6.8-rc2/drivers/ieee1394/eth1394.c linux-2.6.8-rc3/drivers/ieee1394/eth1394.c
--- linux-2.6.8-rc2/drivers/ieee1394/eth1394.c	2004-08-03 15:21:07.167514129 -0700
+++ linux-2.6.8-rc3/drivers/ieee1394/eth1394.c	2004-08-03 15:21:39.080823153 -0700
@@ -290,6 +290,20 @@
 	return 0;
 }
 
+static inline void purge_partial_datagram(struct list_head *old)
+{
+	struct partial_datagram *pd = list_entry(old, struct partial_datagram, list);
+	struct list_head *lh, *n;
+
+	list_for_each_safe(lh, n, &pd->frag_info) {
+		struct fragment_info *fi = list_entry(lh, struct fragment_info, list);
+		list_del(lh);
+		kfree(fi);
+	}
+	list_del(old);
+	kfree_skb(pd->skb);
+	kfree(pd);
+}
 
 /******************************************
  * 1394 bus activity functions
@@ -1081,21 +1095,6 @@
 	return 0;
 }
 
-static inline void purge_partial_datagram(struct list_head *old)
-{
-	struct partial_datagram *pd = list_entry(old, struct partial_datagram, list);
-	struct list_head *lh, *n;
-
-	list_for_each_safe(lh, n, &pd->frag_info) {
-		struct fragment_info *fi = list_entry(lh, struct fragment_info, list);
-		list_del(lh);
-		kfree(fi);
-	}
-	list_del(old);
-	kfree_skb(pd->skb);
-	kfree(pd);
-}
-
 static inline int is_datagram_complete(struct list_head *lh, int dg_size)
 {
 	struct partial_datagram *pd = list_entry(lh, struct partial_datagram, list);
diff -urN linux-2.6.8-rc2/drivers/ieee1394/raw1394.c linux-2.6.8-rc3/drivers/ieee1394/raw1394.c
--- linux-2.6.8-rc2/drivers/ieee1394/raw1394.c	2004-08-03 15:21:07.172514333 -0700
+++ linux-2.6.8-rc3/drivers/ieee1394/raw1394.c	2004-08-03 15:21:39.086823399 -0700
@@ -55,13 +55,8 @@
 #include "raw1394.h"
 #include "raw1394-private.h"
 
-#if BITS_PER_LONG == 64
-#define int2ptr(x) ((void __user *)x)
+#define int2ptr(x) ((void __user *)(unsigned long)x)
 #define ptr2int(x) ((u64)(unsigned long)(void __user *)x)
-#else
-#define int2ptr(x) ((void __user *)(u32)x)
-#define ptr2int(x) ((u64)(unsigned long)(void __user *)x)
-#endif
 
 #ifdef CONFIG_IEEE1394_VERBOSEDEBUG
 #define RAW1394_DEBUG
@@ -1629,7 +1624,7 @@
         if (another_host) {
                 DBGMSG("another hosts entry is valid -> SUCCESS");
                 if (copy_to_user(int2ptr(req->req.recvb),
-                        int2ptr(&addr->start),sizeof(u64))) {
+                        &addr->start,sizeof(u64))) {
                         printk(KERN_ERR "raw1394: arm_register failed "
                               " address-range-entry is invalid -> EFAULT !!!\n");
                         vfree(addr->addr_space_buffer);
diff -urN linux-2.6.8-rc2/drivers/ieee1394/video1394.c linux-2.6.8-rc3/drivers/ieee1394/video1394.c
--- linux-2.6.8-rc2/drivers/ieee1394/video1394.c	2004-08-03 15:21:07.176514497 -0700
+++ linux-2.6.8-rc3/drivers/ieee1394/video1394.c	2004-08-03 15:21:39.108824301 -0700
@@ -1003,11 +1003,9 @@
 	case VIDEO1394_IOC_TALK_QUEUE_BUFFER:
 	{
 		struct video1394_wait v;
-		struct video1394_queue_variable qv;
+		unsigned int *psizes = NULL;
 		struct dma_iso_ctx *d;
 
-		qv.packet_sizes = NULL;
-
 		if (copy_from_user(&v, argp, sizeof(v)))
 			return -EFAULT;
 
@@ -1021,22 +1019,21 @@
 		}
 
 		if (d->flags & VIDEO1394_VARIABLE_PACKET_SIZE) {
-			unsigned int *psizes;
 			int buf_size = d->nb_cmd * sizeof(unsigned int);
+			struct video1394_queue_variable __user *p = argp;
+			unsigned int __user *qv;
 
-			if (copy_from_user(&qv, argp, sizeof(qv)))
+			if (get_user(qv, &p->packet_sizes))
 				return -EFAULT;
 
 			psizes = kmalloc(buf_size, GFP_KERNEL);
 			if (!psizes)
 				return -ENOMEM;
 
-			if (copy_from_user(psizes, qv.packet_sizes, buf_size)) {
+			if (copy_from_user(psizes, qv, buf_size)) {
 				kfree(psizes);
 				return -EFAULT;
 			}
-
-			qv.packet_sizes = psizes;
 		}
 
 		spin_lock_irqsave(&d->lock,flags);
@@ -1045,14 +1042,14 @@
 			PRINT(KERN_ERR, ohci->host->id,
 			      "Buffer %d is already used",v.buffer);
 			spin_unlock_irqrestore(&d->lock,flags);
-			if (qv.packet_sizes)
-				kfree(qv.packet_sizes);
+			if (psizes)
+				kfree(psizes);
 			return -EFAULT;
 		}
 
 		if (d->flags & VIDEO1394_VARIABLE_PACKET_SIZE) {
 			initialize_dma_it_prg_var_packet_queue(
-				d, v.buffer, qv.packet_sizes,
+				d, v.buffer, psizes,
 				ohci);
 		}
 
@@ -1101,8 +1098,8 @@
 			}
 		}
 
-		if (qv.packet_sizes)
-			kfree(qv.packet_sizes);
+		if (psizes)
+			kfree(psizes);
 
 		return 0;
 
@@ -1339,6 +1336,7 @@
 static int video1394_wr_wait32(unsigned int fd, unsigned int cmd, unsigned long arg,
 			       struct file *file)
 {
+        struct video1394_wait32 __user *argp = (void __user *)arg;
         struct video1394_wait32 wait32;
         struct video1394_wait wait;
         mm_segment_t old_fs;
@@ -1347,7 +1345,7 @@
 	if (file->f_op->ioctl != video1394_ioctl)
 		return -EFAULT;
 
-        if (copy_from_user(&wait32, (void *)arg, sizeof(wait32)))
+        if (copy_from_user(&wait32, argp, sizeof(wait32)))
                 return -EFAULT;
 
         wait.channel = wait32.channel;
@@ -1373,7 +1371,7 @@
                 wait32.filltime.tv_sec = (int)wait.filltime.tv_sec;
                 wait32.filltime.tv_usec = (int)wait.filltime.tv_usec;
 
-                if (copy_to_user((struct video1394_wait32 *)arg, &wait32, sizeof(wait32)))
+                if (copy_to_user(argp, &wait32, sizeof(wait32)))
                         ret = -EFAULT;
         }
 
@@ -1391,7 +1389,7 @@
 	if (file->f_op->ioctl != video1394_ioctl)
 		return -EFAULT;
 
-        if (copy_from_user(&wait32, (void *)arg, sizeof(wait32)))
+        if (copy_from_user(&wait32, (void __user *)arg, sizeof(wait32)))
                 return -EFAULT;
 
         wait.channel = wait32.channel;
diff -urN linux-2.6.8-rc2/drivers/ieee1394/video1394.h linux-2.6.8-rc3/drivers/ieee1394/video1394.h
--- linux-2.6.8-rc2/drivers/ieee1394/video1394.h	2004-06-15 22:19:42.000000000 -0700
+++ linux-2.6.8-rc3/drivers/ieee1394/video1394.h	2004-08-03 15:21:39.108824301 -0700
@@ -53,7 +53,7 @@
 struct video1394_queue_variable {
 	unsigned int channel;
 	unsigned int buffer;
-	unsigned int* packet_sizes; /* Buffer of size:
+	unsigned int __user * packet_sizes; /* Buffer of size:
 				       buf_size / packet_size  */
 };
 
diff -urN linux-2.6.8-rc2/drivers/input/joystick/analog.c linux-2.6.8-rc3/drivers/input/joystick/analog.c
--- linux-2.6.8-rc2/drivers/input/joystick/analog.c	2004-06-15 22:20:03.000000000 -0700
+++ linux-2.6.8-rc3/drivers/input/joystick/analog.c	2004-08-03 15:21:39.149825983 -0700
@@ -158,11 +158,11 @@
 
         return count;
 }
-#elif __x86_64__
+#elif defined(__x86_64__)
 #define GET_TIME(x)	rdtscl(x)
 #define DELTA(x,y)	((y)-(x))
 #define TIME_NAME	"TSC"
-#elif __alpha__
+#elif defined(__alpha__)
 #define GET_TIME(x)	do { x = get_cycles(); } while (0)
 #define DELTA(x,y)	((y)-(x))
 #define TIME_NAME	"PCC"
diff -urN linux-2.6.8-rc2/drivers/input/keyboard/sunkbd.c linux-2.6.8-rc3/drivers/input/keyboard/sunkbd.c
--- linux-2.6.8-rc2/drivers/input/keyboard/sunkbd.c	2004-06-15 22:18:37.000000000 -0700
+++ linux-2.6.8-rc3/drivers/input/keyboard/sunkbd.c	2004-08-03 15:21:39.258830455 -0700
@@ -81,8 +81,8 @@
 	char name[64];
 	char phys[32];
 	char type;
-	volatile char reset;
-	volatile char layout;
+	volatile s8 reset;
+	volatile s8 layout;
 };
 
 /*
diff -urN linux-2.6.8-rc2/drivers/input/mouse/pc110pad.c linux-2.6.8-rc3/drivers/input/mouse/pc110pad.c
--- linux-2.6.8-rc2/drivers/input/mouse/pc110pad.c	2004-06-15 22:19:11.000000000 -0700
+++ linux-2.6.8-rc3/drivers/input/mouse/pc110pad.c	2004-08-03 15:21:39.315832794 -0700
@@ -98,9 +98,9 @@
 	if (pc110pad_used++)
 		return 0;
 
-	pc110pad_interrupt(0,0,0);
-	pc110pad_interrupt(0,0,0);
-	pc110pad_interrupt(0,0,0);
+	pc110pad_interrupt(0,NULL,NULL);
+	pc110pad_interrupt(0,NULL,NULL);
+	pc110pad_interrupt(0,NULL,NULL);
 	outb(PC110PAD_ON, pc110pad_io + 2);
 	pc110pad_count = 0;
 
@@ -117,7 +117,7 @@
 
 	outb(PC110PAD_OFF, pc110pad_io + 2);
 
-	if (request_irq(pc110pad_irq, pc110pad_interrupt, 0, "pc110pad", 0))
+	if (request_irq(pc110pad_irq, pc110pad_interrupt, 0, "pc110pad", NULL))
 	{
 		release_region(pc110pad_io, 4);
 		printk(KERN_ERR "pc110pad: Unable to get irq %d.\n", pc110pad_irq);
@@ -155,7 +155,7 @@
 
 	outb(PC110PAD_OFF, pc110pad_io + 2);
 
-	free_irq(pc110pad_irq, 0);
+	free_irq(pc110pad_irq, NULL);
 	release_region(pc110pad_io, 4);
 }
 
diff -urN linux-2.6.8-rc2/drivers/isdn/hardware/avm/b1.c linux-2.6.8-rc3/drivers/isdn/hardware/avm/b1.c
--- linux-2.6.8-rc2/drivers/isdn/hardware/avm/b1.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hardware/avm/b1.c	2004-08-03 15:21:39.419837060 -0700
@@ -67,14 +67,14 @@
 
 	card = kmalloc(sizeof(*card), GFP_KERNEL);
 	if (!card)
-		return 0;
+		return NULL;
 
 	memset(card, 0, sizeof(*card));
 
         cinfo = kmalloc(sizeof(*cinfo) * nr_controllers, GFP_KERNEL);
 	if (!cinfo) {
 		kfree(card);
-		return 0;
+		return NULL;
 	}
 	memset(cinfo, 0, sizeof(*cinfo) * nr_controllers);
 
@@ -753,7 +753,7 @@
  err_kfree:
 	kfree(p);
  err:
-	return 0;
+	return NULL;
 }
 
 void avmcard_dma_free(avmcard_dmainfo *p)
diff -urN linux-2.6.8-rc2/drivers/isdn/hardware/eicon/platform.h linux-2.6.8-rc3/drivers/isdn/hardware/eicon/platform.h
--- linux-2.6.8-rc2/drivers/isdn/hardware/eicon/platform.h	2004-06-15 22:19:43.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hardware/eicon/platform.h	2004-08-03 15:21:39.517841080 -0700
@@ -1,4 +1,4 @@
-/* $Id: platform.h,v 1.37 2004/03/20 17:44:29 armin Exp $
+/* $Id: platform.h,v 1.37.4.1 2004/07/28 14:47:21 armin Exp $
  *
  * platform.h
  * 
@@ -214,10 +214,7 @@
 */
 static __inline__ void diva_os_sleep(dword mSec)
 {
-	unsigned long timeout = HZ * mSec / 1000 + 1;
-
-	set_current_state(TASK_UNINTERRUPTIBLE);
-	schedule_timeout(timeout);
+	msleep(mSec);
 }
 static __inline__ void diva_os_wait(dword mSec)
 {
diff -urN linux-2.6.8-rc2/drivers/isdn/hisax/Kconfig linux-2.6.8-rc3/drivers/isdn/hisax/Kconfig
--- linux-2.6.8-rc2/drivers/isdn/hisax/Kconfig	2004-08-03 15:21:07.253517652 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hisax/Kconfig	2004-08-03 15:21:39.519841163 -0700
@@ -110,7 +110,7 @@
 
 config HISAX_TELESPCI
 	bool "Teles PCI"
-	depends on PCI && (BROKEN || !SPARC64)
+	depends on PCI && (BROKEN || !(SPARC64 || PPC))
 	help
 	  This enables HiSax support for the Teles PCI.
 	  See <file:Documentation/isdn/README.HiSax> on how to configure it.
@@ -237,7 +237,7 @@
 
 config HISAX_NETJET
 	bool "NETjet card"
-	depends on PCI && (BROKEN || !SPARC64)
+	depends on PCI && (BROKEN || !(SPARC64 || PPC))
 	help
 	  This enables HiSax support for the NetJet from Traverse
 	  Technologies.
@@ -248,7 +248,7 @@
 
 config HISAX_NETJET_U
 	bool "NETspider U card"
-	depends on PCI && (BROKEN || !SPARC64)
+	depends on PCI && (BROKEN || !(SPARC64 || PPC))
 	help
 	  This enables HiSax support for the Netspider U interface ISDN card
 	  from Traverse Technologies.
@@ -316,7 +316,7 @@
 
 config HISAX_HFC_PCI
 	bool "HFC PCI-Bus cards"
-	depends on PCI && (BROKEN || !SPARC64)
+	depends on PCI && (BROKEN || !(SPARC64 || PPC))
 	help
 	  This enables HiSax support for the HFC-S PCI 2BDS0 based cards.
 
@@ -343,7 +343,7 @@
 
 config HISAX_ENTERNOW_PCI
 	bool "Formula-n enter:now PCI card"
-	depends on PCI && (BROKEN || !SPARC64)
+	depends on PCI && (BROKEN || !(SPARC64 || PPC))
 	help
 	  This enables HiSax support for the Formula-n enter:now PCI
 	  ISDN card.
@@ -413,7 +413,7 @@
 
 config HISAX_FRITZ_PCIPNP
 	tristate "AVM Fritz!Card PCI/PCIv2/PnP support (EXPERIMENTAL)"
-	depends on EXPERIMENTAL
+	depends on PCI && EXPERIMENTAL
 	help
 	  This enables the driver for the AVM Fritz!Card PCI,
 	  Fritz!Card PCI v2 and Fritz!Card PnP.
diff -urN linux-2.6.8-rc2/drivers/isdn/hisax/avm_pci.c linux-2.6.8-rc3/drivers/isdn/hisax/avm_pci.c
--- linux-2.6.8-rc2/drivers/isdn/hisax/avm_pci.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hisax/avm_pci.c	2004-08-03 15:21:39.520841204 -0700
@@ -729,7 +729,9 @@
 	return(0);
 }
 
+#ifdef CONFIG_PCI
 static struct pci_dev *dev_avm __initdata = NULL;
+#endif
 #ifdef __ISAPNP__
 static struct pnp_card *pnp_avm_c __initdata = NULL;
 #endif
@@ -788,7 +790,7 @@
 			printk(KERN_INFO "FritzPnP: no ISA PnP present\n");
 		}
 #endif
-#if CONFIG_PCI
+#ifdef CONFIG_PCI
 		if ((dev_avm = pci_find_device(PCI_VENDOR_ID_AVM,
 			PCI_DEVICE_ID_AVM_A1,  dev_avm))) {
 			cs->irq = dev_avm->irq;
diff -urN linux-2.6.8-rc2/drivers/isdn/hisax/callc.c linux-2.6.8-rc3/drivers/isdn/hisax/callc.c
--- linux-2.6.8-rc2/drivers/isdn/hisax/callc.c	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hisax/callc.c	2004-08-03 15:21:39.521841245 -0700
@@ -7,7 +7,7 @@
  * of the GNU General Public License, incorporated herein by reference.
  *
  * For changes and modifications please read
- * ../../../Documentation/isdn/HiSax.cert
+ * Documentation/isdn/HiSax.cert
  *
  * based on the teles driver from Jan den Ouden
  *
diff -urN linux-2.6.8-rc2/drivers/isdn/hisax/config.c linux-2.6.8-rc3/drivers/isdn/hisax/config.c
--- linux-2.6.8-rc2/drivers/isdn/hisax/config.c	2004-08-03 15:21:07.255517734 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hisax/config.c	2004-08-03 15:21:39.522841286 -0700
@@ -8,7 +8,7 @@
  * of the GNU General Public License, incorporated herein by reference.
  *
  * For changes and modifications please read
- * ../../../Documentation/isdn/HiSax.cert
+ * Documentation/isdn/HiSax.cert
  *
  * based on the teles driver from Jan den Ouden
  *
@@ -1878,6 +1878,7 @@
 	}
 }
 
+#ifdef CONFIG_PCI
 #include <linux/pci.h>
 
 static struct pci_device_id hisax_pci_tbl[] __initdata = {
@@ -1946,6 +1947,7 @@
 };
 
 MODULE_DEVICE_TABLE(pci, hisax_pci_tbl);
+#endif /* CONFIG_PCI */
 
 module_init(HiSax_init);
 module_exit(HiSax_exit);
diff -urN linux-2.6.8-rc2/drivers/isdn/hisax/diva.c linux-2.6.8-rc3/drivers/isdn/hisax/diva.c
--- linux-2.6.8-rc2/drivers/isdn/hisax/diva.c	2004-08-03 15:21:07.256517775 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hisax/diva.c	2004-08-03 15:21:39.523841327 -0700
@@ -9,7 +9,7 @@
  * of the GNU General Public License, incorporated herein by reference.
  *
  * For changes and modifications please read
- * ../../../Documentation/isdn/HiSax.cert
+ * Documentation/isdn/HiSax.cert
  *
  * Thanks to Eicon Technology for documents and information
  *
diff -urN linux-2.6.8-rc2/drivers/isdn/hisax/elsa.c linux-2.6.8-rc3/drivers/isdn/hisax/elsa.c
--- linux-2.6.8-rc2/drivers/isdn/hisax/elsa.c	2004-06-15 22:18:59.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hisax/elsa.c	2004-08-03 15:21:39.524841368 -0700
@@ -9,7 +9,7 @@
  * of the GNU General Public License, incorporated herein by reference.
  *
  * For changes and modifications please read
- * ../../../Documentation/isdn/HiSax.cert
+ * Documentation/isdn/HiSax.cert
  *
  * Thanks to    Elsa GmbH for documents and information
  *
diff -urN linux-2.6.8-rc2/drivers/isdn/hisax/hfc_2bds0.c linux-2.6.8-rc3/drivers/isdn/hisax/hfc_2bds0.c
--- linux-2.6.8-rc2/drivers/isdn/hisax/hfc_2bds0.c	2004-06-15 22:18:56.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hisax/hfc_2bds0.c	2004-08-03 15:21:39.527841491 -0700
@@ -40,7 +40,7 @@
 			byteout(cs->hw.hfcD.addr | 1, reg);
 		}
 		ret = bytein(cs->hw.hfcD.addr);
-#if HFC_REG_DEBUG
+#ifdef HFC_REG_DEBUG
 		if (cs->debug & L1_DEB_HSCX_FIFO && (data != 2))
 			debugl1(cs, "t3c RD %02x %02x", reg, ret);
 #endif
@@ -58,7 +58,7 @@
 	}
 	if (data)
 		byteout(cs->hw.hfcD.addr, value);
-#if HFC_REG_DEBUG
+#ifdef HFC_REG_DEBUG
 	if (cs->debug & L1_DEB_HSCX_FIFO && (data != HFCD_DATA_NODEB))
 		debugl1(cs, "t3c W%c %02x %02x", data ? 'D' : 'C', reg, value);
 #endif
diff -urN linux-2.6.8-rc2/drivers/isdn/hisax/hfc_pci.c linux-2.6.8-rc3/drivers/isdn/hisax/hfc_pci.c
--- linux-2.6.8-rc2/drivers/isdn/hisax/hfc_pci.c	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hisax/hfc_pci.c	2004-08-03 15:21:39.528841532 -0700
@@ -11,7 +11,7 @@
  * of the GNU General Public License, incorporated herein by reference.
  *
  * For changes and modifications please read
- * ../../../Documentation/isdn/HiSax.cert
+ * Documentation/isdn/HiSax.cert
  *
  */
 
diff -urN linux-2.6.8-rc2/drivers/isdn/hisax/isac.c linux-2.6.8-rc3/drivers/isdn/hisax/isac.c
--- linux-2.6.8-rc2/drivers/isdn/hisax/isac.c	2004-06-15 22:18:59.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hisax/isac.c	2004-08-03 15:21:39.530841614 -0700
@@ -9,7 +9,7 @@
  * of the GNU General Public License, incorporated herein by reference.
  *
  * For changes and modifications please read
- * ../../../Documentation/isdn/HiSax.cert
+ * Documentation/isdn/HiSax.cert
  *
  */
 
diff -urN linux-2.6.8-rc2/drivers/isdn/hisax/isdnl1.c linux-2.6.8-rc3/drivers/isdn/hisax/isdnl1.c
--- linux-2.6.8-rc2/drivers/isdn/hisax/isdnl1.c	2004-06-15 22:19:03.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hisax/isdnl1.c	2004-08-03 15:21:39.534841778 -0700
@@ -10,7 +10,7 @@
  * of the GNU General Public License, incorporated herein by reference.
  *
  * For changes and modifications please read
- * ../../../Documentation/isdn/HiSax.cert
+ * Documentation/isdn/HiSax.cert
  *
  * Thanks to    Jan den Ouden
  *              Fritz Elfert
diff -urN linux-2.6.8-rc2/drivers/isdn/hisax/isdnl2.c linux-2.6.8-rc3/drivers/isdn/hisax/isdnl2.c
--- linux-2.6.8-rc2/drivers/isdn/hisax/isdnl2.c	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hisax/isdnl2.c	2004-08-03 15:21:39.645846332 -0700
@@ -8,7 +8,7 @@
  * of the GNU General Public License, incorporated herein by reference.
  *
  * For changes and modifications please read
- * ../../../Documentation/isdn/HiSax.cert
+ * Documentation/isdn/HiSax.cert
  *
  * Thanks to    Jan den Ouden
  *              Fritz Elfert
diff -urN linux-2.6.8-rc2/drivers/isdn/hisax/isdnl3.c linux-2.6.8-rc3/drivers/isdn/hisax/isdnl3.c
--- linux-2.6.8-rc2/drivers/isdn/hisax/isdnl3.c	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hisax/isdnl3.c	2004-08-03 15:21:39.646846373 -0700
@@ -8,7 +8,7 @@
  * of the GNU General Public License, incorporated herein by reference.
  *
  * For changes and modifications please read
- * ../../../Documentation/isdn/HiSax.cert
+ * Documentation/isdn/HiSax.cert
  *
  * Thanks to    Jan den Ouden
  *              Fritz Elfert
diff -urN linux-2.6.8-rc2/drivers/isdn/hisax/l3_1tr6.c linux-2.6.8-rc3/drivers/isdn/hisax/l3_1tr6.c
--- linux-2.6.8-rc2/drivers/isdn/hisax/l3_1tr6.c	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hisax/l3_1tr6.c	2004-08-03 15:21:39.646846373 -0700
@@ -9,7 +9,7 @@
  * of the GNU General Public License, incorporated herein by reference.
  *
  * For changes and modifications please read
- * ../../../Documentation/isdn/HiSax.cert
+ * Documentation/isdn/HiSax.cert
  *
  */
 
diff -urN linux-2.6.8-rc2/drivers/isdn/hisax/l3dss1.c linux-2.6.8-rc3/drivers/isdn/hisax/l3dss1.c
--- linux-2.6.8-rc2/drivers/isdn/hisax/l3dss1.c	2004-06-15 22:19:17.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hisax/l3dss1.c	2004-08-03 15:21:39.648846455 -0700
@@ -12,7 +12,7 @@
  * of the GNU General Public License, incorporated herein by reference.
  *
  * For changes and modifications please read
- * ../../../Documentation/isdn/HiSax.cert
+ * Documentation/isdn/HiSax.cert
  *
  * Thanks to    Jan den Ouden
  *              Fritz Elfert
diff -urN linux-2.6.8-rc2/drivers/isdn/hisax/netjet.c linux-2.6.8-rc3/drivers/isdn/hisax/netjet.c
--- linux-2.6.8-rc2/drivers/isdn/hisax/netjet.c	2004-08-03 15:21:07.262518021 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hisax/netjet.c	2004-08-03 15:21:39.650846537 -0700
@@ -701,8 +701,8 @@
 		}
 		bcs->hw.tiger.s_tot += s_cnt;
 		if (bcs->cs->debug & L1_DEB_HSCX)
-			debugl1(bcs->cs,"tiger write_raw: c%d %x-%x %d/%d %d %x", bcs->channel,
-				(u_int)buf, (u_int)p, s_cnt, cnt,
+			debugl1(bcs->cs,"tiger write_raw: c%d %p-%p %d/%d %d %x", bcs->channel,
+				buf, p, s_cnt, cnt,
 				bcs->hw.tiger.sendcnt, bcs->cs->hw.njet.irqstat0);
 		if (bcs->cs->debug & L1_DEB_HSCX_FIFO)
 			printframe(bcs->cs, bcs->hw.tiger.sp, s_cnt, "snd");
@@ -931,8 +931,8 @@
 	cs->bcs[1].hw.tiger.s_end = cs->bcs[0].hw.tiger.s_end;
 	
 	memset(cs->bcs[0].hw.tiger.send, 0xff, NETJET_DMA_TXSIZE * sizeof(unsigned int));
-	debugl1(cs, "tiger: send buf %x - %x", (u_int)cs->bcs[0].hw.tiger.send,
-		(u_int)(cs->bcs[0].hw.tiger.send + NETJET_DMA_TXSIZE - 1));
+	debugl1(cs, "tiger: send buf %p - %p", cs->bcs[0].hw.tiger.send,
+		cs->bcs[0].hw.tiger.send + NETJET_DMA_TXSIZE - 1);
 	outl(virt_to_bus(cs->bcs[0].hw.tiger.send),
 		cs->hw.njet.base + NETJET_DMA_READ_START);
 	outl(virt_to_bus(cs->bcs[0].hw.tiger.s_irq),
@@ -945,8 +945,8 @@
 		       "HiSax: No memory for tiger.rec\n");
 		return;
 	}
-	debugl1(cs, "tiger: rec buf %x - %x", (u_int)cs->bcs[0].hw.tiger.rec,
-		(u_int)(cs->bcs[0].hw.tiger.rec + NETJET_DMA_RXSIZE - 1));
+	debugl1(cs, "tiger: rec buf %p - %p", cs->bcs[0].hw.tiger.rec,
+		cs->bcs[0].hw.tiger.rec + NETJET_DMA_RXSIZE - 1);
 	cs->bcs[1].hw.tiger.rec = cs->bcs[0].hw.tiger.rec;
 	memset(cs->bcs[0].hw.tiger.rec, 0xff, NETJET_DMA_RXSIZE * sizeof(unsigned int));
 	outl(virt_to_bus(cs->bcs[0].hw.tiger.rec),
diff -urN linux-2.6.8-rc2/drivers/isdn/hisax/st5481_d.c linux-2.6.8-rc3/drivers/isdn/hisax/st5481_d.c
--- linux-2.6.8-rc2/drivers/isdn/hisax/st5481_d.c	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hisax/st5481_d.c	2004-08-03 15:21:39.650846537 -0700
@@ -623,7 +623,7 @@
 	st5481_usb_device_ctrl_msg(adapter, FFMSK_D, 0xfc, NULL, NULL);
 	st5481_in_mode(d_in, L1_MODE_HDLC);
 
-#if LOOPBACK
+#ifdef LOOPBACK
 	// Turn loopback on (data sent on B and D looped back)
 	st5481_usb_device_ctrl_msg(cs, LBB, 0x04, NULL, NULL);
 #endif
diff -urN linux-2.6.8-rc2/drivers/isdn/hisax/tei.c linux-2.6.8-rc3/drivers/isdn/hisax/tei.c
--- linux-2.6.8-rc2/drivers/isdn/hisax/tei.c	2004-08-03 15:21:07.263518062 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hisax/tei.c	2004-08-03 15:21:39.652846619 -0700
@@ -8,7 +8,7 @@
  * of the GNU General Public License, incorporated herein by reference.
  *
  * For changes and modifications please read
- * ../../../Documentation/isdn/HiSax.cert
+ * Documentation/isdn/HiSax.cert
  *
  * Thanks to    Jan den Ouden
  *              Fritz Elfert
diff -urN linux-2.6.8-rc2/drivers/isdn/hysdn/Kconfig linux-2.6.8-rc3/drivers/isdn/hysdn/Kconfig
--- linux-2.6.8-rc2/drivers/isdn/hysdn/Kconfig	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hysdn/Kconfig	2004-08-03 15:21:39.653846660 -0700
@@ -3,7 +3,7 @@
 #
 config HYSDN
 	tristate "Hypercope HYSDN cards (Champ, Ergo, Metro) support (module only)"
-	depends on m && PROC_FS && BROKEN_ON_SMP
+	depends on m && PROC_FS && PCI && BROKEN_ON_SMP
 	help
 	  Say Y here if you have one of Hypercope's active PCI ISDN cards
 	  Champ, Ergo and Metro. You will then get a module called hysdn.
diff -urN linux-2.6.8-rc2/drivers/isdn/hysdn/hycapi.c linux-2.6.8-rc3/drivers/isdn/hysdn/hycapi.c
--- linux-2.6.8-rc2/drivers/isdn/hysdn/hycapi.c	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hysdn/hycapi.c	2004-08-03 15:21:39.654846701 -0700
@@ -96,7 +96,7 @@
 		}
 	}
 	detach_capi_ctr(ctrl);
-	ctrl->driverdata = 0;
+	ctrl->driverdata = NULL;
 	kfree(card->hyctrlinfo);
 
 		
@@ -678,7 +678,7 @@
 
 ***********************************************************/
 
-int hycapi_init()
+int hycapi_init(void)
 {
 	int i;
 	for(i=0;i<CAPI_MAXAPPL;i++) {
diff -urN linux-2.6.8-rc2/drivers/isdn/hysdn/hysdn_procconf.c linux-2.6.8-rc3/drivers/isdn/hysdn/hysdn_procconf.c
--- linux-2.6.8-rc2/drivers/isdn/hysdn/hysdn_procconf.c	2004-06-15 22:19:42.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hysdn/hysdn_procconf.c	2004-08-03 15:21:39.655846742 -0700
@@ -89,7 +89,7 @@
 /* write conf file -> boot or send cfg line to card */
 /****************************************************/
 static ssize_t
-hysdn_conf_write(struct file *file, const char *buf, size_t count, loff_t * off)
+hysdn_conf_write(struct file *file, const char __user *buf, size_t count, loff_t * off)
 {
 	struct conf_writedata *cnf;
 	int i;
@@ -209,7 +209,7 @@
 /* read conf file -> output card info data */
 /*******************************************/
 static ssize_t
-hysdn_conf_read(struct file *file, char *buf, size_t count, loff_t * off)
+hysdn_conf_read(struct file *file, char __user *buf, size_t count, loff_t * off)
 {
 	char *cp;
 	int i;
diff -urN linux-2.6.8-rc2/drivers/isdn/hysdn/hysdn_proclog.c linux-2.6.8-rc3/drivers/isdn/hysdn/hysdn_proclog.c
--- linux-2.6.8-rc2/drivers/isdn/hysdn/hysdn_proclog.c	2004-06-15 22:18:59.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/hysdn/hysdn_proclog.c	2004-08-03 15:21:39.655846742 -0700
@@ -150,7 +150,7 @@
 /* write log file -> set log level bits */
 /****************************************/
 static ssize_t
-hysdn_log_write(struct file *file, const char *buf, size_t count, loff_t * off)
+hysdn_log_write(struct file *file, const char __user *buf, size_t count, loff_t * off)
 {
 	ulong u = 0;
 	int found = 0;
@@ -203,7 +203,7 @@
 /* read log file */
 /******************/
 static ssize_t
-hysdn_log_read(struct file *file, char *buf, size_t count, loff_t * off)
+hysdn_log_read(struct file *file, char __user *buf, size_t count, loff_t * off)
 {
 	struct log_data *inf;
 	int len;
diff -urN linux-2.6.8-rc2/drivers/isdn/i4l/isdn_net.c linux-2.6.8-rc3/drivers/isdn/i4l/isdn_net.c
--- linux-2.6.8-rc2/drivers/isdn/i4l/isdn_net.c	2004-08-03 15:21:07.269518307 -0700
+++ linux-2.6.8-rc3/drivers/isdn/i4l/isdn_net.c	2004-08-03 15:21:39.660846947 -0700
@@ -1432,7 +1432,7 @@
 	unsigned long expires = 0;
 	int tmp = 0;
 	int period = lp->cisco_keepalive_period;
-	char debserint = lp->cisco_debserint;
+	s8 debserint = lp->cisco_debserint;
 	int rc = 0;
 
 	if (lp->p_encap != ISDN_NET_ENCAP_CISCOHDLCK)
diff -urN linux-2.6.8-rc2/drivers/isdn/i4l/isdn_x25iface.c linux-2.6.8-rc3/drivers/isdn/i4l/isdn_x25iface.c
--- linux-2.6.8-rc2/drivers/isdn/i4l/isdn_x25iface.c	2004-08-03 15:21:07.276518594 -0700
+++ linux-2.6.8-rc3/drivers/isdn/i4l/isdn_x25iface.c	2004-08-03 15:21:39.667847234 -0700
@@ -8,7 +8,7 @@
  * stuff needed to support the Linux X.25 PLP code on top of devices that
  * can provide a lab_b service using the concap_proto mechanism.
  * This module supports a network interface wich provides lapb_sematics
- * -- as defined in ../../Documentation/networking/x25-iface.txt -- to
+ * -- as defined in Documentation/networking/x25-iface.txt -- to
  * the upper layer and assumes that the lower layer provides a reliable
  * data link service by means of the concap_device_ops callbacks.
  *
@@ -270,7 +270,7 @@
 }
 
 /* process a frame handed over to us from linux network layer. First byte
-   semantics as defined in ../../Documentation/networking/x25-iface.txt 
+   semantics as defined in Documentation/networking/x25-iface.txt
    */
 int isdn_x25iface_xmit(struct concap_proto *cprot, struct sk_buff *skb)
 {
diff -urN linux-2.6.8-rc2/drivers/isdn/pcbit/Kconfig linux-2.6.8-rc3/drivers/isdn/pcbit/Kconfig
--- linux-2.6.8-rc2/drivers/isdn/pcbit/Kconfig	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/drivers/isdn/pcbit/Kconfig	2004-08-03 15:21:39.672847439 -0700
@@ -3,7 +3,7 @@
 #
 config ISDN_DRV_PCBIT
 	tristate "PCBIT-D support"
-	depends on ISDN_I4L && ISA
+	depends on ISDN_I4L && ISA && (BROKEN || !PPC)
 	help
 	  This enables support for the PCBIT ISDN-card.  This card is
 	  manufactured in Portugal by Octal.  For running this card,
diff -urN linux-2.6.8-rc2/drivers/isdn/tpam/tpam_memory.c linux-2.6.8-rc3/drivers/isdn/tpam/tpam_memory.c
--- linux-2.6.8-rc2/drivers/isdn/tpam/tpam_memory.c	2004-08-03 15:21:07.288519086 -0700
+++ linux-2.6.8-rc3/drivers/isdn/tpam/tpam_memory.c	2004-08-03 15:21:39.772851542 -0700
@@ -30,7 +30,7 @@
 	       card->bar0 + TPAM_PAGE_REGISTER);
 
 	/* write the value */
-	writel(val, card->bar0 + (((u32)addr) & TPAM_PAGE_SIZE));
+	writel(val, card->bar0 + (((unsigned long)addr) & TPAM_PAGE_SIZE));
 }
 
 /*
diff -urN linux-2.6.8-rc2/drivers/macintosh/Kconfig linux-2.6.8-rc3/drivers/macintosh/Kconfig
--- linux-2.6.8-rc2/drivers/macintosh/Kconfig	2004-06-15 22:19:21.000000000 -0700
+++ linux-2.6.8-rc3/drivers/macintosh/Kconfig	2004-08-03 15:21:39.790852280 -0700
@@ -118,13 +118,6 @@
 	  events; also, the PowerBook button device will be enabled so you can
 	  change the screen brightness.
 
-config MAC_FLOPPY
-	bool "Support for PowerMac floppy"
-	depends on PPC_PMAC && !PPC_PMAC64
-	help
-	  If you have a SWIM-3 (Super Woz Integrated Machine 3; from Apple)
-	  floppy controller, say Y here. Most commonly found in PowerMacs.
-
 config MAC_SERIAL
 	tristate "Support for PowerMac serial ports (OBSOLETE DRIVER)"
 	depends on PPC_PMAC && BROKEN
@@ -191,7 +184,7 @@
 	  G5 machines. 
 
 config ANSLCD
-	bool "Support for ANS LCD display"
+	tristate "Support for ANS LCD display"
 	depends on ADB_CUDA && PPC_PMAC
 
 endmenu
diff -urN linux-2.6.8-rc2/drivers/macintosh/adb.c linux-2.6.8-rc3/drivers/macintosh/adb.c
--- linux-2.6.8-rc2/drivers/macintosh/adb.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/drivers/macintosh/adb.c	2004-08-03 15:21:39.797852567 -0700
@@ -139,10 +139,9 @@
 static __inline__ void adb_wait_ms(unsigned int ms)
 {
 	if (current->pid && adb_probe_task_pid &&
-	  adb_probe_task_pid == current->pid) {
-		set_task_state(current, TASK_UNINTERRUPTIBLE);
-		schedule_timeout(1 + ms * HZ / 1000);
-	} else
+	  adb_probe_task_pid == current->pid)
+		msleep(ms);
+	else
 		mdelay(ms);
 }
 
@@ -561,7 +560,7 @@
 			write_lock_irq(&adb_handler_lock);
 		}
 		ret = 0;
-		adb_handler[index].handler = 0;
+		adb_handler[index].handler = NULL;
 	}
 	write_unlock_irq(&adb_handler_lock);
 	up(&adb_handler_sem);
diff -urN linux-2.6.8-rc2/drivers/macintosh/adbhid.c linux-2.6.8-rc3/drivers/macintosh/adbhid.c
--- linux-2.6.8-rc2/drivers/macintosh/adbhid.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/drivers/macintosh/adbhid.c	2004-08-03 15:21:39.799852649 -0700
@@ -102,7 +102,7 @@
 #define FLAG_POWER_FROM_FN	0x00000002
 #define FLAG_EMU_FWDEL_DOWN	0x00000004
 
-static struct adbhid *adbhid[16] = { 0 };
+static struct adbhid *adbhid[16];
 
 static void adbhid_probe(void);
 
@@ -689,7 +689,7 @@
 	if (adbhid[id]->keycode)
 		kfree(adbhid[id]->keycode);
 	kfree(adbhid[id]);
-	adbhid[id] = 0;
+	adbhid[id] = NULL;
 }
 
 
diff -urN linux-2.6.8-rc2/drivers/macintosh/ans-lcd.c linux-2.6.8-rc3/drivers/macintosh/ans-lcd.c
--- linux-2.6.8-rc2/drivers/macintosh/ans-lcd.c	2004-06-15 22:20:25.000000000 -0700
+++ linux-2.6.8-rc3/drivers/macintosh/ans-lcd.c	2004-08-03 15:21:39.800852690 -0700
@@ -49,10 +49,10 @@
 }
 
 static ssize_t __pmac
-anslcd_write( struct file * file, const char * buf, 
+anslcd_write( struct file * file, const char __user * buf, 
 				size_t count, loff_t *ppos )
 {
-	const char * p = buf;
+	const char __user *p = buf;
 	int i;
 
 #ifdef DEBUG
@@ -75,7 +75,7 @@
 anslcd_ioctl( struct inode * inode, struct file * file,
 				unsigned int cmd, unsigned long arg )
 {
-	char ch, *temp;
+	char ch, __user *temp;
 
 #ifdef DEBUG
 	printk(KERN_DEBUG "LCD: ioctl(%d,%d)\n",cmd,arg);
@@ -91,7 +91,7 @@
 		anslcd_write_byte_ctrl ( 0x02 );
 		return 0;
 	case ANSLCD_SENDCTRL:
-		temp = (char *) arg;
+		temp = (char __user *) arg;
 		__get_user(ch, temp);
 		for (; ch; temp++) { /* FIXME: This is ugly, but should work, as a \0 byte is not a valid command code */
 			anslcd_write_byte_ctrl ( ch );
@@ -136,7 +136,7 @@
 				"*    Welcome to    *"  /* Line #2 */
 				"********************"; /* Line #4 */
 
-int __init
+static int __init
 anslcd_init(void)
 {
 	int a;
@@ -173,5 +173,12 @@
 	return 0;
 }
 
-__initcall(anslcd_init);
+static void __exit
+anslcd_exit(void)
+{
+	misc_deregister(&anslcd_dev);
+	iounmap(anslcd_ptr);
+}
 
+module_init(anslcd_init);
+module_exit(anslcd_exit);
diff -urN linux-2.6.8-rc2/drivers/macintosh/macio-adb.c linux-2.6.8-rc3/drivers/macintosh/macio-adb.c
--- linux-2.6.8-rc2/drivers/macintosh/macio-adb.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/drivers/macintosh/macio-adb.c	2004-08-03 15:21:39.800852690 -0700
@@ -175,7 +175,7 @@
 		req->data[i] = req->data[i+1];
 	--req->nbytes;
 	
-	req->next = 0;
+	req->next = NULL;
 	req->sent = 0;
 	req->complete = 0;
 	req->reply_len = 0;
@@ -280,6 +280,6 @@
 
 	local_irq_save(flags);
 	if (in_8(&adb->intr.r) != 0)
-		macio_adb_interrupt(0, 0, 0);
+		macio_adb_interrupt(0, NULL, NULL);
 	local_irq_restore(flags);
 }
diff -urN linux-2.6.8-rc2/drivers/macintosh/macserial.c linux-2.6.8-rc3/drivers/macintosh/macserial.c
--- linux-2.6.8-rc2/drivers/macintosh/macserial.c	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/drivers/macintosh/macserial.c	2004-08-03 15:21:39.806852937 -0700
@@ -158,10 +158,6 @@
 static void rxdma_start(struct mac_serial * info, int current);
 static void rxdma_to_tty(struct mac_serial * info);
 
-#ifndef MIN
-#define MIN(a,b)	((a) < (b) ? (a) : (b))
-#endif
-
 /*
  * tmp_buf is used as a temporary buffer by serial_write.  We need to
  * lock it in case the copy_from_user blocks while swapping in a page,
@@ -1485,9 +1481,8 @@
 	if (from_user) {
 		down(&tmp_buf_sem);
 		while (1) {
-			c = MIN(count,
-				MIN(SERIAL_XMIT_SIZE - info->xmit_cnt - 1,
-				    SERIAL_XMIT_SIZE - info->xmit_head));
+			c = min_t(int, count, min(SERIAL_XMIT_SIZE - info->xmit_cnt - 1,
+						  SERIAL_XMIT_SIZE - info->xmit_head));
 			if (c <= 0)
 				break;
 
@@ -1498,8 +1493,8 @@
 				break;
 			}
 			spin_lock_irqsave(&info->lock, flags);
-			c = MIN(c, MIN(SERIAL_XMIT_SIZE - info->xmit_cnt - 1,
-				       SERIAL_XMIT_SIZE - info->xmit_head));
+			c = min_t(int, c, min(SERIAL_XMIT_SIZE - info->xmit_cnt - 1,
+					      SERIAL_XMIT_SIZE - info->xmit_head));
 			memcpy(info->xmit_buf + info->xmit_head, tmp_buf, c);
 			info->xmit_head = ((info->xmit_head + c) &
 					   (SERIAL_XMIT_SIZE-1));
@@ -1513,9 +1508,8 @@
 	} else {
 		while (1) {
 			spin_lock_irqsave(&info->lock, flags);
-			c = MIN(count,
-				MIN(SERIAL_XMIT_SIZE - info->xmit_cnt - 1,
-				    SERIAL_XMIT_SIZE - info->xmit_head));
+			c = min_t(int, count, min(SERIAL_XMIT_SIZE - info->xmit_cnt - 1,
+						  SERIAL_XMIT_SIZE - info->xmit_head));
 			if (c <= 0) {
 				spin_unlock_irqrestore(&info->lock, flags);
 				break;
@@ -2052,7 +2046,7 @@
 	} else if (char_time == 0)
 		char_time = 1;
 	if (timeout)
-		char_time = MIN(char_time, timeout);
+		char_time = min_t(unsigned long, char_time, timeout);
 	while ((read_zsreg(info->zs_channel, 1) & ALL_SNT) == 0) {
 		current->state = TASK_INTERRUPTIBLE;
 		schedule_timeout(char_time);
diff -urN linux-2.6.8-rc2/drivers/macintosh/mediabay.c linux-2.6.8-rc3/drivers/macintosh/mediabay.c
--- linux-2.6.8-rc2/drivers/macintosh/mediabay.c	2004-06-15 22:19:02.000000000 -0700
+++ linux-2.6.8-rc3/drivers/macintosh/mediabay.c	2004-08-03 15:21:39.814853265 -0700
@@ -435,6 +435,7 @@
 #endif /* CONFIG_BLK_DEV_IDE */
 	return -ENODEV;
 }
+EXPORT_SYMBOL(check_media_bay);
 
 int __pmac check_media_bay_by_base(unsigned long base, int what)
 {
@@ -686,15 +687,13 @@
 
 	/* Force an immediate detect */
 	set_mb_power(bay, 0);
-	set_current_state(TASK_UNINTERRUPTIBLE);
-	schedule_timeout(MS_TO_HZ(MB_POWER_DELAY));
+	msleep(MB_POWER_DELAY);
 	bay->content_id = MB_NO;
 	bay->last_value = bay->ops->content(bay);
 	bay->value_count = MS_TO_HZ(MB_STABLE_DELAY);
 	bay->state = mb_empty;
 	do {
-		set_current_state(TASK_UNINTERRUPTIBLE);
-		schedule_timeout(MS_TO_HZ(MB_POLL_DELAY));
+		msleep(MB_POLL_DELAY);
 		media_bay_step(i);
 	} while((bay->state != mb_empty) &&
 		(bay->state != mb_up));
@@ -719,8 +718,7 @@
 		bay->sleeping = 1;
 		set_mb_power(bay, 0);
 		up(&bay->lock);
-		set_current_state(TASK_UNINTERRUPTIBLE);
-		schedule_timeout(MS_TO_HZ(MB_POLL_DELAY));
+		msleep(MB_POLL_DELAY);
 		mdev->ofdev.dev.power_state = state;
 	}
 	return 0;
@@ -740,8 +738,7 @@
 	       	/* Force MB power to 0 */
 		down(&bay->lock);
 	       	set_mb_power(bay, 0);
-		set_current_state(TASK_UNINTERRUPTIBLE);
-		schedule_timeout(MS_TO_HZ(MB_POWER_DELAY));
+		msleep(MB_POWER_DELAY);
 	       	if (bay->ops->content(bay) != bay->content_id) {
 			printk("mediabay%d: content changed during sleep...\n", bay->index);
 			up(&bay->lock);
@@ -755,8 +752,7 @@
 	       	bay->cd_retry = 0;
 #endif
 	       	do {
-			set_current_state(TASK_UNINTERRUPTIBLE);
-			schedule_timeout(MS_TO_HZ(MB_POLL_DELAY));
+			msleep(MB_POLL_DELAY);
 	       		media_bay_step(bay->index);
 	       	} while((bay->state != mb_empty) &&
 	       		(bay->state != mb_up));
diff -urN linux-2.6.8-rc2/drivers/macintosh/therm_pm72.c linux-2.6.8-rc3/drivers/macintosh/therm_pm72.c
--- linux-2.6.8-rc2/drivers/macintosh/therm_pm72.c	2004-06-15 22:19:44.000000000 -0700
+++ linux-2.6.8-rc3/drivers/macintosh/therm_pm72.c	2004-08-03 15:21:39.816853347 -0700
@@ -317,6 +317,20 @@
 	return nw;
 }
 
+static int start_fcu(void)
+{
+	unsigned char buf = 0xff;
+	int rc;
+
+	rc = fan_write_reg(0xe, &buf, 1);
+	if (rc < 0)
+		return -EIO;
+	rc = fan_write_reg(0x2e, &buf, 1);
+	if (rc < 0)
+		return -EIO;
+	return 0;
+}
+
 static int set_rpm_fan(int fan, int rpm)
 {
 	unsigned char buf[2];
@@ -1011,6 +1025,12 @@
 
 	down(&driver_lock);
 
+	if (start_fcu() < 0) {
+		printk(KERN_ERR "kfand: failed to start FCU\n");
+		up(&driver_lock);
+		goto out;
+	}
+
 	/* Set the PCI fan once for now */
 	set_pwm_fan(SLOTS_FAN_PWM_ID, SLOTS_FAN_DEFAULT_PWM);
 
@@ -1057,6 +1077,7 @@
 			schedule_timeout(HZ - elapsed);
 	}
 
+ out:
 	DBG("main_control_loop ended\n");
 
 	ctrl_task = 0;
diff -urN linux-2.6.8-rc2/drivers/macintosh/via-cuda.c linux-2.6.8-rc3/drivers/macintosh/via-cuda.c
--- linux-2.6.8-rc2/drivers/macintosh/via-cuda.c	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/drivers/macintosh/via-cuda.c	2004-08-03 15:21:39.818853429 -0700
@@ -386,7 +386,7 @@
 	req->complete = 1;
 	return -EINVAL;
     }
-    req->next = 0;
+    req->next = NULL;
     req->sent = 0;
     req->complete = 0;
     req->reply_len = 0;
@@ -437,7 +437,7 @@
      * disable_irq(), would that work on m68k ? --BenH
      */
     local_irq_save(flags);
-    cuda_interrupt(0, 0, 0);
+    cuda_interrupt(0, NULL, NULL);
     local_irq_restore(flags);
 }
 
diff -urN linux-2.6.8-rc2/drivers/macintosh/via-pmu.c linux-2.6.8-rc3/drivers/macintosh/via-pmu.c
--- linux-2.6.8-rc2/drivers/macintosh/via-pmu.c	2004-06-15 22:20:03.000000000 -0700
+++ linux-2.6.8-rc3/drivers/macintosh/via-pmu.c	2004-08-03 15:21:39.822853593 -0700
@@ -492,7 +492,7 @@
 	}
 #endif /* CONFIG_PMAC_PBOOK */
 	/* Create /proc/pmu */
-	proc_pmu_root = proc_mkdir("pmu", 0);
+	proc_pmu_root = proc_mkdir("pmu", NULL);
 	if (proc_pmu_root) {
 		int i;
 		proc_pmu_info = create_proc_read_entry("info", 0, proc_pmu_root,
@@ -549,7 +549,7 @@
 		}
 		if (pmu_state == idle)
 			adb_int_pending = 1;
-		via_pmu_interrupt(0, 0, 0);
+		via_pmu_interrupt(0, NULL, NULL);
 		udelay(10);
 	}
 
@@ -1122,7 +1122,7 @@
 		return -EINVAL;
 	}
 
-	req->next = 0;
+	req->next = NULL;
 	req->sent = 0;
 	req->complete = 0;
 
@@ -1225,7 +1225,7 @@
 		return;
 	if (disable_poll)
 		return;
-	via_pmu_interrupt(0, 0, 0);
+	via_pmu_interrupt(0, NULL, NULL);
 }
 
 void __openfirmware
@@ -1238,7 +1238,7 @@
 	/* Kicks ADB read when PMU is suspended */
 	adb_int_pending = 1;
 	do {
-		via_pmu_interrupt(0, 0, 0);
+		via_pmu_interrupt(0, NULL, NULL);
 	} while (pmu_suspended && (adb_int_pending || pmu_state != idle
 		|| req_awaiting_reply));
 }
@@ -1249,7 +1249,7 @@
 	if (!via)
 		return;
 	while((pmu_state != idle && pmu_state != locked) || !req->complete)
-		via_pmu_interrupt(0, 0, 0);
+		via_pmu_interrupt(0, NULL, NULL);
 }
 
 /* This function loops until the PMU is idle and prevents it from
@@ -1278,7 +1278,7 @@
 		spin_unlock_irqrestore(&pmu_lock, flags);
 		if (req_awaiting_reply)
 			adb_int_pending = 1;
-		via_pmu_interrupt(0, 0, 0);
+		via_pmu_interrupt(0, NULL, NULL);
 		spin_lock_irqsave(&pmu_lock, flags);
 		if (!adb_int_pending && pmu_state == idle && !req_awaiting_reply) {
 #ifdef SUSPEND_USES_PMU
@@ -1377,7 +1377,7 @@
 				printk(KERN_ERR "PMU: extra ADB reply\n");
 				return;
 			}
-			req_awaiting_reply = 0;
+			req_awaiting_reply = NULL;
 			if (len <= 2)
 				req->reply_len = 0;
 			else {
@@ -1662,7 +1662,7 @@
 		pmu_irq_stats[1]++;
 		adb_int_pending = 1;
 		spin_unlock_irqrestore(&pmu_lock, flags);
-		via_pmu_interrupt(0, 0, 0);
+		via_pmu_interrupt(0, NULL, NULL);
 		return IRQ_HANDLED;
 	}
 	return IRQ_NONE;
@@ -2071,7 +2071,7 @@
 	if (n->list.next == 0)
 		return -ENOENT;
 	list_del(&n->list);
-	n->list.next = 0;
+	n->list.next = NULL;
 	return 0;
 }
 
@@ -2406,7 +2406,7 @@
 
 	/* Force a poll of ADB interrupts */
 	adb_int_pending = 1;
-	via_pmu_interrupt(0, 0, 0);
+	via_pmu_interrupt(0, NULL, NULL);
 
 	/* Restart jiffies & scheduling */
 	wakeup_decrementer();
@@ -2857,7 +2857,7 @@
 
 	lock_kernel();
 	if (pp != 0) {
-		file->private_data = 0;
+		file->private_data = NULL;
 		spin_lock_irqsave(&all_pvt_lock, flags);
 		list_del(&pp->list);
 		spin_unlock_irqrestore(&all_pvt_lock, flags);
@@ -2880,6 +2880,7 @@
 		     u_int cmd, u_long arg)
 {
 	struct pmu_private *pp = filp->private_data;
+	__u32 __user *argp = (__u32 __user *)arg;
 	int error;
 
 	switch (cmd) {
@@ -2906,7 +2907,7 @@
 		sleep_in_progress = 0;
 		return error;
 	case PMU_IOC_CAN_SLEEP:
-		return put_user((u32)can_sleep, (__u32 *)arg);
+		return put_user((u32)can_sleep, argp);
 
 #ifdef CONFIG_PMAC_BACKLIGHT
 	/* Backlight should have its own device or go via
@@ -2918,13 +2919,13 @@
 		error = get_backlight_level();
 		if (error < 0)
 			return error;
-		return put_user(error, (__u32 *)arg);
+		return put_user(error, argp);
 	case PMU_IOC_SET_BACKLIGHT:
 	{
 		__u32 value;
 		if (sleep_in_progress)
 			return -EBUSY;
-		error = get_user(value, (__u32 *)arg);
+		error = get_user(value, argp);
 		if (!error)
 			error = set_backlight_level(value);
 		return error;
@@ -2943,9 +2944,9 @@
 #endif /* CONFIG_INPUT_ADBHID */
 #endif /* CONFIG_PMAC_BACKLIGHT */
 	case PMU_IOC_GET_MODEL:
-	    	return put_user(pmu_kind, (__u32 *)arg);
+	    	return put_user(pmu_kind, argp);
 	case PMU_IOC_HAS_ADB:
-		return put_user(pmu_has_adb, (__u32 *)arg);
+		return put_user(pmu_has_adb, argp);
 	}
 	return -EINVAL;
 }
diff -urN linux-2.6.8-rc2/drivers/macintosh/via-pmu68k.c linux-2.6.8-rc3/drivers/macintosh/via-pmu68k.c
--- linux-2.6.8-rc2/drivers/macintosh/via-pmu68k.c	2004-06-15 22:18:58.000000000 -0700
+++ linux-2.6.8-rc3/drivers/macintosh/via-pmu68k.c	2004-08-03 15:21:39.823853634 -0700
@@ -177,7 +177,7 @@
 /*f8*/	{-1,-1},{-1,-1},{-1,-1},{-1,-1},{-1,-1},{-1,-1},{-1,-1},{-1,-1},
 };
 
-int pmu_probe()
+int pmu_probe(void)
 {
 	if (macintosh_config->adb_type == MAC_ADB_PB1) {
 		pmu_kind = PMU_68K_V1;
@@ -521,7 +521,7 @@
 }
 
 static void 
-recv_byte()
+recv_byte(void)
 {
 	char c;
 
@@ -531,7 +531,7 @@
 }
 
 static void 
-pmu_start()
+pmu_start(void)
 {
 	unsigned long flags;
 	struct adb_request *req;
@@ -556,7 +556,7 @@
 }
 
 void 
-pmu_poll()
+pmu_poll(void)
 {
 	unsigned long flags;
 
diff -urN linux-2.6.8-rc2/drivers/md/raid5.c linux-2.6.8-rc3/drivers/md/raid5.c
--- linux-2.6.8-rc2/drivers/md/raid5.c	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/drivers/md/raid5.c	2004-08-03 15:21:39.912857285 -0700
@@ -55,7 +55,7 @@
  */
 #define RAID5_DEBUG	0
 #define RAID5_PARANOIA	1
-#if RAID5_PARANOIA && CONFIG_SMP
+#if RAID5_PARANOIA && defined(CONFIG_SMP)
 # define CHECK_DEVLOCK() if (!spin_is_locked(&conf->device_lock)) BUG()
 #else
 # define CHECK_DEVLOCK()
diff -urN linux-2.6.8-rc2/drivers/md/raid6main.c linux-2.6.8-rc3/drivers/md/raid6main.c
--- linux-2.6.8-rc2/drivers/md/raid6main.c	2004-06-15 22:18:52.000000000 -0700
+++ linux-2.6.8-rc3/drivers/md/raid6main.c	2004-08-03 15:21:39.916857449 -0700
@@ -61,7 +61,7 @@
 #define RAID6_DEBUG	0	/* Extremely verbose printk */
 #define RAID6_PARANOIA	1	/* Check spinlocks */
 #define RAID6_DUMPSTATE 0	/* Include stripe cache state in /proc/mdstat */
-#if RAID6_PARANOIA && CONFIG_SMP
+#if RAID6_PARANOIA && defined(CONFIG_SMP)
 # define CHECK_DEVLOCK() if (!spin_is_locked(&conf->device_lock)) BUG()
 #else
 # define CHECK_DEVLOCK()
diff -urN linux-2.6.8-rc2/drivers/media/dvb/b2c2/Kconfig linux-2.6.8-rc3/drivers/media/dvb/b2c2/Kconfig
--- linux-2.6.8-rc2/drivers/media/dvb/b2c2/Kconfig	2004-06-15 22:19:36.000000000 -0700
+++ linux-2.6.8-rc3/drivers/media/dvb/b2c2/Kconfig	2004-08-03 15:21:40.040862536 -0700
@@ -1,6 +1,6 @@
 config DVB_B2C2_SKYSTAR
 	tristate "Technisat Skystar2 PCI"
-	depends on DVB_CORE
+	depends on DVB_CORE && PCI
 	help
 	  Support for the Skystar2 PCI DVB card by Technisat, which
 	  is equipped with the FlexCopII chipset by B2C2.
diff -urN linux-2.6.8-rc2/drivers/media/dvb/dvb-core/dvb_functions.c linux-2.6.8-rc3/drivers/media/dvb/dvb-core/dvb_functions.c
--- linux-2.6.8-rc2/drivers/media/dvb/dvb-core/dvb_functions.c	2004-08-03 15:21:07.349521585 -0700
+++ linux-2.6.8-rc3/drivers/media/dvb/dvb-core/dvb_functions.c	2004-08-03 15:21:40.203869223 -0700
@@ -36,7 +36,11 @@
         /*  Copy arguments into temp kernel buffer  */
         switch (_IOC_DIR(cmd)) {
         case _IOC_NONE:
-                parg = NULL;
+		/*
+		 * For this command, the pointer is actually an integer
+		 * argument.
+		 */
+                parg = (void *) arg;
                 break;
         case _IOC_READ: /* some v4l ioctls are marked wrong ... */
         case _IOC_WRITE:
diff -urN linux-2.6.8-rc2/drivers/media/dvb/dvb-core/dvbdev.h linux-2.6.8-rc3/drivers/media/dvb/dvb-core/dvbdev.h
--- linux-2.6.8-rc2/drivers/media/dvb/dvb-core/dvbdev.h	2004-06-15 22:19:09.000000000 -0700
+++ linux-2.6.8-rc3/drivers/media/dvb/dvb-core/dvbdev.h	2004-08-03 15:21:40.208869428 -0700
@@ -29,7 +29,7 @@
 #include <linux/list.h>
 #include <linux/devfs_fs_kernel.h>
 
-#define DVB_MAJOR 250
+#define DVB_MAJOR 212
 
 #define DVB_DEVICE_VIDEO      0
 #define DVB_DEVICE_AUDIO      1
diff -urN linux-2.6.8-rc2/drivers/media/dvb/frontends/alps_tdlb7.c linux-2.6.8-rc3/drivers/media/dvb/frontends/alps_tdlb7.c
--- linux-2.6.8-rc2/drivers/media/dvb/frontends/alps_tdlb7.c	2004-06-15 22:20:27.000000000 -0700
+++ linux-2.6.8-rc3/drivers/media/dvb/frontends/alps_tdlb7.c	2004-08-03 15:21:40.276872218 -0700
@@ -28,8 +28,6 @@
     
 */  
 
-
-#define __KERNEL_SYSCALLS__
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/vmalloc.h>
@@ -151,13 +149,13 @@
 	loff_t filesize;
 	char *dp;
 
-	fd = open(fn, 0, 0);
+	fd = sys_open(fn, 0, 0);
 	if (fd == -1) {
                 printk("%s: unable to open '%s'.\n", __FUNCTION__, fn);
 		return -EIO;
 	}
 
-	filesize = lseek(fd, 0L, 2);
+	filesize = sys_lseek(fd, 0L, 2);
 	if (filesize <= 0 || filesize < SP8870_FIRMWARE_OFFSET + SP8870_FIRMWARE_SIZE) {
 	        printk("%s: firmware filesize to small '%s'\n", __FUNCTION__, fn);
 		sys_close(fd);
@@ -171,8 +169,8 @@
 		return -EIO;
 	}
 
-	lseek(fd, SP8870_FIRMWARE_OFFSET, 0);
-	if (read(fd, dp, SP8870_FIRMWARE_SIZE) != SP8870_FIRMWARE_SIZE) {
+	sys_lseek(fd, SP8870_FIRMWARE_OFFSET, 0);
+	if (sys_read(fd, dp, SP8870_FIRMWARE_SIZE) != SP8870_FIRMWARE_SIZE) {
 		printk("%s: failed to read '%s'.\n",__FUNCTION__, fn);
 		vfree(dp);
 		sys_close(fd);
diff -urN linux-2.6.8-rc2/drivers/media/dvb/frontends/sp887x.c linux-2.6.8-rc3/drivers/media/dvb/frontends/sp887x.c
--- linux-2.6.8-rc2/drivers/media/dvb/frontends/sp887x.c	2004-06-15 22:19:44.000000000 -0700
+++ linux-2.6.8-rc3/drivers/media/dvb/frontends/sp887x.c	2004-08-03 15:21:40.306873449 -0700
@@ -12,7 +12,6 @@
    next 0x4000 loaded. This may change in future versions.
  */
 
-#define __KERNEL_SYSCALLS__
 #include <linux/kernel.h>
 #include <linux/vmalloc.h>
 #include <linux/module.h>
@@ -211,13 +210,13 @@
 
 	// Load the firmware
 	set_fs(get_ds());
-	fd = open(sp887x_firmware, 0, 0);
+	fd = sys_open(sp887x_firmware, 0, 0);
 	if (fd < 0) {
 		printk(KERN_WARNING "%s: Unable to open firmware %s\n", __FUNCTION__,
 		       sp887x_firmware);
 		return -EIO;
 	}
-	filesize = lseek(fd, 0L, 2);
+	filesize = sys_lseek(fd, 0L, 2);
 	if (filesize <= 0) {
 		printk(KERN_WARNING "%s: Firmware %s is empty\n", __FUNCTION__,
 		       sp887x_firmware);
@@ -239,8 +238,8 @@
 	// read it!
 	// read the first 16384 bytes from the file
 	// ignore the first 10 bytes
-	lseek(fd, 10, 0);
-	if (read(fd, firmware, fw_size) != fw_size) {
+	sys_lseek(fd, 10, 0);
+	if (sys_read(fd, firmware, fw_size) != fw_size) {
 		printk(KERN_WARNING "%s: Failed to read firmware\n", __FUNCTION__);
 		vfree(firmware);
 		sys_close(fd);
diff -urN linux-2.6.8-rc2/drivers/media/dvb/frontends/tda1004x.c linux-2.6.8-rc3/drivers/media/dvb/frontends/tda1004x.c
--- linux-2.6.8-rc2/drivers/media/dvb/frontends/tda1004x.c	2004-08-03 15:21:07.395523470 -0700
+++ linux-2.6.8-rc3/drivers/media/dvb/frontends/tda1004x.c	2004-08-03 15:21:40.436878782 -0700
@@ -32,7 +32,6 @@
  */
 
 
-#define __KERNEL_SYSCALLS__
 #include <linux/kernel.h>
 #include <linux/vmalloc.h>
 #include <linux/module.h>
@@ -40,7 +39,6 @@
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/fs.h>
-#include <linux/unistd.h>
 #include <linux/fcntl.h>
 #include <linux/errno.h>
 #include <linux/syscalls.h>
@@ -399,13 +397,13 @@
 
 	// Load the firmware
 	set_fs(get_ds());
-	fd = open(tda1004x_firmware, 0, 0);
+	fd = sys_open(tda1004x_firmware, 0, 0);
 	if (fd < 0) {
 		printk("%s: Unable to open firmware %s\n", __FUNCTION__,
 		       tda1004x_firmware);
 		return -EIO;
 	}
-	filesize = lseek(fd, 0L, 2);
+	filesize = sys_lseek(fd, 0L, 2);
 	if (filesize <= 0) {
 		printk("%s: Firmware %s is empty\n", __FUNCTION__,
 		       tda1004x_firmware);
@@ -436,8 +434,8 @@
 	}
 
 	// read it!
-	lseek(fd, fw_offset, 0);
-	if (read(fd, firmware, fw_size) != fw_size) {
+	sys_lseek(fd, fw_offset, 0);
+	if (sys_read(fd, firmware, fw_size) != fw_size) {
 		printk("%s: Failed to read firmware\n", __FUNCTION__);
 		vfree(firmware);
 		sys_close(fd);
diff -urN linux-2.6.8-rc2/drivers/media/radio/Kconfig linux-2.6.8-rc3/drivers/media/radio/Kconfig
--- linux-2.6.8-rc2/drivers/media/radio/Kconfig	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/drivers/media/radio/Kconfig	2004-08-03 15:21:40.498881325 -0700
@@ -145,7 +145,7 @@
 
 config RADIO_MAXIRADIO
 	tristate "Guillemot MAXI Radio FM 2000 radio"
-	depends on VIDEO_DEV
+	depends on VIDEO_DEV && PCI
 	---help---
 	  Choose Y here if you have this radio card.  This card may also be
 	  found as Gemtek PCI FM.
diff -urN linux-2.6.8-rc2/drivers/media/radio/miropcm20-radio.c linux-2.6.8-rc3/drivers/media/radio/miropcm20-radio.c
--- linux-2.6.8-rc2/drivers/media/radio/miropcm20-radio.c	2004-08-03 15:21:07.403523797 -0700
+++ linux-2.6.8-rc3/drivers/media/radio/miropcm20-radio.c	2004-08-03 15:21:40.523882351 -0700
@@ -75,7 +75,7 @@
 
 	if ((i=aci_rw_cmd(ACI_READ_TUNERSTATION, -1, -1))<0)
 		return i;
-#if DEBUG
+#ifdef DEBUG
 	printk("check_sig: 0x%x\n", i);
 #endif
 	if (i & 0x80) {
@@ -107,7 +107,7 @@
 
 	if ((i=aci_rds_cmd(RDS_RXVALUE, &buf, 1))<0)
 		return i;
-#if DEBUG
+#ifdef DEBUG
 	printk("rds-signal: %d\n", buf);
 #endif
 	if (buf > 15) {
@@ -172,7 +172,7 @@
 			unsigned long *freq = arg;
 			pcm20->freq = *freq;
 			i=pcm20_setfreq(pcm20, pcm20->freq);
-#if DEBUG
+#ifdef DEBUG
 			printk("First view (setfreq): 0x%x\n", i);
 #endif
 			return i;
diff -urN linux-2.6.8-rc2/drivers/media/video/saa7134/saa7134-core.c linux-2.6.8-rc3/drivers/media/video/saa7134/saa7134-core.c
--- linux-2.6.8-rc2/drivers/media/video/saa7134/saa7134-core.c	2004-08-03 15:21:07.449525682 -0700
+++ linux-2.6.8-rc3/drivers/media/video/saa7134/saa7134-core.c	2004-08-03 15:21:41.076905038 -0700
@@ -324,7 +324,7 @@
 			 struct saa7134_buf *buf)
 {
 	struct saa7134_buf *next = NULL;
-#if DEBUG_SPINLOCKS
+#ifdef DEBUG_SPINLOCKS
 	BUG_ON(!spin_is_locked(&dev->slock));
 #endif
 	
@@ -353,7 +353,7 @@
 			   struct saa7134_dmaqueue *q,
 			   unsigned int state)
 {
-#if DEBUG_SPINLOCKS
+#ifdef DEBUG_SPINLOCKS
 	BUG_ON(!spin_is_locked(&dev->slock));
 #endif
 	dprintk("buffer_finish %p\n",q->curr);
@@ -370,7 +370,7 @@
 {
 	struct saa7134_buf *buf,*next = NULL;
 
-#if DEBUG_SPINLOCKS
+#ifdef DEBUG_SPINLOCKS
 	BUG_ON(!spin_is_locked(&dev->slock));
 #endif
 	BUG_ON(NULL != q->curr);
@@ -427,7 +427,7 @@
 	enum v4l2_field cap = V4L2_FIELD_ANY;
 	enum v4l2_field ov  = V4L2_FIELD_ANY;
 
-#if DEBUG_SPINLOCKS
+#ifdef DEBUG_SPINLOCKS
 	BUG_ON(!spin_is_locked(&dev->slock));
 #endif
 
diff -urN linux-2.6.8-rc2/drivers/media/video/zoran_procfs.c linux-2.6.8-rc3/drivers/media/video/zoran_procfs.c
--- linux-2.6.8-rc2/drivers/media/video/zoran_procfs.c	2004-08-03 15:21:07.473526665 -0700
+++ linux-2.6.8-rc3/drivers/media/video/zoran_procfs.c	2004-08-03 15:21:41.127907130 -0700
@@ -40,6 +40,7 @@
 #include <linux/videodev.h>
 #include <linux/spinlock.h>
 #include <linux/sem.h>
+#include <linux/seq_file.h>
 
 #include <linux/ctype.h>
 #include <asm/io.h>
@@ -93,14 +94,6 @@
 	{NULL, 0, 0, 0},
 };
 
-struct procfs_io {
-	char *buffer;
-	char *end;
-	int neof;
-	int count;
-	int count_current;
-};
-
 static void
 setparam (struct zoran *zr,
 	  char         *name,
@@ -130,85 +123,34 @@
 	}
 }
 
-static int
-print_procfs (struct procfs_io *io,
-	      const char       *fmt,
-	      ...)
+static int zoran_show(struct seq_file *p, void *v)
 {
-	va_list args;
+	struct zoran *zr = p->private;
 	int i;
 
-	if (io->buffer >= io->end) {
-		io->neof++;
-		return 0;
-	}
-	if (io->count > io->count_current++)
-		return 0;
-	va_start(args, fmt);
-	i = vsprintf(io->buffer, fmt, args);
-	io->buffer += i;
-	va_end(args);
-	return i;
+	seq_printf(p, "ZR36067 registers:\n");
+	for (i = 0; i < 0x130; i += 16)
+		seq_printf(p, "%03X %08X  %08X  %08X  %08X \n", i,
+			   btread(i), btread(i+4), btread(i+8), btread(i+12));
+	return 0;
 }
 
-static void
-zoran_procfs_output (struct procfs_io *io,
-		     void             *data)
+static int zoran_open(struct inode *inode, struct file *file)
 {
-	int i;
-	struct zoran *zr;
-	zr = (struct zoran *) data;
-
-	print_procfs(io, "ZR36067 registers:");
-	for (i = 0; i < 0x130; i += 4) {
-		if (!(i % 16)) {
-			print_procfs(io, "\n%03X", i);
-		};
-		print_procfs(io, " %08X ", btread(i));
-	};
-	print_procfs(io, "\n");
-}
-
-static int
-zoran_read_proc (char  *buffer,
-		 char **start,
-		 off_t  offset,
-		 int    size,
-		 int   *eof,
-		 void  *data)
-{
-	struct procfs_io io;
-	int nbytes;
-
-	io.buffer = buffer;
-	io.end = buffer + size - 128;	// Just to make it a little bit safer
-	io.count = offset;
-	io.count_current = 0;
-	io.neof = 0;
-	zoran_procfs_output(&io, data);
-	*start = (char *) (io.count_current - io.count);
-	nbytes = (int) (io.buffer - buffer);
-	*eof = !io.neof;
-	return nbytes;
-
-	return 0;
+	struct zoran *data = PDE(inode)->data;
+	return single_open(file, zoran_show, data);
 }
 
-static int
-zoran_write_proc (struct file   *file,
-		  const char    __user *buffer,
-		  unsigned long  count,
-		  void          *data)
+static ssize_t zoran_write(struct file *file, const char __user *buffer,
+			size_t count, loff_t *ppos)
 {
+	struct zoran *zr = PDE(file->f_dentry->d_inode)->data;
 	char *string, *sp;
 	char *line, *ldelim, *varname, *svar, *tdelim;
-	struct zoran *zr;
 
 	if (count > 32768)	/* Stupidity filter */
 		return -EINVAL;
 
-	zr = (struct zoran *) data;
-
 	string = sp = vmalloc(count + 1);
 	if (!string) {
 		dprintk(1,
@@ -222,8 +164,8 @@
 		return -EFAULT;
 	}
 	string[count] = 0;
-	dprintk(4, KERN_INFO "%s: write_proc: name=%s count=%lu data=%x\n",
-		ZR_DEVNAME(zr), file->f_dentry->d_name.name, count, (int) data);
+	dprintk(4, KERN_INFO "%s: write_proc: name=%s count=%zu zr=%p\n",
+		ZR_DEVNAME(zr), file->f_dentry->d_name.name, count, zr);
 	ldelim = " \t\n";
 	tdelim = "=";
 	line = strpbrk(sp, ldelim);
@@ -243,6 +185,14 @@
 
 	return count;
 }
+
+static struct file_operations zoran_operations = {
+	.open		= zoran_open,
+	.read		= seq_read,
+	.write		= zoran_write,
+	.llseek		= seq_lseek,
+	.release	= single_release,
+};
 #endif
 
 int
@@ -253,10 +203,9 @@
 
 	snprintf(name, 7, "zoran%d", zr->id);
 	if ((zr->zoran_proc = create_proc_entry(name, 0, NULL))) {
-		zr->zoran_proc->read_proc = zoran_read_proc;
-		zr->zoran_proc->write_proc = zoran_write_proc;
 		zr->zoran_proc->data = zr;
 		zr->zoran_proc->owner = THIS_MODULE;
+		zr->zoran_proc->proc_fops = &zoran_operations;
 		dprintk(2,
 			KERN_INFO
 			"%s: procfs entry /proc/%s allocated. data=%p\n",
@@ -277,9 +226,8 @@
 	char name[8];
 
 	snprintf(name, 7, "zoran%d", zr->id);
-	if (zr->zoran_proc) {
+	if (zr->zoran_proc)
 		remove_proc_entry(name, NULL);
-	}
 	zr->zoran_proc = NULL;
 #endif
 }
diff -urN linux-2.6.8-rc2/drivers/mtd/chips/cfi_cmdset_0002.c linux-2.6.8-rc3/drivers/mtd/chips/cfi_cmdset_0002.c
--- linux-2.6.8-rc2/drivers/mtd/chips/cfi_cmdset_0002.c	2004-08-03 15:21:07.585531254 -0700
+++ linux-2.6.8-rc3/drivers/mtd/chips/cfi_cmdset_0002.c	2004-08-03 15:21:41.640928175 -0700
@@ -1415,7 +1415,7 @@
 	ofs = instr->addr;
 	len = instr->len;
 
-	ret = cfi_amdstd_varsize_frob(mtd, do_erase_oneblock, ofs, len, 0);
+	ret = cfi_amdstd_varsize_frob(mtd, do_erase_oneblock, ofs, len, NULL);
 	if (ret)
 		return ret;
 
@@ -1681,7 +1681,7 @@
 	int ret;
 
 	DEBUG(MTD_DEBUG_LEVEL3,
-	      "%s: lock status before, ofs=0x%08llx, len=0x%08X\n",
+	      "%s: lock status before, ofs=0x%08llx, len=0x%08zX\n",
 	      __func__, ofs, len);
 	debug_dump_locks(mtd, do_printlockstatus_oneblock, ofs, len, 0);
 
@@ -1705,7 +1705,7 @@
 	int ret;
 
 	DEBUG(MTD_DEBUG_LEVEL3,
-	      "%s: lock status before, ofs=0x%08llx, len=0x%08X\n",
+	      "%s: lock status before, ofs=0x%08llx, len=0x%08zX\n",
 	      __func__, ofs, len);
 	debug_dump_locks(mtd, do_printlockstatus_oneblock, ofs, len, 0);
 
diff -urN linux-2.6.8-rc2/drivers/mtd/devices/blkmtd.c linux-2.6.8-rc3/drivers/mtd/devices/blkmtd.c
--- linux-2.6.8-rc2/drivers/mtd/devices/blkmtd.c	2004-08-03 15:21:07.598531786 -0700
+++ linux-2.6.8-rc3/drivers/mtd/devices/blkmtd.c	2004-08-03 15:21:41.706930883 -0700
@@ -246,7 +246,7 @@
 	pagenr = to >> PAGE_SHIFT;
 	offset = to & ~PAGE_MASK;
 
-	DEBUG(2, "blkmtd: write_pages: buf = %p to = %ld len = %d pagenr = %d offset = %d\n",
+	DEBUG(2, "blkmtd: write_pages: buf = %p to = %ld len = %zd pagenr = %d offset = %d\n",
 	      buf, (long)to, len, pagenr, offset);
 
 	/* see if we have to do a partial write at the start */
@@ -270,21 +270,21 @@
 
 	down(&dev->wrbuf_mutex);
 
-	DEBUG(3, "blkmtd: write: start_len = %d len = %d end_len = %d pagecnt = %d\n",
+	DEBUG(3, "blkmtd: write: start_len = %zd len = %zd end_len = %zd pagecnt = %d\n",
 	      start_len, len, end_len, pagecnt);
 
 	if(start_len) {
 		/* do partial start region */
 		struct page *page;
 
-		DEBUG(3, "blkmtd: write: doing partial start, page = %d len = %d offset = %d\n",
+		DEBUG(3, "blkmtd: write: doing partial start, page = %d len = %zd offset = %d\n",
 		      pagenr, start_len, offset);
 
 		BUG_ON(!buf);
 		page = read_cache_page(dev->blkdev->bd_inode->i_mapping, pagenr, (filler_t *)blkmtd_readpage, dev);
 		lock_page(page);
 		if(PageDirty(page)) {
-			err("to = %lld start_len = %d len = %d end_len = %d pagenr = %d\n",
+			err("to = %lld start_len = %zd len = %zd end_len = %zd pagenr = %d\n",
 			    to, start_len, len, end_len, pagenr);
 			BUG();
 		}
@@ -346,13 +346,13 @@
 	if(end_len) {
 		/* do the third region */
 		struct page *page;
-		DEBUG(3, "blkmtd: write: doing partial end, page = %d len = %d\n",
+		DEBUG(3, "blkmtd: write: doing partial end, page = %d len = %zd\n",
 		      pagenr, end_len);
 		BUG_ON(!buf);
 		page = read_cache_page(dev->blkdev->bd_inode->i_mapping, pagenr, (filler_t *)blkmtd_readpage, dev);
 		lock_page(page);
 		if(PageDirty(page)) {
-			err("to = %lld start_len = %d len = %d end_len = %d pagenr = %d\n",
+			err("to = %lld start_len = %zd len = %zd end_len = %zd pagenr = %d\n",
 			    to, start_len, len, end_len, pagenr);
 			BUG();
 		}
@@ -375,7 +375,7 @@
 	if(bio)
 		blkmtd_write_out(bio);
 
-	DEBUG(2, "blkmtd: write: end, retlen = %d, err = %d\n", *retlen, err);
+	DEBUG(2, "blkmtd: write: end, retlen = %zd, err = %d\n", *retlen, err);
 	up(&dev->wrbuf_mutex);
 
 	if(retlen)
@@ -393,14 +393,14 @@
 	size_t from;
 	u_long len;
 	int err = -EIO;
-	int retlen;
+	size_t retlen;
 
 	instr->state = MTD_ERASING;
 	from = instr->addr;
 	len = instr->len;
 
 	/* check erase region has valid start and length */
-	DEBUG(2, "blkmtd: erase: dev = `%s' from = 0x%x len = 0x%lx\n",
+	DEBUG(2, "blkmtd: erase: dev = `%s' from = 0x%zx len = 0x%lx\n",
 	      mtd->name+9, from, len);
 	while(numregions) {
 		DEBUG(3, "blkmtd: checking erase region = 0x%08X size = 0x%X num = 0x%x\n",
@@ -417,14 +417,14 @@
 
 	if(!numregions) {
 		/* Not a valid erase block */
-		err("erase: invalid erase request 0x%lX @ 0x%08X", len, from);
+		err("erase: invalid erase request 0x%lX @ 0x%08zX", len, from);
 		instr->state = MTD_ERASE_FAILED;
 		err = -EIO;
 	}
 
 	if(instr->state != MTD_ERASE_FAILED) {
 		/* do the erase */
-		DEBUG(3, "Doing erase from = %d len = %ld\n", from, len);
+		DEBUG(3, "Doing erase from = %zd len = %ld\n", from, len);
 		err = write_pages(dev, NULL, from, len, &retlen);
 		if(err || retlen != len) {
 			err("erase failed err = %d", err);
@@ -453,8 +453,8 @@
 	int pagenr, pages;
 	size_t thislen = 0;
 
-	DEBUG(2, "blkmtd: read: dev = `%s' from = %ld len = %d buf = %p\n",
-	      mtd->name+9, (long int)from, len, buf);
+	DEBUG(2, "blkmtd: read: dev = `%s' from = %lld len = %zd buf = %p\n",
+	      mtd->name+9, from, len, buf);
 
 	if(from > mtd->size)
 		return -EINVAL;
@@ -496,7 +496,7 @@
  readerr:
 	if(retlen)
 		*retlen = thislen;
-	DEBUG(2, "blkmtd: end read: retlen = %d, err = %d\n", thislen, err);
+	DEBUG(2, "blkmtd: end read: retlen = %zd, err = %d\n", thislen, err);
 	return err;
 }
 
@@ -511,8 +511,8 @@
 	if(!len)
 		return 0;
 
-	DEBUG(2, "blkmtd: write: dev = `%s' to = %ld len = %d buf = %p\n",
-	      mtd->name+9, (long int)to, len, buf);
+	DEBUG(2, "blkmtd: write: dev = `%s' to = %lld len = %zd buf = %p\n",
+	      mtd->name+9, to, len, buf);
 
 	if(to >= mtd->size) {
 		return -ENOSPC;
@@ -565,7 +565,7 @@
 {
 	struct mtd_erase_region_info *info = NULL;
 
-	DEBUG(2, "calc_erase_regions, es = %d size = %d regions = %d\n",
+	DEBUG(2, "calc_erase_regions, es = %zd size = %zd regions = %d\n",
 	      erase_size, total_size, *regions);
 	/* Make any user specified erasesize be a power of 2
 	   and at least PAGE_SIZE */
@@ -613,7 +613,7 @@
 				break;
 		}
 	} while(!(*regions));
-	DEBUG(2, "calc_erase_regions done, es = %d size = %d regions = %d\n",
+	DEBUG(2, "calc_erase_regions done, es = %zd size = %zd regions = %d\n",
 	      erase_size, total_size, *regions);
 	return info;
 }
diff -urN linux-2.6.8-rc2/drivers/mtd/devices/doc2000.c linux-2.6.8-rc3/drivers/mtd/devices/doc2000.c
--- linux-2.6.8-rc2/drivers/mtd/devices/doc2000.c	2004-08-03 15:21:07.601531909 -0700
+++ linux-2.6.8-rc3/drivers/mtd/devices/doc2000.c	2004-08-03 15:21:41.709931006 -0700
@@ -58,7 +58,7 @@
 			size_t *retlen, u_char *buf, u_char *eccbuf, struct nand_oobinfo *oobsel);
 static int doc_write_ecc(struct mtd_info *mtd, loff_t to, size_t len,
 			 size_t *retlen, const u_char *buf, u_char *eccbuf, struct nand_oobinfo *oobsel);
-static int doc_writev_ecc(struct mtd_info *mtd, const struct iovec *vecs, 
+static int doc_writev_ecc(struct mtd_info *mtd, const struct kvec *vecs, 
 			  unsigned long count, loff_t to, size_t *retlen,
 			  u_char *eccbuf, struct nand_oobinfo *oobsel);
 static int doc_read_oob(struct mtd_info *mtd, loff_t ofs, size_t len,
@@ -632,7 +632,7 @@
 		    size_t * retlen, u_char * buf)
 {
 	/* Just a special case of doc_read_ecc */
-	return doc_read_ecc(mtd, from, len, retlen, buf, NULL, 0);
+	return doc_read_ecc(mtd, from, len, retlen, buf, NULL, NULL);
 }
 
 static int doc_read_ecc(struct mtd_info *mtd, loff_t from, size_t len,
@@ -790,7 +790,7 @@
 		     size_t * retlen, const u_char * buf)
 {
 	char eccbuf[6];
-	return doc_write_ecc(mtd, to, len, retlen, buf, eccbuf, 0);
+	return doc_write_ecc(mtd, to, len, retlen, buf, eccbuf, NULL);
 }
 
 static int doc_write_ecc(struct mtd_info *mtd, loff_t to, size_t len,
@@ -979,7 +979,7 @@
 	return 0;
 }
 
-static int doc_writev_ecc(struct mtd_info *mtd, const struct iovec *vecs, 
+static int doc_writev_ecc(struct mtd_info *mtd, const struct kvec *vecs, 
 			  unsigned long count, loff_t to, size_t *retlen,
 			  u_char *eccbuf, struct nand_oobinfo *oobsel)
 {
diff -urN linux-2.6.8-rc2/drivers/mtd/devices/doc2001.c linux-2.6.8-rc3/drivers/mtd/devices/doc2001.c
--- linux-2.6.8-rc2/drivers/mtd/devices/doc2001.c	2004-08-03 15:21:07.602531950 -0700
+++ linux-2.6.8-rc3/drivers/mtd/devices/doc2001.c	2004-08-03 15:21:41.711931088 -0700
@@ -38,9 +38,11 @@
 static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
 		     size_t *retlen, const u_char *buf);
 static int doc_read_ecc(struct mtd_info *mtd, loff_t from, size_t len,
-			size_t *retlen, u_char *buf, u_char *eccbuf, int oobsel);
+			size_t *retlen, u_char *buf, u_char *eccbuf,
+			struct nand_oobinfo *oobsel);
 static int doc_write_ecc(struct mtd_info *mtd, loff_t to, size_t len,
-			 size_t *retlen, const u_char *buf, u_char *eccbuf, int oobsel);
+			 size_t *retlen, const u_char *buf, u_char *eccbuf,
+			 struct nand_oobinfo *oobsel);
 static int doc_read_oob(struct mtd_info *mtd, loff_t ofs, size_t len,
 			size_t *retlen, u_char *buf);
 static int doc_write_oob(struct mtd_info *mtd, loff_t ofs, size_t len,
@@ -404,11 +406,12 @@
 		     size_t *retlen, u_char *buf)
 {
 	/* Just a special case of doc_read_ecc */
-	return doc_read_ecc(mtd, from, len, retlen, buf, NULL, 0);
+	return doc_read_ecc(mtd, from, len, retlen, buf, NULL, NULL);
 }
 
 static int doc_read_ecc (struct mtd_info *mtd, loff_t from, size_t len,
-			 size_t *retlen, u_char *buf, u_char *eccbuf, int oobsel)
+			 size_t *retlen, u_char *buf, u_char *eccbuf,
+			 struct nand_oobinfo *oobsel)
 {
 	int i, ret;
 	volatile char dummy;
@@ -530,11 +533,12 @@
 		      size_t *retlen, const u_char *buf)
 {
 	char eccbuf[6];
-	return doc_write_ecc(mtd, to, len, retlen, buf, eccbuf, 0);
+	return doc_write_ecc(mtd, to, len, retlen, buf, eccbuf, NULL);
 }
 
 static int doc_write_ecc (struct mtd_info *mtd, loff_t to, size_t len,
-			  size_t *retlen, const u_char *buf, u_char *eccbuf, int oobsel)
+			  size_t *retlen, const u_char *buf, u_char *eccbuf,
+			 struct nand_oobinfo *oobsel)
 {
 	int i,ret = 0;
 	volatile char dummy;
diff -urN linux-2.6.8-rc2/drivers/mtd/ftl.c linux-2.6.8-rc3/drivers/mtd/ftl.c
--- linux-2.6.8-rc2/drivers/mtd/ftl.c	2004-08-03 15:21:07.609532237 -0700
+++ linux-2.6.8-rc3/drivers/mtd/ftl.c	2004-08-03 15:21:41.767933385 -0700
@@ -167,7 +167,8 @@
 {
     erase_unit_header_t header;
     loff_t offset, max_offset;
-    int ret;
+    size_t ret;
+    int err;
     part->header.FormattedSize = 0;
     max_offset = (0x100000<part->mbd.mtd->size)?0x100000:part->mbd.mtd->size;
     /* Search first megabyte for a valid FTL header */
@@ -175,11 +176,11 @@
 	 (offset + sizeof(header)) < max_offset;
 	 offset += part->mbd.mtd->erasesize ? : 0x2000) {
 
-	ret = part->mbd.mtd->read(part->mbd.mtd, offset, sizeof(header), &ret, 
+	err = part->mbd.mtd->read(part->mbd.mtd, offset, sizeof(header), &ret, 
 			      (unsigned char *)&header);
 	
-	if (ret) 
-	    return ret;
+	if (err) 
+	    return err;
 
 	if (strcmp(header.DataOrgTuple+3, "FTL100") == 0) break;
     }
@@ -958,7 +959,7 @@
 	if (ret) {
 	    printk(KERN_NOTICE "ftl_cs: block write failed!\n");
 	    printk(KERN_NOTICE "ftl_cs:   log_addr = 0x%x, virt_addr"
-		   " = 0x%x, Offset = 0x%x\n", log_addr, virt_addr,
+		   " = 0x%x, Offset = 0x%zx\n", log_addr, virt_addr,
 		   offset);
 	    return -EIO;
 	}
diff -urN linux-2.6.8-rc2/drivers/mtd/inftlcore.c linux-2.6.8-rc3/drivers/mtd/inftlcore.c
--- linux-2.6.8-rc2/drivers/mtd/inftlcore.c	2004-08-03 15:21:07.610532278 -0700
+++ linux-2.6.8-rc3/drivers/mtd/inftlcore.c	2004-08-03 15:21:41.769933467 -0700
@@ -167,8 +167,8 @@
 	u16 pot = inftl->LastFreeEUN;
 	int silly = inftl->nb_blocks;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_findfreeblock(inftl=0x%x,"
-		"desperate=%d)\n", (int)inftl, desperate);
+	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_findfreeblock(inftl=%p,"
+		"desperate=%d)\n", inftl, desperate);
 
 	/*
 	 * Normally, we force a fold to happen before we run out of free
@@ -210,8 +210,8 @@
 	struct inftl_oob oob;
         size_t retlen;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=0x%x,thisVUC=%d,"
-		"pending=%d)\n", (int)inftl, thisVUC, pendingblock);
+	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
+		"pending=%d)\n", inftl, thisVUC, pendingblock);
 
 	memset(BlockMap, 0xff, sizeof(BlockMap));
 	memset(BlockDeleted, 0, sizeof(BlockDeleted));
@@ -366,8 +366,8 @@
 	u16 ChainLength = 0, thislen;
 	u16 chain, EUN;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_makefreeblock(inftl=0x%x,"
-		"pending=%d)\n", (int)inftl, pendingblock);
+	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_makefreeblock(inftl=%p,"
+		"pending=%d)\n", inftl, pendingblock);
 
 	for (chain = 0; chain < inftl->nb_blocks; chain++) {
 		EUN = inftl->VUtable[chain];
@@ -428,8 +428,8 @@
 	size_t retlen;
 	int silly, silly2 = 3;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_findwriteunit(inftl=0x%x,"
-		"block=%d)\n", (int)inftl, block);
+	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_findwriteunit(inftl=%p,"
+		"block=%d)\n", inftl, block);
 
 	do {
 		/*
@@ -590,8 +590,8 @@
 	struct inftl_bci bci;
 	size_t retlen;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_trydeletechain(inftl=0x%x,"
-		"thisVUC=%d)\n", (int)inftl, thisVUC);
+	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_trydeletechain(inftl=%p,"
+		"thisVUC=%d)\n", inftl, thisVUC);
 
 	memset(BlockUsed, 0, sizeof(BlockUsed));
 	memset(BlockDeleted, 0, sizeof(BlockDeleted));
@@ -709,8 +709,8 @@
 	size_t retlen;
 	struct inftl_bci bci;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_deleteblock(inftl=0x%x,"
-		"block=%d)\n", (int)inftl, block);
+	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_deleteblock(inftl=%p,"
+		"block=%d)\n", inftl, block);
 
 	while (thisEUN < inftl->nb_blocks) {
 		if (MTD_READOOB(inftl->mbd.mtd, (thisEUN * inftl->EraseSize) +
@@ -768,8 +768,8 @@
 	struct inftl_oob oob;
 	char *p, *pend;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: inftl_writeblock(inftl=0x%x,block=%ld,"
-		"buffer=0x%x)\n", (int)inftl, block, (int)buffer);
+	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: inftl_writeblock(inftl=%p,block=%ld,"
+		"buffer=%p)\n", inftl, block, buffer);
 
 	/* Is block all zero? */
 	pend = buffer + SECTORSIZE;
@@ -816,8 +816,8 @@
         struct inftl_bci bci;
 	size_t retlen;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: inftl_readblock(inftl=0x%x,block=%ld,"
-		"buffer=0x%x)\n", (int)inftl, block, (int)buffer);
+	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: inftl_readblock(inftl=%p,block=%ld,"
+		"buffer=%p)\n", inftl, block, buffer);
 
 	while (thisEUN < inftl->nb_blocks) {
 		if (MTD_READOOB(inftl->mbd.mtd, (thisEUN * inftl->EraseSize) +
diff -urN linux-2.6.8-rc2/drivers/mtd/inftlmount.c linux-2.6.8-rc3/drivers/mtd/inftlmount.c
--- linux-2.6.8-rc2/drivers/mtd/inftlmount.c	2004-08-03 15:21:07.611532319 -0700
+++ linux-2.6.8-rc3/drivers/mtd/inftlmount.c	2004-08-03 15:21:41.771933550 -0700
@@ -58,10 +58,9 @@
 	u8 buf[SECTORSIZE];
 	struct INFTLMediaHeader *mh = &inftl->MediaHdr;
 	struct INFTLPartition *ip;
-	int retlen;
+	size_t retlen;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=0x%x)\n",
-		(int)inftl);
+	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
 
         /*
 	 * Assume logical EraseSize == physical erasesize for starting the
@@ -288,7 +287,7 @@
 		inftl->PUtable = kmalloc(inftl->nb_blocks * sizeof(u16), GFP_KERNEL);
 		if (!inftl->PUtable) {
 			printk(KERN_WARNING "INFTL: allocation of PUtable "
-				"failed (%d bytes)\n",
+				"failed (%zd bytes)\n",
 				inftl->nb_blocks * sizeof(u16));
 			return -ENOMEM;
 		}
@@ -297,7 +296,7 @@
 		if (!inftl->VUtable) {
 			kfree(inftl->PUtable);
 			printk(KERN_WARNING "INFTL: allocation of VUtable "
-				"failed (%d bytes)\n",
+				"failed (%zd bytes)\n",
 				inftl->nb_blocks * sizeof(u16));
 			return -ENOMEM;
 		}
@@ -348,11 +347,12 @@
 static int check_free_sectors(struct INFTLrecord *inftl, unsigned int address,
 	int len, int check_oob)
 {
-	int i, retlen;
 	u8 buf[SECTORSIZE + inftl->mbd.mtd->oobsize];
+	size_t retlen;
+	int i;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: check_free_sectors(inftl=0x%x,"
-		"address=0x%x,len=%d,check_oob=%d)\n", (int)inftl,
+	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: check_free_sectors(inftl=%p,"
+		"address=0x%x,len=%d,check_oob=%d)\n", inftl,
 		address, len, check_oob);
 
 	for (i = 0; i < len; i += SECTORSIZE) {
@@ -382,13 +382,13 @@
  */
 int INFTL_formatblock(struct INFTLrecord *inftl, int block)
 {
-	int retlen;
+	size_t retlen;
 	struct inftl_unittail uci;
 	struct erase_info *instr = &inftl->instr;
 	int physblock;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_formatblock(inftl=0x%x,"
-		"block=%d)\n", (int)inftl, block);
+	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_formatblock(inftl=%p,"
+		"block=%d)\n", inftl, block);
 
 	memset(instr, 0, sizeof(struct erase_info));
 
@@ -551,10 +551,11 @@
 	int chain_length, do_format_chain;
 	struct inftl_unithead1 h0;
 	struct inftl_unittail h1;
-	int i, retlen;
+	size_t retlen;
+	int i;
 	u8 *ANACtable, ANAC;
 
-	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_mount(inftl=0x%x)\n", (int)s);
+	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_mount(inftl=%p)\n", s);
 
 	/* Search for INFTL MediaHeader and Spare INFTL Media Header */
 	if (find_boot_record(s) < 0) {
diff -urN linux-2.6.8-rc2/drivers/mtd/maps/ichxrom.c linux-2.6.8-rc3/drivers/mtd/maps/ichxrom.c
--- linux-2.6.8-rc2/drivers/mtd/maps/ichxrom.c	2004-08-03 15:21:07.627532974 -0700
+++ linux-2.6.8-rc3/drivers/mtd/maps/ichxrom.c	2004-08-03 15:21:41.825935765 -0700
@@ -286,7 +286,7 @@
 		info->mtd->unlock = ichxrom_unlock;
 	}
 	if (info->mtd->size > info->map.size) {
-		printk(KERN_WARNING MOD_NAME " rom(%u) larger than window(%u). fixing...\n",
+		printk(KERN_WARNING MOD_NAME " rom(%u) larger than window(%lu). fixing...\n",
 		       info->mtd->size, info->map.size);
 		info->mtd->size = info->map.size;
 	}
diff -urN linux-2.6.8-rc2/drivers/mtd/mtdchar.c linux-2.6.8-rc3/drivers/mtd/mtdchar.c
--- linux-2.6.8-rc2/drivers/mtd/mtdchar.c	2004-08-03 15:21:07.653534040 -0700
+++ linux-2.6.8-rc3/drivers/mtd/mtdchar.c	2004-08-03 15:21:42.000942944 -0700
@@ -511,7 +511,7 @@
 	}
 
 	default:
-		DEBUG(MTD_DEBUG_LEVEL0, "Invalid ioctl %x (MEMGETINFO = %x)\n", cmd, MEMGETINFO);
+		DEBUG(MTD_DEBUG_LEVEL0, "Invalid ioctl %x (MEMGETINFO = %lx)\n", cmd, (unsigned long)MEMGETINFO);
 		ret = -ENOTTY;
 	}
 
diff -urN linux-2.6.8-rc2/drivers/mtd/nand/diskonchip.c linux-2.6.8-rc3/drivers/mtd/nand/diskonchip.c
--- linux-2.6.8-rc2/drivers/mtd/nand/diskonchip.c	2004-08-03 15:21:07.661534367 -0700
+++ linux-2.6.8-rc3/drivers/mtd/nand/diskonchip.c	2004-08-03 15:21:42.009943313 -0700
@@ -651,10 +651,11 @@
 {
 	struct nand_chip *this = mtd->priv;
 	struct doc_priv *doc = (void *)this->priv;
-	int offs, end = (MAX_MEDIAHEADER_SCAN << this->phys_erase_shift);
-	int ret, retlen;
+	unsigned offs, end = (MAX_MEDIAHEADER_SCAN << this->phys_erase_shift);
+	int ret;
+	size_t retlen;
 
-	end = min(end, (int)mtd->size); // paranoia
+	end = min(end, mtd->size); // paranoia
 	for (offs = 0; offs < end; offs += mtd->erasesize) {
 		ret = mtd->read(mtd, offs, mtd->oobblock, &retlen, buf);
 		if (retlen != mtd->oobblock) continue;
@@ -695,8 +696,8 @@
 	struct doc_priv *doc = (void *)this->priv;
 	u_char *buf = this->data_buf;
 	struct NFTLMediaHeader *mh = (struct NFTLMediaHeader *) buf;
-	const int psize = 1 << this->page_shift;
-	int blocks, maxblocks;
+	const unsigned psize = 1 << this->page_shift;
+	unsigned blocks, maxblocks;
 	int offs, numheaders;
 
 	if (!(numheaders=find_media_headers(mtd, buf, "ANAND", 1))) return 0;
@@ -714,7 +715,7 @@
 //#endif
 
 	blocks = mtd->size >> this->phys_erase_shift;
-	maxblocks = min(32768, (int)mtd->erasesize - psize);
+	maxblocks = min(32768U, mtd->erasesize - psize);
 
 	if (mh->UnitSizeFactor == 0x00) {
 		/* Auto-determine UnitSizeFactor.  The constraints are:
@@ -725,7 +726,7 @@
 		mh->UnitSizeFactor = 0xff;
 		while (blocks > maxblocks) {
 			blocks >>= 1;
-			maxblocks = min(32768, (maxblocks << 1) + psize);
+			maxblocks = min(32768U, (maxblocks << 1) + psize);
 			mh->UnitSizeFactor--;
 		}
 		printk(KERN_WARNING "UnitSizeFactor=0x00 detected.  Correct value is assumed to be 0x%02x.\n", mh->UnitSizeFactor);
@@ -741,7 +742,7 @@
 		mtd->erasesize <<= (0xff - mh->UnitSizeFactor);
 		printk(KERN_INFO "Setting virtual erase size to %d\n", mtd->erasesize);
 		blocks = mtd->size >> this->bbt_erase_shift;
-		maxblocks = min(32768, (int)mtd->erasesize - psize);
+		maxblocks = min(32768U, mtd->erasesize - psize);
 	}
 
 	if (blocks > maxblocks) {
diff -urN linux-2.6.8-rc2/drivers/net/3c515.c linux-2.6.8-rc3/drivers/net/3c515.c
--- linux-2.6.8-rc2/drivers/net/3c515.c	2004-06-15 22:18:59.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/3c515.c	2004-08-03 15:21:42.375958328 -0700
@@ -831,7 +831,7 @@
 		outb(PKT_BUF_SZ >> 8, ioaddr + TxFreeThreshold);	/* Room for a packet. */
 		/* Clear the Tx ring. */
 		for (i = 0; i < TX_RING_SIZE; i++)
-			vp->tx_skbuff[i] = 0;
+			vp->tx_skbuff[i] = NULL;
 		outl(0, ioaddr + DownListPtr);
 	}
 	/* Set receiver mode: presumably accept b-case and phys addr only. */
@@ -1174,7 +1174,7 @@
 					break;	/* It still hasn't been processed. */
 				if (lp->tx_skbuff[entry]) {
 					dev_kfree_skb_irq(lp->tx_skbuff[entry]);
-					lp->tx_skbuff[entry] = 0;
+					lp->tx_skbuff[entry] = NULL;
 				}
 				dirty_tx++;
 			}
@@ -1458,7 +1458,7 @@
 		for (i = 0; i < RX_RING_SIZE; i++)
 			if (vp->rx_skbuff[i]) {
 				dev_kfree_skb(vp->rx_skbuff[i]);
-				vp->rx_skbuff[i] = 0;
+				vp->rx_skbuff[i] = NULL;
 			}
 	}
 	if (vp->full_bus_master_tx) {	/* Free Boomerang bus master Tx buffers. */
@@ -1466,7 +1466,7 @@
 		for (i = 0; i < TX_RING_SIZE; i++)
 			if (vp->tx_skbuff[i]) {
 				dev_kfree_skb(vp->tx_skbuff[i]);
-				vp->tx_skbuff[i] = 0;
+				vp->tx_skbuff[i] = NULL;
 			}
 	}
 
diff -urN linux-2.6.8-rc2/drivers/net/82596.c linux-2.6.8-rc3/drivers/net/82596.c
--- linux-2.6.8-rc2/drivers/net/82596.c	2004-08-03 15:21:07.729537153 -0700
+++ linux-2.6.8-rc3/drivers/net/82596.c	2004-08-03 15:21:42.568966246 -0700
@@ -619,7 +619,7 @@
 #endif
 	unsigned long flags;
 
-	MPU_PORT(dev, PORT_RESET, 0);
+	MPU_PORT(dev, PORT_RESET, NULL);
 
 	udelay(100);		/* Wait 100us - seems to help */
 
@@ -760,7 +760,7 @@
 
 failed:
 	printk(KERN_CRIT "%s: Failed to initialise 82596\n", dev->name);
-	MPU_PORT(dev, PORT_RESET, 0);
+	MPU_PORT(dev, PORT_RESET, NULL);
 	return -1;
 }
 
diff -urN linux-2.6.8-rc2/drivers/net/Kconfig linux-2.6.8-rc3/drivers/net/Kconfig
--- linux-2.6.8-rc2/drivers/net/Kconfig	2004-08-03 15:21:07.731537235 -0700
+++ linux-2.6.8-rc3/drivers/net/Kconfig	2004-08-03 15:21:42.634968954 -0700
@@ -234,7 +234,7 @@
 
 config OAKNET
 	tristate "National DP83902AV (Oak ethernet) support"
-	depends on NET_ETHERNET && PPC
+	depends on NET_ETHERNET && PPC && BROKEN
 	select CRC32
 	help
 	  Say Y if your machine has this type of Ethernet network card.
diff -urN linux-2.6.8-rc2/drivers/net/acenic.c linux-2.6.8-rc3/drivers/net/acenic.c
--- linux-2.6.8-rc2/drivers/net/acenic.c	2004-08-03 15:21:07.764538587 -0700
+++ linux-2.6.8-rc3/drivers/net/acenic.c	2004-08-03 15:21:42.749973671 -0700
@@ -369,9 +369,9 @@
  */
 #define ACE_MINI_SIZE		100
 
-#define ACE_MINI_BUFSIZE	(ACE_MINI_SIZE + 2 + 16)
-#define ACE_STD_BUFSIZE		(ACE_STD_MTU + ETH_HLEN + 2+4+16)
-#define ACE_JUMBO_BUFSIZE	(ACE_JUMBO_MTU + ETH_HLEN + 2+4+16)
+#define ACE_MINI_BUFSIZE	ACE_MINI_SIZE
+#define ACE_STD_BUFSIZE		(ACE_STD_MTU + ETH_HLEN + 4)
+#define ACE_JUMBO_BUFSIZE	(ACE_JUMBO_MTU + ETH_HLEN + 4)
 
 /*
  * There seems to be a magic difference in the effect between 995 and 996
@@ -678,7 +678,7 @@
 			ringp = &ap->skb->rx_std_skbuff[i];
 			mapping = pci_unmap_addr(ringp, mapping);
 			pci_unmap_page(ap->pdev, mapping,
-				       ACE_STD_BUFSIZE - (2 + 16),
+				       ACE_STD_BUFSIZE,
 				       PCI_DMA_FROMDEVICE);
 
 			ap->rx_std_ring[i].size = 0;
@@ -698,7 +698,7 @@
 				ringp = &ap->skb->rx_mini_skbuff[i];
 				mapping = pci_unmap_addr(ringp,mapping);
 				pci_unmap_page(ap->pdev, mapping,
-					       ACE_MINI_BUFSIZE - (2 + 16),
+					       ACE_MINI_BUFSIZE,
 					       PCI_DMA_FROMDEVICE);
 
 				ap->rx_mini_ring[i].size = 0;
@@ -717,7 +717,7 @@
 			ringp = &ap->skb->rx_jumbo_skbuff[i];
 			mapping = pci_unmap_addr(ringp, mapping);
 			pci_unmap_page(ap->pdev, mapping,
-				       ACE_JUMBO_BUFSIZE - (2 + 16),
+				       ACE_JUMBO_BUFSIZE,
 				       PCI_DMA_FROMDEVICE);
 
 			ap->rx_jumbo_ring[i].size = 0;
@@ -1257,7 +1257,7 @@
 	set_aceaddr(&info->stats2_ptr, (dma_addr_t) tmp_ptr);
 
 	set_aceaddr(&info->rx_std_ctrl.rngptr, ap->rx_ring_base_dma);
-	info->rx_std_ctrl.max_len = ACE_STD_MTU + ETH_HLEN + 4;
+	info->rx_std_ctrl.max_len = ACE_STD_BUFSIZE;
 	info->rx_std_ctrl.flags =
 	  RCB_FLG_TCP_UDP_SUM | RCB_FLG_NO_PSEUDO_HDR | ACE_RCB_VLAN_FLAG;
 
@@ -1700,17 +1700,14 @@
 		struct rx_desc *rd;
 		dma_addr_t mapping;
 
-		skb = alloc_skb(ACE_STD_BUFSIZE, GFP_ATOMIC);
+		skb = alloc_skb(ACE_STD_BUFSIZE + NET_IP_ALIGN, GFP_ATOMIC);
 		if (!skb)
 			break;
 
-		/*
-		 * Make sure IP header starts on a fresh cache line.
-		 */
-		skb_reserve(skb, 2 + 16);
+		skb_reserve(skb, NET_IP_ALIGN);
 		mapping = pci_map_page(ap->pdev, virt_to_page(skb->data),
 				       offset_in_page(skb->data),
-				       ACE_STD_BUFSIZE - (2 + 16),
+				       ACE_STD_BUFSIZE,
 				       PCI_DMA_FROMDEVICE);
 		ap->skb->rx_std_skbuff[idx].skb = skb;
 		pci_unmap_addr_set(&ap->skb->rx_std_skbuff[idx],
@@ -1718,7 +1715,7 @@
 
 		rd = &ap->rx_std_ring[idx];
 		set_aceaddr(&rd->addr, mapping);
-		rd->size = ACE_STD_MTU + ETH_HLEN + 4;
+		rd->size = ACE_STD_BUFSIZE;
 		rd->idx = idx;
 		idx = (idx + 1) % RX_STD_RING_ENTRIES;
 	}
@@ -1766,17 +1763,14 @@
 		struct rx_desc *rd;
 		dma_addr_t mapping;
 
-		skb = alloc_skb(ACE_MINI_BUFSIZE, GFP_ATOMIC);
+		skb = alloc_skb(ACE_MINI_BUFSIZE + NET_IP_ALIGN, GFP_ATOMIC);
 		if (!skb)
 			break;
 
-		/*
-		 * Make sure the IP header ends up on a fresh cache line
-		 */
-		skb_reserve(skb, 2 + 16);
+		skb_reserve(skb, NET_IP_ALIGN);
 		mapping = pci_map_page(ap->pdev, virt_to_page(skb->data),
 				       offset_in_page(skb->data),
-				       ACE_MINI_BUFSIZE - (2 + 16),
+				       ACE_MINI_BUFSIZE,
 				       PCI_DMA_FROMDEVICE);
 		ap->skb->rx_mini_skbuff[idx].skb = skb;
 		pci_unmap_addr_set(&ap->skb->rx_mini_skbuff[idx],
@@ -1784,7 +1778,7 @@
 
 		rd = &ap->rx_mini_ring[idx];
 		set_aceaddr(&rd->addr, mapping);
-		rd->size = ACE_MINI_SIZE;
+		rd->size = ACE_MINI_BUFSIZE;
 		rd->idx = idx;
 		idx = (idx + 1) % RX_MINI_RING_ENTRIES;
 	}
@@ -1827,17 +1821,14 @@
 		struct rx_desc *rd;
 		dma_addr_t mapping;
 
-		skb = alloc_skb(ACE_JUMBO_BUFSIZE, GFP_ATOMIC);
+		skb = alloc_skb(ACE_JUMBO_BUFSIZE + NET_IP_ALIGN, GFP_ATOMIC);
 		if (!skb)
 			break;
 
-		/*
-		 * Make sure the IP header ends up on a fresh cache line
-		 */
-		skb_reserve(skb, 2 + 16);
+		skb_reserve(skb, NET_IP_ALIGN);
 		mapping = pci_map_page(ap->pdev, virt_to_page(skb->data),
 				       offset_in_page(skb->data),
-				       ACE_JUMBO_BUFSIZE - (2 + 16),
+				       ACE_JUMBO_BUFSIZE,
 				       PCI_DMA_FROMDEVICE);
 		ap->skb->rx_jumbo_skbuff[idx].skb = skb;
 		pci_unmap_addr_set(&ap->skb->rx_jumbo_skbuff[idx],
@@ -1845,7 +1836,7 @@
 
 		rd = &ap->rx_jumbo_ring[idx];
 		set_aceaddr(&rd->addr, mapping);
-		rd->size = ACE_JUMBO_MTU + ETH_HLEN + 4;
+		rd->size = ACE_JUMBO_BUFSIZE;
 		rd->idx = idx;
 		idx = (idx + 1) % RX_JUMBO_RING_ENTRIES;
 	}
@@ -2027,19 +2018,19 @@
 			 */
 		case 0:
 			rip = &ap->skb->rx_std_skbuff[skbidx];
-			mapsize = ACE_STD_BUFSIZE - (2 + 16);
+			mapsize = ACE_STD_BUFSIZE;
 			rxdesc = &ap->rx_std_ring[skbidx];
 			std_count++;
 			break;
 		case BD_FLG_JUMBO:
 			rip = &ap->skb->rx_jumbo_skbuff[skbidx];
-			mapsize = ACE_JUMBO_BUFSIZE - (2 + 16);
+			mapsize = ACE_JUMBO_BUFSIZE;
 			rxdesc = &ap->rx_jumbo_ring[skbidx];
 			atomic_dec(&ap->cur_jumbo_bufs);
 			break;
 		case BD_FLG_MINI:
 			rip = &ap->skb->rx_mini_skbuff[skbidx];
-			mapsize = ACE_MINI_BUFSIZE - (2 + 16);
+			mapsize = ACE_MINI_BUFSIZE;
 			rxdesc = &ap->rx_mini_ring[skbidx];
 			mini_count++; 
 			break;
diff -urN linux-2.6.8-rc2/drivers/net/acenic_firmware.h linux-2.6.8-rc3/drivers/net/acenic_firmware.h
--- linux-2.6.8-rc2/drivers/net/acenic_firmware.h	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/acenic_firmware.h	2004-08-03 15:21:42.894979620 -0700
@@ -18,9 +18,9 @@
 #define tigonFwBssAddr 0x00015dd0
 #define tigonFwBssLen 0x2080
 #ifdef CONFIG_ACENIC_OMIT_TIGON_I
-#define tigonFwText 0
-#define tigonFwData 0
-#define tigonFwRodata 0
+#define tigonFwText NULL
+#define tigonFwData NULL
+#define tigonFwRodata NULL
 #else
 /* Generated by genfw.c */
 static u32 tigonFwText[(MAX_TEXT_LEN/4) + 1] __initdata = {
diff -urN linux-2.6.8-rc2/drivers/net/amd8111e.c linux-2.6.8-rc3/drivers/net/amd8111e.c
--- linux-2.6.8-rc2/drivers/net/amd8111e.c	2004-06-15 22:19:36.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/amd8111e.c	2004-08-03 15:21:42.897979743 -0700
@@ -701,7 +701,7 @@
 				  	lp->tx_skbuff[tx_index]->len,
 					PCI_DMA_TODEVICE);
 			dev_kfree_skb_irq (lp->tx_skbuff[tx_index]);
-			lp->tx_skbuff[tx_index] = 0;
+			lp->tx_skbuff[tx_index] = NULL;
 			lp->tx_dma_addr[tx_index] = 0;
 		}
 		lp->tx_complete_idx++;
@@ -1544,7 +1544,7 @@
 	if( dev->mc_count == 0 ){
 		/* get only own packets */
 		mc_filter[1] = mc_filter[0] = 0;
-		lp->mc_list = 0;
+		lp->mc_list = NULL;
 		lp->options &= ~OPTION_MULTICAST_ENABLE;
 		amd8111e_writeq(*(u64*)mc_filter,lp->mmio + LADRF);
 		/* disable promiscous mode */
diff -urN linux-2.6.8-rc2/drivers/net/bonding/bond_main.c linux-2.6.8-rc3/drivers/net/bonding/bond_main.c
--- linux-2.6.8-rc2/drivers/net/bonding/bond_main.c	2004-06-15 22:20:03.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/bonding/bond_main.c	2004-08-03 15:21:43.065986635 -0700
@@ -4214,13 +4214,6 @@
 	return 0;
 }
 
-#ifdef CONFIG_NET_FASTROUTE
-static int bond_accept_fastpath(struct net_device *bond_dev, struct dst_entry *dst)
-{
-	return -1;
-}
-#endif
-
 /*------------------------- Device initialization ---------------------------*/
 
 /*
@@ -4294,9 +4287,6 @@
 	bond_set_mode_ops(bond_dev, bond->params.mode);
 
 	bond_dev->destructor = free_netdev;
-#ifdef CONFIG_NET_FASTROUTE
-	bond_dev->accept_fastpath = bond_accept_fastpath;
-#endif
 
 	/* Initialize the device options */
 	bond_dev->tx_queue_len = 0;
diff -urN linux-2.6.8-rc2/drivers/net/cs89x0.c linux-2.6.8-rc3/drivers/net/cs89x0.c
--- linux-2.6.8-rc2/drivers/net/cs89x0.c	2004-08-03 15:21:07.772538915 -0700
+++ linux-2.6.8-rc3/drivers/net/cs89x0.c	2004-08-03 15:21:43.088987579 -0700
@@ -1566,7 +1566,7 @@
 {
 	if (lp->dma_buff) {
 		free_pages((unsigned long)(lp->dma_buff), get_order(lp->dmasize * 1024));
-		lp->dma_buff = 0;
+		lp->dma_buff = NULL;
 	}
 }
 #endif
diff -urN linux-2.6.8-rc2/drivers/net/dgrs_asstruct.h linux-2.6.8-rc3/drivers/net/dgrs_asstruct.h
--- linux-2.6.8-rc2/drivers/net/dgrs_asstruct.h	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/dgrs_asstruct.h	2004-08-03 15:21:43.135989507 -0700
@@ -4,7 +4,7 @@
  *	$Id: asstruct.h,v 1.1.1.1 1994/10/23 05:08:32 rick Exp $
  */
 
-#if ASSEMBLER
+#ifdef ASSEMBLER
 
 #	define MO(t,a)		(a)
 #	define VMO(t,a)		(a)
diff -urN linux-2.6.8-rc2/drivers/net/dgrs_i82596.h linux-2.6.8-rc3/drivers/net/dgrs_i82596.h
--- linux-2.6.8-rc2/drivers/net/dgrs_i82596.h	2004-06-15 22:19:43.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/dgrs_i82596.h	2004-08-03 15:21:43.170990943 -0700
@@ -95,7 +95,7 @@
 /************************************************************************/
 typedef volatile struct _I596_RBD
 {
-#if INTEL_RETENTIVE
+#ifdef INTEL_RETENTIVE
 	ushort			count;	/* Length of data in buf */
 	ushort			offset;
 #else
@@ -103,7 +103,7 @@
 #endif
 	vol struct _I596_RBD	*next;	/* Next buffer descriptor in list */
 	uchar			*buf;	/* Data buffer */
-#if INTEL_RETENTIVE
+#ifdef INTEL_RETENTIVE
 	ushort			size;	/* Size of buf (constant) */
 	ushort			zero;
 #else
diff -urN linux-2.6.8-rc2/drivers/net/dl2k.c linux-2.6.8-rc3/drivers/net/dl2k.c
--- linux-2.6.8-rc2/drivers/net/dl2k.c	2004-06-15 22:19:17.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/dl2k.c	2004-08-03 15:21:43.172991025 -0700
@@ -583,7 +583,7 @@
 
 	/* Initialize Tx descriptors, TFDListPtr leaves in start_xmit(). */
 	for (i = 0; i < TX_RING_SIZE; i++) {
-		np->tx_skbuff[i] = 0;
+		np->tx_skbuff[i] = NULL;
 		np->tx_ring[i].status = cpu_to_le64 (TFDDone);
 		np->tx_ring[i].next_desc = cpu_to_le64 (np->tx_ring_dma +
 					      ((i+1)%TX_RING_SIZE) *
@@ -597,7 +597,7 @@
 						sizeof (struct netdev_desc));
 		np->rx_ring[i].status = 0;
 		np->rx_ring[i].fraginfo = 0;
-		np->rx_skbuff[i] = 0;
+		np->rx_skbuff[i] = NULL;
 	}
 
 	/* Allocate the rx buffers */
@@ -770,7 +770,7 @@
 		else
 			dev_kfree_skb (skb);
 
-		np->tx_skbuff[entry] = 0;
+		np->tx_skbuff[entry] = NULL;
 		entry = (entry + 1) % TX_RING_SIZE;
 		tx_use++;
 	}
@@ -1818,7 +1818,7 @@
 			pci_unmap_single (np->pdev, np->rx_ring[i].fraginfo,
 					  skb->len, PCI_DMA_FROMDEVICE);
 			dev_kfree_skb (skb);
-			np->rx_skbuff[i] = 0;
+			np->rx_skbuff[i] = NULL;
 		}
 	}
 	for (i = 0; i < TX_RING_SIZE; i++) {
@@ -1827,7 +1827,7 @@
 			pci_unmap_single (np->pdev, np->tx_ring[i].fraginfo,
 					  skb->len, PCI_DMA_TODEVICE);
 			dev_kfree_skb (skb);
-			np->tx_skbuff[i] = 0;
+			np->tx_skbuff[i] = NULL;
 		}
 	}
 
diff -urN linux-2.6.8-rc2/drivers/net/dummy.c linux-2.6.8-rc3/drivers/net/dummy.c
--- linux-2.6.8-rc2/drivers/net/dummy.c	2004-08-03 15:21:07.776539079 -0700
+++ linux-2.6.8-rc3/drivers/net/dummy.c	2004-08-03 15:21:43.173991066 -0700
@@ -57,13 +57,6 @@
 {
 }
 
-#ifdef CONFIG_NET_FASTROUTE
-static int dummy_accept_fastpath(struct net_device *dev, struct dst_entry *dst)
-{
-	return -1;
-}
-#endif
-
 static void __init dummy_setup(struct net_device *dev)
 {
 	/* Initialize the device structure. */
@@ -71,9 +64,6 @@
 	dev->hard_start_xmit = dummy_xmit;
 	dev->set_multicast_list = set_multicast_list;
 	dev->set_mac_address = dummy_set_address;
-#ifdef CONFIG_NET_FASTROUTE
-	dev->accept_fastpath = dummy_accept_fastpath;
-#endif
 
 	/* Fill in device structure with ethernet-generic values. */
 	ether_setup(dev);
diff -urN linux-2.6.8-rc2/drivers/net/e1000/e1000.h linux-2.6.8-rc3/drivers/net/e1000/e1000.h
--- linux-2.6.8-rc2/drivers/net/e1000/e1000.h	2004-08-03 15:21:07.777539120 -0700
+++ linux-2.6.8-rc3/drivers/net/e1000/e1000.h	2004-08-03 15:21:43.200992173 -0700
@@ -82,7 +82,7 @@
 
 #include "e1000_hw.h"
 
-#if DBG
+#ifdef DBG
 #define E1000_DBG(args...) printk(KERN_DEBUG "e1000: " args)
 #else
 #define E1000_DBG(args...)
diff -urN linux-2.6.8-rc2/drivers/net/e1000/e1000_osdep.h linux-2.6.8-rc3/drivers/net/e1000/e1000_osdep.h
--- linux-2.6.8-rc2/drivers/net/e1000/e1000_osdep.h	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/e1000/e1000_osdep.h	2004-08-03 15:21:43.243993937 -0700
@@ -63,7 +63,7 @@
 
 #define MSGOUT(S, A, B)	printk(KERN_DEBUG S "\n", A, B)
 
-#if DBG
+#ifdef DBG
 #define DEBUGOUT(S)		printk(KERN_DEBUG S "\n")
 #define DEBUGOUT1(S, A...)	printk(KERN_DEBUG S "\n", A)
 #else
diff -urN linux-2.6.8-rc2/drivers/net/eepro100.c linux-2.6.8-rc3/drivers/net/eepro100.c
--- linux-2.6.8-rc2/drivers/net/eepro100.c	2004-08-03 15:21:07.872543012 -0700
+++ linux-2.6.8-rc3/drivers/net/eepro100.c	2004-08-03 15:21:43.268994963 -0700
@@ -1021,7 +1021,7 @@
 	/* Set up the Tx queue early.. */
 	sp->cur_tx = 0;
 	sp->dirty_tx = 0;
-	sp->last_cmd = 0;
+	sp->last_cmd = NULL;
 	sp->tx_full = 0;
 	sp->in_interrupt = 0;
 
@@ -1355,7 +1355,7 @@
 					le32_to_cpu(sp->tx_ring[entry].tx_buf_addr0),
 					sp->tx_skbuff[entry]->len, PCI_DMA_TODEVICE);
 			dev_kfree_skb_irq(sp->tx_skbuff[entry]);
-			sp->tx_skbuff[entry] = 0;
+			sp->tx_skbuff[entry] = NULL;
 		}
 		sp->dirty_tx++;
 	}
@@ -1559,7 +1559,7 @@
 					le32_to_cpu(sp->tx_ring[entry].tx_buf_addr0),
 					sp->tx_skbuff[entry]->len, PCI_DMA_TODEVICE);
 			dev_kfree_skb_irq(sp->tx_skbuff[entry]);
-			sp->tx_skbuff[entry] = 0;
+			sp->tx_skbuff[entry] = NULL;
 		}
 		dirty_tx++;
 	}
@@ -1932,7 +1932,7 @@
     /* Free all the skbuffs in the Rx and Tx queues. */
 	for (i = 0; i < RX_RING_SIZE; i++) {
 		struct sk_buff *skb = sp->rx_skbuff[i];
-		sp->rx_skbuff[i] = 0;
+		sp->rx_skbuff[i] = NULL;
 		/* Clear the Rx descriptors. */
 		if (skb) {
 			pci_unmap_single(sp->pdev,
@@ -1944,7 +1944,7 @@
 
 	for (i = 0; i < TX_RING_SIZE; i++) {
 		struct sk_buff *skb = sp->tx_skbuff[i];
-		sp->tx_skbuff[i] = 0;
+		sp->tx_skbuff[i] = NULL;
 		/* Clear the Tx descriptors. */
 		if (skb) {
 			pci_unmap_single(sp->pdev,
@@ -2174,7 +2174,7 @@
 		last_cmd = sp->last_cmd;
 		sp->last_cmd = (struct descriptor *)&sp->tx_ring[entry];
 
-		sp->tx_skbuff[entry] = 0;			/* Redundant. */
+		sp->tx_skbuff[entry] = NULL;			/* Redundant. */
 		sp->tx_ring[entry].status = cpu_to_le32(CmdSuspend | CmdConfigure);
 		sp->tx_ring[entry].link =
 			cpu_to_le32(TX_RING_ELEM_DMA(sp, (entry + 1) % TX_RING_SIZE));
@@ -2217,7 +2217,7 @@
 		last_cmd = sp->last_cmd;
 		sp->last_cmd = (struct descriptor *)&sp->tx_ring[entry];
 
-		sp->tx_skbuff[entry] = 0;
+		sp->tx_skbuff[entry] = NULL;
 		sp->tx_ring[entry].status = cpu_to_le32(CmdSuspend | CmdMulticastList);
 		sp->tx_ring[entry].link =
 			cpu_to_le32(TX_RING_ELEM_DMA(sp, (entry + 1) % TX_RING_SIZE));
@@ -2298,7 +2298,7 @@
 		sp->last_cmd = mc_setup_frm;
 
 		/* Change the command to a NoOp, pointing to the CmdMulti command. */
-		sp->tx_skbuff[entry] = 0;
+		sp->tx_skbuff[entry] = NULL;
 		sp->tx_ring[entry].status = cpu_to_le32(CmdNOp);
 		sp->tx_ring[entry].link = cpu_to_le32(mc_blk->frame_dma);
 
diff -urN linux-2.6.8-rc2/drivers/net/epic100.c linux-2.6.8-rc3/drivers/net/epic100.c
--- linux-2.6.8-rc2/drivers/net/epic100.c	2004-08-03 15:21:07.874543094 -0700
+++ linux-2.6.8-rc3/drivers/net/epic100.c	2004-08-03 15:21:43.308996604 -0700
@@ -937,7 +937,7 @@
 		ep->rx_ring[i].buflength = cpu_to_le32(ep->rx_buf_sz);
 		ep->rx_ring[i].next = ep->rx_ring_dma + 
 				      (i+1)*sizeof(struct epic_rx_desc);
-		ep->rx_skbuff[i] = 0;
+		ep->rx_skbuff[i] = NULL;
 	}
 	/* Mark the last entry as wrapping the ring. */
 	ep->rx_ring[i-1].next = ep->rx_ring_dma;
@@ -959,7 +959,7 @@
 	/* The Tx buffer descriptor is filled in as needed, but we
 	   do need to clear the ownership bit. */
 	for (i = 0; i < TX_RING_SIZE; i++) {
-		ep->tx_skbuff[i] = 0;
+		ep->tx_skbuff[i] = NULL;
 		ep->tx_ring[i].txstatus = 0x0000;
 		ep->tx_ring[i].next = ep->tx_ring_dma + 
 			(i+1)*sizeof(struct epic_tx_desc);
@@ -1093,7 +1093,7 @@
 				pci_unmap_single(ep->pci_dev, ep->tx_ring[entry].bufaddr, 
 						 skb->len, PCI_DMA_TODEVICE);
 				dev_kfree_skb_irq(skb);
-				ep->tx_skbuff[entry] = 0;
+				ep->tx_skbuff[entry] = NULL;
 			}
 
 #ifndef final_version
@@ -1274,7 +1274,7 @@
 	/* Free all the skbuffs in the Rx queue. */
 	for (i = 0; i < RX_RING_SIZE; i++) {
 		skb = ep->rx_skbuff[i];
-		ep->rx_skbuff[i] = 0;
+		ep->rx_skbuff[i] = NULL;
 		ep->rx_ring[i].rxstatus = 0;		/* Not owned by Epic chip. */
 		ep->rx_ring[i].buflength = 0;
 		if (skb) {
@@ -1286,7 +1286,7 @@
 	}
 	for (i = 0; i < TX_RING_SIZE; i++) {
 		skb = ep->tx_skbuff[i];
-		ep->tx_skbuff[i] = 0;
+		ep->tx_skbuff[i] = NULL;
 		if (!skb)
 			continue;
 		pci_unmap_single(ep->pci_dev, ep->tx_ring[i].bufaddr, 
diff -urN linux-2.6.8-rc2/drivers/net/eql.c linux-2.6.8-rc3/drivers/net/eql.c
--- linux-2.6.8-rc2/drivers/net/eql.c	2004-08-03 15:21:07.875543135 -0700
+++ linux-2.6.8-rc3/drivers/net/eql.c	2004-08-03 15:21:43.309996645 -0700
@@ -389,7 +389,7 @@
 static int __eql_insert_slave(slave_queue_t *queue, slave_t *slave)
 {
 	if (!eql_is_full(queue)) {
-		slave_t *duplicate_slave = 0;
+		slave_t *duplicate_slave = NULL;
 
 		duplicate_slave = __eql_find_slave_dev(queue, slave->dev);
 		if (duplicate_slave != 0)
diff -urN linux-2.6.8-rc2/drivers/net/ethertap.c linux-2.6.8-rc3/drivers/net/ethertap.c
--- linux-2.6.8-rc2/drivers/net/ethertap.c	2004-06-15 22:19:02.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/ethertap.c	2004-08-03 15:21:43.313996809 -0700
@@ -13,7 +13,7 @@
  
 #include <linux/config.h>
 #include <linux/module.h>
-
+#include <linux/moduleparam.h>
 #include <linux/kernel.h>
 #include <linux/jiffies.h>
 #include <linux/slab.h>
@@ -45,7 +45,7 @@
 static int ethertap_debug;
 
 static int max_taps = 1;
-MODULE_PARM(max_taps, "i");
+module_param(max_taps, int, 0);
 MODULE_PARM_DESC(max_taps,"Max number of ethernet tap devices");
 
 static struct net_device **tap_map;	/* Returns the tap device for a given netlink */
diff -urN linux-2.6.8-rc2/drivers/net/hamachi.c linux-2.6.8-rc3/drivers/net/hamachi.c
--- linux-2.6.8-rc2/drivers/net/hamachi.c	2004-08-03 15:21:07.977547314 -0700
+++ linux-2.6.8-rc3/drivers/net/hamachi.c	2004-08-03 15:21:43.496004276 -0700
@@ -1017,7 +1017,7 @@
 				hmp->tx_ring[entry].addr, skb->len, 
 				PCI_DMA_TODEVICE);
 			dev_kfree_skb(skb);
-			hmp->tx_skbuff[entry] = 0;
+			hmp->tx_skbuff[entry] = NULL;
 		}
 		hmp->tx_ring[entry].status_n_length = 0;
 		if (entry >= TX_RING_SIZE-1) 
@@ -1105,7 +1105,7 @@
 			pci_unmap_single(hmp->pci_dev, hmp->tx_ring[i].addr, 
 				skb->len, PCI_DMA_TODEVICE);
 			dev_kfree_skb(skb);
-			hmp->tx_skbuff[i] = 0;
+			hmp->tx_skbuff[i] = NULL;
 		}
 	}
 
@@ -1127,7 +1127,7 @@
 			pci_unmap_single(hmp->pci_dev, hmp->rx_ring[i].addr, 
 				hmp->rx_buf_sz, PCI_DMA_FROMDEVICE);
 			dev_kfree_skb(skb);
-			hmp->rx_skbuff[i] = 0;
+			hmp->rx_skbuff[i] = NULL;
 		}
 	}
 	/* Fill in the Rx buffers.  Handle allocation failure gracefully. */
@@ -1189,7 +1189,7 @@
 	/* Initialize all Rx descriptors. */
 	for (i = 0; i < RX_RING_SIZE; i++) {
 		hmp->rx_ring[i].status_n_length = 0;
-		hmp->rx_skbuff[i] = 0;
+		hmp->rx_skbuff[i] = NULL;
 	}
 	/* Fill in the Rx buffers.  Handle allocation failure gracefully. */
 	for (i = 0; i < RX_RING_SIZE; i++) {
@@ -1209,7 +1209,7 @@
 	hmp->rx_ring[RX_RING_SIZE-1].status_n_length |= cpu_to_le32(DescEndRing);
 
 	for (i = 0; i < TX_RING_SIZE; i++) {
-		hmp->tx_skbuff[i] = 0;
+		hmp->tx_skbuff[i] = NULL;
 		hmp->tx_ring[i].status_n_length = 0;
 	}
 	/* Mark the last entry of the ring */
@@ -1421,7 +1421,7 @@
 							skb->len,
 							PCI_DMA_TODEVICE);
 						dev_kfree_skb_irq(skb);
-						hmp->tx_skbuff[entry] = 0;
+						hmp->tx_skbuff[entry] = NULL;
 					}
 					hmp->tx_ring[entry].status_n_length = 0;
 					if (entry >= TX_RING_SIZE-1)  
@@ -1791,7 +1791,7 @@
 				hmp->rx_ring[i].addr, hmp->rx_buf_sz, 
 				PCI_DMA_FROMDEVICE);
 			dev_kfree_skb(skb);
-			hmp->rx_skbuff[i] = 0;
+			hmp->rx_skbuff[i] = NULL;
 		}
 	}
 	for (i = 0; i < TX_RING_SIZE; i++) {
@@ -1801,7 +1801,7 @@
 				hmp->tx_ring[i].addr, skb->len, 
 				PCI_DMA_TODEVICE);
 			dev_kfree_skb(skb);
-			hmp->tx_skbuff[i] = 0;
+			hmp->tx_skbuff[i] = NULL;
 		}
 	}
 
diff -urN linux-2.6.8-rc2/drivers/net/hamradio/6pack.c linux-2.6.8-rc3/drivers/net/hamradio/6pack.c
--- linux-2.6.8-rc2/drivers/net/hamradio/6pack.c	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/hamradio/6pack.c	2004-08-03 15:21:43.528005588 -0700
@@ -731,7 +731,7 @@
 
 	write_lock(&disc_data_lock);
 	sp = tty->disc_data;
-	tty->disc_data = 0;
+	tty->disc_data = NULL;
 	write_unlock(&disc_data_lock);
 	if (sp == 0)
 		return;
@@ -750,7 +750,7 @@
 	unregister_netdev(sp->dev);
 }
 
-static int sp_set_mac_address(struct net_device *dev, void *addr)
+static int sp_set_mac_address(struct net_device *dev, void __user *addr)
 {
 	return copy_from_user(dev->dev_addr, addr, AX25_ADDR_LEN) ? -EFAULT : 0;
 }
@@ -767,16 +767,16 @@
 
 	switch(cmd) {
 	case SIOCGIFNAME:
-		err = copy_to_user((void *) arg, sp->dev->name,
+		err = copy_to_user((void __user *) arg, sp->dev->name,
 		                   strlen(sp->dev->name) + 1) ? -EFAULT : 0;
 		break;
 
 	case SIOCGIFENCAP:
-		err = put_user(0, (int *)arg);
+		err = put_user(0, (int __user *)arg);
 		break;
 
 	case SIOCSIFENCAP:
-		if (get_user(tmp, (int *) arg)) {
+		if (get_user(tmp, (int __user *) arg)) {
 			err = -EFAULT;
 			break;
 		}
@@ -790,7 +790,7 @@
 		break;
 
 	 case SIOCSIFHWADDR:
-		err = sp_set_mac_address(sp->dev, (void *) arg);
+		err = sp_set_mac_address(sp->dev, (void __user *) arg);
 		break;
 
 	/* Allow stty to read, but not set, the serial port */
diff -urN linux-2.6.8-rc2/drivers/net/hamradio/mkiss.c linux-2.6.8-rc3/drivers/net/hamradio/mkiss.c
--- linux-2.6.8-rc2/drivers/net/hamradio/mkiss.c	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/hamradio/mkiss.c	2004-08-03 15:21:43.541006122 -0700
@@ -626,7 +626,7 @@
 
 	unregister_netdev(ax->dev);
 
-	tty->disc_data = 0;
+	tty->disc_data = NULL;
 	ax->tty        = NULL;
 
 	ax_free(ax);
@@ -774,7 +774,7 @@
 }
 
 
-static int ax_set_mac_address(struct net_device *dev, void *addr)
+static int ax_set_mac_address(struct net_device *dev, void __user *addr)
 {
 	if (copy_from_user(dev->dev_addr, addr, AX25_ADDR_LEN))
 		return -EFAULT;
@@ -792,7 +792,7 @@
 
 
 /* Perform I/O control on an active ax25 channel. */
-static int ax25_disp_ioctl(struct tty_struct *tty, void *file, int cmd, void *arg)
+static int ax25_disp_ioctl(struct tty_struct *tty, void *file, int cmd, void __user *arg)
 {
 	struct ax_disp *ax = (struct ax_disp *) tty->disc_data;
 	unsigned int tmp;
@@ -808,10 +808,10 @@
 			return 0;
 
 		case SIOCGIFENCAP:
-			return put_user(4, (int *)arg);
+			return put_user(4, (int __user *)arg);
 
 		case SIOCSIFENCAP:
-			if (get_user(tmp, (int *)arg))
+			if (get_user(tmp, (int __user *)arg))
 				return -EFAULT;
 			ax->mode = tmp;
 			ax->dev->addr_len        = AX25_ADDR_LEN;	  /* sizeof an AX.25 addr */
diff -urN linux-2.6.8-rc2/drivers/net/hamradio/scc.c linux-2.6.8-rc3/drivers/net/hamradio/scc.c
--- linux-2.6.8-rc2/drivers/net/hamradio/scc.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/hamradio/scc.c	2004-08-03 15:21:43.543006204 -0700
@@ -7,7 +7,7 @@
  *            ------------------
  *
  * You can find a subset of the documentation in 
- * linux/Documentation/networking/z8530drv.txt.
+ * Documentation/networking/z8530drv.txt.
  */
 
 /*
diff -urN linux-2.6.8-rc2/drivers/net/irda/Kconfig linux-2.6.8-rc3/drivers/net/irda/Kconfig
--- linux-2.6.8-rc2/drivers/net/irda/Kconfig	2004-08-03 15:21:07.985547642 -0700
+++ linux-2.6.8-rc3/drivers/net/irda/Kconfig	2004-08-03 15:21:43.623009486 -0700
@@ -333,7 +333,7 @@
 
 config TOSHIBA_FIR
 	tristate "Toshiba Type-O IR Port"
-	depends on IRDA && !64BIT
+	depends on IRDA && PCI && !64BIT
 	help
 	  Say Y here if you want to build support for the Toshiba Type-O IR
 	  and Donau oboe chipsets. These chipsets are used by the Toshiba
@@ -385,7 +385,7 @@
 
 config VIA_FIR
 	tristate "VIA VT8231/VT1211 SIR/MIR/FIR"
-	depends on IRDA && ISA
+	depends on IRDA && ISA && PCI
 	help
 	  Say Y here if you want to build support for the VIA VT8231
 	  and VIA VT1211 IrDA controllers, found on the motherboards using
diff -urN linux-2.6.8-rc2/drivers/net/ixgb/ixgb_hw.c linux-2.6.8-rc3/drivers/net/ixgb/ixgb_hw.c
--- linux-2.6.8-rc2/drivers/net/ixgb/ixgb_hw.c	2004-06-15 22:19:42.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/ixgb/ixgb_hw.c	2004-08-03 15:21:44.027026060 -0700
@@ -67,7 +67,7 @@
 	/* Delay a few ms just to allow the reset to complete */
 	msec_delay(IXGB_DELAY_AFTER_RESET);
 	ctrl_reg = IXGB_READ_REG(hw, CTRL0);
-#if DBG
+#ifdef DBG
 	/* Make sure the self-clearing global reset bit did self clear */
 	ASSERT(!(ctrl_reg & IXGB_CTRL0_RST));
 #endif
diff -urN linux-2.6.8-rc2/drivers/net/ixgb/ixgb_osdep.h linux-2.6.8-rc3/drivers/net/ixgb/ixgb_osdep.h
--- linux-2.6.8-rc2/drivers/net/ixgb/ixgb_osdep.h	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/ixgb/ixgb_osdep.h	2004-08-03 15:21:44.050027003 -0700
@@ -64,7 +64,7 @@
 #define ASSERT(x)	if(!(x)) BUG()
 #define MSGOUT(S, A, B)	printk(KERN_DEBUG S "\n", A, B)
 
-#if DBG
+#ifdef DBG
 #define DEBUGOUT(S)		printk(KERN_DEBUG S "\n")
 #define DEBUGOUT1(S, A...)	printk(KERN_DEBUG S "\n", A)
 #else
diff -urN linux-2.6.8-rc2/drivers/net/lance.c linux-2.6.8-rc3/drivers/net/lance.c
--- linux-2.6.8-rc2/drivers/net/lance.c	2004-08-03 15:21:08.005548461 -0700
+++ linux-2.6.8-rc3/drivers/net/lance.c	2004-08-03 15:21:44.101029095 -0700
@@ -834,7 +834,7 @@
 	/* Free all the skbuffs in the Rx and Tx queues. */
 	for (i = 0; i < RX_RING_SIZE; i++) {
 		struct sk_buff *skb = lp->rx_skbuff[i];
-		lp->rx_skbuff[i] = 0;
+		lp->rx_skbuff[i] = NULL;
 		lp->rx_ring[i].base = 0;		/* Not owned by LANCE chip. */
 		if (skb)
 			dev_kfree_skb_any(skb);
@@ -878,7 +878,7 @@
 	/* The Tx buffer address is filled in as needed, but we do need to clear
 	   the upper ownership bit. */
 	for (i = 0; i < TX_RING_SIZE; i++) {
-		lp->tx_skbuff[i] = 0;
+		lp->tx_skbuff[i] = NULL;
 		lp->tx_ring[i].base = 0;
 	}
 
@@ -1083,7 +1083,7 @@
 				   in the bounce buffer. */
 				if (lp->tx_skbuff[entry]) {
 					dev_kfree_skb_irq(lp->tx_skbuff[entry]);
-					lp->tx_skbuff[entry] = 0;
+					lp->tx_skbuff[entry] = NULL;
 				}
 				dirty_tx++;
 			}
diff -urN linux-2.6.8-rc2/drivers/net/lp486e.c linux-2.6.8-rc3/drivers/net/lp486e.c
--- linux-2.6.8-rc2/drivers/net/lp486e.c	2004-08-03 15:21:08.009548625 -0700
+++ linux-2.6.8-rc3/drivers/net/lp486e.c	2004-08-03 15:21:44.113029588 -0700
@@ -479,7 +479,7 @@
 		kfree(rfd);
 	} while (rfd != lp->rx_tail);
 
-	lp->rx_tail = 0;
+	lp->rx_tail = NULL;
 
 #if 0
 	for (lp->rbd_list) {
diff -urN linux-2.6.8-rc2/drivers/net/mace.c linux-2.6.8-rc3/drivers/net/mace.c
--- linux-2.6.8-rc2/drivers/net/mace.c	2004-06-15 22:19:03.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/mace.c	2004-08-03 15:21:44.124030039 -0700
@@ -432,7 +432,7 @@
     for (i = 0; i < N_RX_RING; ++i) {
 	if (mp->rx_bufs[i] != 0) {
 	    dev_kfree_skb(mp->rx_bufs[i]);
-	    mp->rx_bufs[i] = 0;
+	    mp->rx_bufs[i] = NULL;
 	}
     }
     for (i = mp->tx_empty; i != mp->tx_fill; ) {
@@ -475,7 +475,7 @@
 	cp->xfer_status = 0;
 	++cp;
     }
-    mp->rx_bufs[i] = 0;
+    mp->rx_bufs[i] = NULL;
     st_le16(&cp->command, DBDMA_STOP);
     mp->rx_fill = i;
     mp->rx_empty = 0;
@@ -959,7 +959,7 @@
 		mp->stats.rx_bytes += skb->len;
 		netif_rx(skb);
 		dev->last_rx = jiffies;
-		mp->rx_bufs[i] = 0;
+		mp->rx_bufs[i] = NULL;
 		++mp->stats.rx_packets;
 	    }
 	} else {
diff -urN linux-2.6.8-rc2/drivers/net/myri_sbus.c linux-2.6.8-rc3/drivers/net/myri_sbus.c
--- linux-2.6.8-rc2/drivers/net/myri_sbus.c	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/myri_sbus.c	2004-08-03 15:21:44.126030121 -0700
@@ -1129,7 +1129,7 @@
 static int __init myri_sbus_probe(void)
 {
 	struct sbus_bus *bus;
-	struct sbus_dev *sdev = 0;
+	struct sbus_dev *sdev = NULL;
 	static int called;
 	int cards = 0, v;
 
diff -urN linux-2.6.8-rc2/drivers/net/ne.c linux-2.6.8-rc3/drivers/net/ne.c
--- linux-2.6.8-rc2/drivers/net/ne.c	2004-08-03 15:21:08.017548953 -0700
+++ linux-2.6.8-rc3/drivers/net/ne.c	2004-08-03 15:21:44.157031393 -0700
@@ -111,7 +111,7 @@
     {"PCM-4823", "PCM-4823", {0x00, 0xc0, 0x6c}}, /* Broken Advantech MoBo */
     {"REALTEK", "RTL8019", {0x00, 0x00, 0xe8}}, /* no-name with Realtek chip */
     {"LCS-8834", "LCS-8836", {0x04, 0x04, 0x37}}, /* ShinyNet (SET) */
-    {0,}
+    {NULL,}
 };
 #endif
 
diff -urN linux-2.6.8-rc2/drivers/net/ns83820.c linux-2.6.8-rc3/drivers/net/ns83820.c
--- linux-2.6.8-rc2/drivers/net/ns83820.c	2004-08-03 15:21:08.029549444 -0700
+++ linux-2.6.8-rc3/drivers/net/ns83820.c	2004-08-03 15:21:44.294037013 -0700
@@ -1089,7 +1089,7 @@
 
 	frag = skb_shinfo(skb)->frags;
 	if (!nr_frags)
-		frag = 0;
+		frag = NULL;
 	extsts = 0;
 	if (skb->ip_summed == CHECKSUM_HW) {
 		extsts |= EXTSTS_IPPKT;
diff -urN linux-2.6.8-rc2/drivers/net/pcmcia/nmclan_cs.c linux-2.6.8-rc3/drivers/net/pcmcia/nmclan_cs.c
--- linux-2.6.8-rc2/drivers/net/pcmcia/nmclan_cs.c	2004-08-03 15:21:08.121553213 -0700
+++ linux-2.6.8-rc3/drivers/net/pcmcia/nmclan_cs.c	2004-08-03 15:21:44.521046325 -0700
@@ -1472,7 +1472,7 @@
 	Modified from Am79C90 data sheet.
 ---------------------------------------------------------------------------- */
 
-#if BROKEN_MULTICAST
+#ifdef BROKEN_MULTICAST
 
 static void updateCRC(int *CRC, int bit)
 {
diff -urN linux-2.6.8-rc2/drivers/net/ppp_async.c linux-2.6.8-rc3/drivers/net/ppp_async.c
--- linux-2.6.8-rc2/drivers/net/ppp_async.c	2004-08-03 15:21:08.131553623 -0700
+++ linux-2.6.8-rc3/drivers/net/ppp_async.c	2004-08-03 15:21:44.593049279 -0700
@@ -208,7 +208,7 @@
 
 	write_lock_irq(&disc_data_lock);
 	ap = tty->disc_data;
-	tty->disc_data = 0;
+	tty->disc_data = NULL;
 	write_unlock_irq(&disc_data_lock);
 	if (ap == 0)
 		return;
@@ -606,7 +606,7 @@
 	ap->olim = buf;
 
 	kfree_skb(ap->tpkt);
-	ap->tpkt = 0;
+	ap->tpkt = NULL;
 	return 1;
 }
 
@@ -705,7 +705,7 @@
 	clear_bit(XMIT_BUSY, &ap->xmit_flags);
 	if (ap->tpkt != 0) {
 		kfree_skb(ap->tpkt);
-		ap->tpkt = 0;
+		ap->tpkt = NULL;
 		clear_bit(XMIT_FULL, &ap->xmit_flags);
 		done = 1;
 	}
@@ -727,7 +727,7 @@
 	ap->optr = ap->olim;
 	if (ap->tpkt != NULL) {
 		kfree_skb(ap->tpkt);
-		ap->tpkt = 0;
+		ap->tpkt = NULL;
 		clear_bit(XMIT_FULL, &ap->xmit_flags);
 		done = 1;
 	}
@@ -805,7 +805,7 @@
 	/* queue the frame to be processed */
 	skb->cb[0] = ap->state;
 	skb_queue_tail(&ap->rqueue, skb);
-	ap->rpkt = 0;
+	ap->rpkt = NULL;
 	ap->state = 0;
 	return;
 
diff -urN linux-2.6.8-rc2/drivers/net/ppp_generic.c linux-2.6.8-rc3/drivers/net/ppp_generic.c
--- linux-2.6.8-rc2/drivers/net/ppp_generic.c	2004-08-03 15:21:08.133553705 -0700
+++ linux-2.6.8-rc3/drivers/net/ppp_generic.c	2004-08-03 15:21:44.659051987 -0700
@@ -371,7 +371,7 @@
 	struct ppp *ppp;
 
 	if (pf != 0) {
-		file->private_data = 0;
+		file->private_data = NULL;
 		if (pf->kind == INTERFACE) {
 			ppp = PF_TO_PPP(pf);
 			if (file == ppp->owner)
@@ -397,7 +397,7 @@
 	struct ppp_file *pf = file->private_data;
 	DECLARE_WAITQUEUE(wait, current);
 	ssize_t ret;
-	struct sk_buff *skb = 0;
+	struct sk_buff *skb = NULL;
 
 	ret = count;
 
@@ -1161,7 +1161,7 @@
 	list = &ppp->channels;
 	if (list_empty(list)) {
 		/* nowhere to send the packet, just drop it */
-		ppp->xmit_pending = 0;
+		ppp->xmit_pending = NULL;
 		kfree_skb(skb);
 		return;
 	}
@@ -1174,11 +1174,11 @@
 		spin_lock_bh(&pch->downl);
 		if (pch->chan) {
 			if (pch->chan->ops->start_xmit(pch->chan, skb))
-				ppp->xmit_pending = 0;
+				ppp->xmit_pending = NULL;
 		} else {
 			/* channel got unregistered */
 			kfree_skb(skb);
-			ppp->xmit_pending = 0;
+			ppp->xmit_pending = NULL;
 		}
 		spin_unlock_bh(&pch->downl);
 		return;
@@ -1191,7 +1191,7 @@
 		return;
 #endif /* CONFIG_PPP_MULTILINK */
 
-	ppp->xmit_pending = 0;
+	ppp->xmit_pending = NULL;
 	kfree_skb(skb);
 }
 
@@ -1976,7 +1976,7 @@
 
 	if (pch == 0)
 		return;		/* should never happen */
-	chan->ppp = 0;
+	chan->ppp = NULL;
 
 	/*
 	 * This ensures that we have returned from any calls into the
@@ -1984,7 +1984,7 @@
 	 */
 	down_write(&pch->chan_sem);
 	spin_lock_bh(&pch->downl);
-	pch->chan = 0;
+	pch->chan = NULL;
 	spin_unlock_bh(&pch->downl);
 	up_write(&pch->chan_sem);
 	ppp_disconnect_channel(pch);
@@ -2187,11 +2187,11 @@
 	ppp->xstate = 0;
 	xcomp = ppp->xcomp;
 	xstate = ppp->xc_state;
-	ppp->xc_state = 0;
+	ppp->xc_state = NULL;
 	ppp->rstate = 0;
 	rcomp = ppp->rcomp;
 	rstate = ppp->rc_state;
-	ppp->rc_state = 0;
+	ppp->rc_state = NULL;
 	ppp_unlock(ppp);
 
 	if (xstate) {
@@ -2224,7 +2224,7 @@
 		if (ce->comp->compress_proto == proto)
 			return ce;
 	}
-	return 0;
+	return NULL;
 }
 
 /* Register a compressor */
@@ -2269,7 +2269,7 @@
 find_compressor(int type)
 {
 	struct compressor_entry *ce;
-	struct compressor *cp = 0;
+	struct compressor *cp = NULL;
 
 	spin_lock(&compressor_list_lock);
 	ce = find_comp_entry(type);
@@ -2413,7 +2413,7 @@
 	down(&all_ppp_sem);
 	ppp_lock(ppp);
 	dev = ppp->dev;
-	ppp->dev = 0;
+	ppp->dev = NULL;
 	ppp_unlock(ppp);
 	/* This will call dev_close() for us. */
 	if (dev) {
@@ -2447,7 +2447,7 @@
 	ppp_ccp_closed(ppp);
 	if (ppp->vj) {
 		slhc_free(ppp->vj);
-		ppp->vj = 0;
+		ppp->vj = NULL;
 	}
 	skb_queue_purge(&ppp->file.xq);
 	skb_queue_purge(&ppp->file.rq);
@@ -2461,7 +2461,7 @@
 	}
 	if (ppp->active_filter) {
 		kfree(ppp->active_filter);
-		ppp->active_filter = 0;
+		ppp->active_filter = NULL;
 	}
 #endif /* CONFIG_PPP_FILTER */
 
@@ -2507,7 +2507,7 @@
 		if (pch->file.index == unit)
 			return pch;
 	}
-	return 0;
+	return NULL;
 }
 
 /*
diff -urN linux-2.6.8-rc2/drivers/net/ppp_synctty.c linux-2.6.8-rc3/drivers/net/ppp_synctty.c
--- linux-2.6.8-rc2/drivers/net/ppp_synctty.c	2004-08-03 15:21:08.135553787 -0700
+++ linux-2.6.8-rc3/drivers/net/ppp_synctty.c	2004-08-03 15:21:44.676052684 -0700
@@ -259,7 +259,7 @@
 
 	write_lock_irq(&disc_data_lock);
 	ap = tty->disc_data;
-	tty->disc_data = 0;
+	tty->disc_data = NULL;
 	write_unlock_irq(&disc_data_lock);
 	if (ap == 0)
 		return;
@@ -656,7 +656,7 @@
 				tty_stuffed = 1;
 			} else {
 				kfree_skb(ap->tpkt);
-				ap->tpkt = 0;
+				ap->tpkt = NULL;
 				clear_bit(XMIT_FULL, &ap->xmit_flags);
 				done = 1;
 			}
@@ -675,7 +675,7 @@
 flush:
 	if (ap->tpkt != 0) {
 		kfree_skb(ap->tpkt);
-		ap->tpkt = 0;
+		ap->tpkt = NULL;
 		clear_bit(XMIT_FULL, &ap->xmit_flags);
 		done = 1;
 	}
@@ -695,7 +695,7 @@
 	spin_lock_bh(&ap->xmit_lock);
 	if (ap->tpkt != NULL) {
 		kfree_skb(ap->tpkt);
-		ap->tpkt = 0;
+		ap->tpkt = NULL;
 		clear_bit(XMIT_FULL, &ap->xmit_flags);
 		done = 1;
 	}
diff -urN linux-2.6.8-rc2/drivers/net/pppoe.c linux-2.6.8-rc3/drivers/net/pppoe.c
--- linux-2.6.8-rc2/drivers/net/pppoe.c	2004-08-03 15:21:08.136553828 -0700
+++ linux-2.6.8-rc3/drivers/net/pppoe.c	2004-08-03 15:21:44.765056335 -0700
@@ -79,6 +79,8 @@
 #define PPPOE_HASH_BITS 4
 #define PPPOE_HASH_SIZE (1<<PPPOE_HASH_BITS)
 
+static struct ppp_channel_ops pppoe_chan_ops;
+
 static int pppoe_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 static int pppoe_xmit(struct ppp_channel *chan, struct sk_buff *skb);
 static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb);
diff -urN linux-2.6.8-rc2/drivers/net/sb1000.c linux-2.6.8-rc3/drivers/net/sb1000.c
--- linux-2.6.8-rc2/drivers/net/sb1000.c	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/sb1000.c	2004-08-03 15:21:44.823058715 -0700
@@ -799,7 +799,7 @@
 			skb ? session_id : session_id | 0x40, frame_id);
 	if (skb) {
 		dev_kfree_skb(skb);
-		skb = 0;
+		skb = NULL;
 	}
 
 good_frame:
@@ -875,7 +875,7 @@
 	dev->last_rx = jiffies;
 	stats->rx_bytes+=dlen;
 	stats->rx_packets++;
-	lp->rx_skb[ns] = 0;
+	lp->rx_skb[ns] = NULL;
 	lp->rx_session_id[ns] |= 0x40;
 	return 0;
 
@@ -893,7 +893,7 @@
 	if (ns < NPIDS) {
 		if ((skb = lp->rx_skb[ns])) {
 			dev_kfree_skb(skb);
-			lp->rx_skb[ns] = 0;
+			lp->rx_skb[ns] = NULL;
 		}
 		lp->rx_session_id[ns] |= 0x40;
 	}
diff -urN linux-2.6.8-rc2/drivers/net/seeq8005.c linux-2.6.8-rc3/drivers/net/seeq8005.c
--- linux-2.6.8-rc2/drivers/net/seeq8005.c	2004-06-15 22:19:44.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/seeq8005.c	2004-08-03 15:21:44.858060151 -0700
@@ -414,6 +414,27 @@
 	return 0;
 }
 
+/*
+ * wait_for_buffer
+ *
+ * This routine waits for the SEEQ chip to assert that the FIFO is ready
+ * by checking for a window interrupt, and then clearing it. This has to
+ * occur in the interrupt handler!
+ */
+inline void wait_for_buffer(struct net_device * dev)
+{
+	int ioaddr = dev->base_addr;
+	unsigned long tmp;
+	int status;
+	
+	tmp = jiffies + HZ;
+	while ( ( ((status=inw(SEEQ_STATUS)) & SEEQSTAT_WINDOW_INT) != SEEQSTAT_WINDOW_INT) && time_before(jiffies, tmp))
+		cpu_relax();
+		
+	if ( (status & SEEQSTAT_WINDOW_INT) == SEEQSTAT_WINDOW_INT)
+		outw( SEEQCMD_WINDOW_INT_ACK | (status & SEEQCMD_INT_MASK), SEEQ_CMD);
+}
+
 /* The typical workload of the driver:
    Handle the network interface interrupts. */
 static irqreturn_t seeq8005_interrupt(int irq, void *dev_id, struct pt_regs * regs)
@@ -712,27 +733,6 @@
 }
 
 
-/*
- * wait_for_buffer
- *
- * This routine waits for the SEEQ chip to assert that the FIFO is ready
- * by checking for a window interrupt, and then clearing it. This has to
- * occur in the interrupt handler!
- */
-inline void wait_for_buffer(struct net_device * dev)
-{
-	int ioaddr = dev->base_addr;
-	unsigned long tmp;
-	int status;
-	
-	tmp = jiffies + HZ;
-	while ( ( ((status=inw(SEEQ_STATUS)) & SEEQSTAT_WINDOW_INT) != SEEQSTAT_WINDOW_INT) && time_before(jiffies, tmp))
-		cpu_relax();
-		
-	if ( (status & SEEQSTAT_WINDOW_INT) == SEEQSTAT_WINDOW_INT)
-		outw( SEEQCMD_WINDOW_INT_ACK | (status & SEEQCMD_INT_MASK), SEEQ_CMD);
-}
-	
 #ifdef MODULE
 
 static struct net_device *dev_seeq;
diff -urN linux-2.6.8-rc2/drivers/net/sis900.c linux-2.6.8-rc3/drivers/net/sis900.c
--- linux-2.6.8-rc2/drivers/net/sis900.c	2004-08-03 15:21:08.148554320 -0700
+++ linux-2.6.8-rc3/drivers/net/sis900.c	2004-08-03 15:21:44.876060889 -0700
@@ -126,7 +126,7 @@
 	{ "NS 83851 PHY",			0x2000, 0x5C20, MIX },
 	{ "Realtek RTL8201 PHY",		0x0000, 0x8200, LAN },
 	{ "VIA 6103 PHY",			0x0101, 0x8f20, LAN },
-	{0,},
+	{NULL,},
 };
 
 struct mii_phy {
@@ -1452,7 +1452,7 @@
 				sis_priv->tx_ring[i].bufptr, skb->len,
 				PCI_DMA_TODEVICE);
 			dev_kfree_skb_irq(skb);
-			sis_priv->tx_skbuff[i] = 0;
+			sis_priv->tx_skbuff[i] = NULL;
 			sis_priv->tx_ring[i].cmdsts = 0;
 			sis_priv->tx_ring[i].bufptr = 0;
 			sis_priv->stats.tx_dropped++;
@@ -1847,7 +1847,7 @@
 				sis_priv->rx_ring[i].bufptr,
 				RX_BUF_SIZE, PCI_DMA_FROMDEVICE);
 			dev_kfree_skb(skb);
-			sis_priv->rx_skbuff[i] = 0;
+			sis_priv->rx_skbuff[i] = NULL;
 		}
 	}
 	for (i = 0; i < NUM_TX_DESC; i++) {
@@ -1857,7 +1857,7 @@
 				sis_priv->tx_ring[i].bufptr, skb->len,
 				PCI_DMA_TODEVICE);
 			dev_kfree_skb(skb);
-			sis_priv->tx_skbuff[i] = 0;
+			sis_priv->tx_skbuff[i] = NULL;
 		}
 	}
 
diff -urN linux-2.6.8-rc2/drivers/net/skfp/fplustm.c linux-2.6.8-rc3/drivers/net/skfp/fplustm.c
--- linux-2.6.8-rc2/drivers/net/skfp/fplustm.c	2004-08-03 15:21:08.172555303 -0700
+++ linux-2.6.8-rc3/drivers/net/skfp/fplustm.c	2004-08-03 15:21:45.414082960 -0700
@@ -1075,7 +1075,7 @@
 		for (i = 0 ; i < 6 ; i++, p++)
 			*p = canonical[*p] ;
 	}
-	slot = 0 ;
+	slot = NULL;
 	for (i = 0, tb = smc->hw.fp.mc.table ; i < FPMAX_MULTICAST ; i++, tb++){
 		if (!tb->n) {		/* not used */
 			if (!del && !slot)	/* if !del save first free */
diff -urN linux-2.6.8-rc2/drivers/net/skfp/hwmtm.c linux-2.6.8-rc3/drivers/net/skfp/hwmtm.c
--- linux-2.6.8-rc2/drivers/net/skfp/hwmtm.c	2004-08-03 15:21:08.177555508 -0700
+++ linux-2.6.8-rc3/drivers/net/skfp/hwmtm.c	2004-08-03 15:21:45.519087268 -0700
@@ -1981,7 +1981,7 @@
 {
 	struct s_smt_tx_queue *queue ;
 	struct s_smt_fp_txd volatile *t1 ;
-	struct s_smt_fp_txd volatile *t2=0 ;
+	struct s_smt_fp_txd volatile *t2 = NULL ;
 	SMbuf *mb ;
 	u_long	tbctrl ;
 	int i ;
diff -urN linux-2.6.8-rc2/drivers/net/skfp/pmf.c linux-2.6.8-rc3/drivers/net/skfp/pmf.c
--- linux-2.6.8-rc2/drivers/net/skfp/pmf.c	2004-08-03 15:21:08.182555713 -0700
+++ linux-2.6.8-rc3/drivers/net/skfp/pmf.c	2004-08-03 15:21:45.528087637 -0700
@@ -558,8 +558,8 @@
 {
 	struct smt_para	*pa ;
 	const struct s_p_tab	*pt ;
-	struct fddi_mib_m *mib_m = 0 ;
-	struct fddi_mib_p *mib_p = 0 ;
+	struct fddi_mib_m *mib_m = NULL;
+	struct fddi_mib_p *mib_p = NULL;
 	int		len ;
 	int		plen ;
 	char		*from ;
@@ -644,7 +644,7 @@
 	/*
 	 * check special paras
 	 */
-	swap = 0 ;
+	swap = NULL;
 	switch (para) {
 	case SMT_P10F0 :
 	case SMT_P10F1 :
@@ -1091,9 +1091,9 @@
 	char		c ;
 	char		*mib_addr ;
 	struct fddi_mib	*mib ;
-	struct fddi_mib_m	*mib_m = 0 ;
-	struct fddi_mib_a	*mib_a = 0 ;
-	struct fddi_mib_p	*mib_p = 0 ;
+	struct fddi_mib_m	*mib_m = NULL;
+	struct fddi_mib_a	*mib_a = NULL;
+	struct fddi_mib_p	*mib_p = NULL;
 	int		mac ;
 	int		path ;
 	int		port ;
@@ -1533,7 +1533,7 @@
 	const struct s_p_tab	*pt ;
 	for (pt = p_tab ; pt->p_num && pt->p_num != para ; pt++)
 		;
-	return(pt->p_num ? pt : 0) ;
+	return(pt->p_num ? pt : NULL) ;
 }
 
 static int smt_mib_phys(struct s_smc *smc)
diff -urN linux-2.6.8-rc2/drivers/net/skfp/smt.c linux-2.6.8-rc3/drivers/net/skfp/smt.c
--- linux-2.6.8-rc2/drivers/net/skfp/smt.c	2004-08-03 15:21:08.189555999 -0700
+++ linux-2.6.8-rc3/drivers/net/skfp/smt.c	2004-08-03 15:21:45.535087924 -0700
@@ -1701,7 +1701,7 @@
 	char	*p ;
 	int	len ;
 	int	plen ;
-	void	*found = 0 ;
+	void	*found = NULL;
 
 	SK_UNUSED(smc) ;
 
@@ -1715,16 +1715,16 @@
 		len -= plen ;
 		if (len < 0) {
 			DB_SMT("SMT : sm_to_para - length error %d\n",plen,0) ;
-			return(0) ;
+			return NULL;
 		}
 		if ((plen & 3) && (para != SMT_P_ECHODATA)) {
 			DB_SMT("SMT : sm_to_para - odd length %d\n",plen,0) ;
-			return(0) ;
+			return NULL;
 		}
 		if (found)
 			return(found) ;
 	}
-	return(0) ;
+	return NULL;
 }
 
 #if	0
diff -urN linux-2.6.8-rc2/drivers/net/skfp/smtdef.c linux-2.6.8-rc3/drivers/net/skfp/smtdef.c
--- linux-2.6.8-rc2/drivers/net/skfp/smtdef.c	2004-08-03 15:21:08.190556040 -0700
+++ linux-2.6.8-rc3/drivers/net/skfp/smtdef.c	2004-08-03 15:21:45.535087924 -0700
@@ -262,7 +262,7 @@
 		 */
 		/* Attention: don't initialize mib pointer here! */
 		/*  It must be initialized during phase 2 */
-		smc->y[port].mib = 0 ;
+		smc->y[port].mib = NULL;
 		mib->fddiSMTPORTIndexes[port] = port+INDEX_PORT ;
 
 		pm->fddiPORTIndex = port+INDEX_PORT ;
diff -urN linux-2.6.8-rc2/drivers/net/skfp/smtparse.c linux-2.6.8-rc3/drivers/net/skfp/smtparse.c
--- linux-2.6.8-rc2/drivers/net/skfp/smtparse.c	2004-08-03 15:21:08.191556081 -0700
+++ linux-2.6.8-rc3/drivers/net/skfp/smtparse.c	2004-08-03 15:21:45.537088006 -0700
@@ -73,7 +73,7 @@
 	{ "SBACOMMAND",16,	0 } ,
 	{ "SBAAVAILABLE",17,	1,	0,	100	} ,
 #endif
-	{ 0 }
+	{ NULL }
 } ;
 
 /* Define maximum string size for values and keybuffer */
diff -urN linux-2.6.8-rc2/drivers/net/skfp/smttimer.c linux-2.6.8-rc3/drivers/net/skfp/smttimer.c
--- linux-2.6.8-rc2/drivers/net/skfp/smttimer.c	2004-08-03 15:21:08.192556122 -0700
+++ linux-2.6.8-rc3/drivers/net/skfp/smttimer.c	2004-08-03 15:21:45.537088006 -0700
@@ -30,9 +30,9 @@
 
 void smt_timer_init(struct s_smc *smc)
 {
-	smc->t.st_queue = 0 ;
+	smc->t.st_queue = NULL;
 	smc->t.st_fast.tm_active = FALSE ;
-	smc->t.st_fast.tm_next = 0 ;
+	smc->t.st_fast.tm_next = NULL;
 	hwt_init(smc) ;
 }
 
@@ -75,7 +75,7 @@
 	timer->tm_active = TRUE ;
 	if (!smc->t.st_queue) {
 		smc->t.st_queue = timer ;
-		timer->tm_next = 0 ;
+		timer->tm_next = NULL;
 		timer->tm_delta = time ;
 		hwt_start(smc,time) ;
 		return ;
@@ -141,7 +141,7 @@
 			done = 1 ;
 		}
 	}
-	*last = 0 ;
+	*last = NULL;
 	next = smc->t.st_queue ;
 	smc->t.st_queue = tm ;
 
diff -urN linux-2.6.8-rc2/drivers/net/skfp/srf.c linux-2.6.8-rc3/drivers/net/skfp/srf.c
--- linux-2.6.8-rc2/drivers/net/skfp/srf.c	2004-08-03 15:21:08.192556122 -0700
+++ linux-2.6.8-rc3/drivers/net/skfp/srf.c	2004-08-03 15:21:45.538088047 -0700
@@ -167,7 +167,7 @@
 		if (evc->evc_code == code && evc->evc_index == index)
 			return(evc) ;
 	}
-	return(0) ;
+	return NULL;
 }
 
 #define THRESHOLD_2	(2*TICKS_PER_SECOND)
diff -urN linux-2.6.8-rc2/drivers/net/slip.c linux-2.6.8-rc3/drivers/net/slip.c
--- linux-2.6.8-rc2/drivers/net/slip.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/slip.c	2004-08-03 15:21:45.583089893 -0700
@@ -954,7 +954,7 @@
 	if (!sl || sl->magic != SLIP_MAGIC || sl->tty != tty)
 		return;
 
-	tty->disc_data = 0;
+	tty->disc_data = NULL;
 	sl->tty = NULL;
 	if (!sl->leased)
 		sl->line = 0;
diff -urN linux-2.6.8-rc2/drivers/net/sunbmac.c linux-2.6.8-rc3/drivers/net/sunbmac.c
--- linux-2.6.8-rc2/drivers/net/sunbmac.c	2004-06-15 22:19:29.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/sunbmac.c	2004-08-03 15:21:45.772097647 -0700
@@ -1274,7 +1274,7 @@
 static int __init bigmac_probe(void)
 {
 	struct sbus_bus *sbus;
-	struct sbus_dev *sdev = 0;
+	struct sbus_dev *sdev = NULL;
 	static int called;
 	int cards = 0, v;
 
diff -urN linux-2.6.8-rc2/drivers/net/sundance.c linux-2.6.8-rc3/drivers/net/sundance.c
--- linux-2.6.8-rc2/drivers/net/sundance.c	2004-08-03 15:21:08.271559359 -0700
+++ linux-2.6.8-rc3/drivers/net/sundance.c	2004-08-03 15:21:45.796098631 -0700
@@ -300,7 +300,7 @@
 	{"D-Link DFE-530TXS FAST Ethernet Adapter"},
 	{"D-Link DL10050-based FAST Ethernet Adapter"},
 	{"Sundance Technology Alta"},
-	{0,},			/* 0 terminated list. */
+	{NULL,},			/* 0 terminated list. */
 };
 
 /* This driver was written to use PCI memory space, however x86-oriented
@@ -1030,7 +1030,7 @@
 			((i+1)%RX_RING_SIZE)*sizeof(*np->rx_ring));
 		np->rx_ring[i].status = 0;
 		np->rx_ring[i].frag[0].length = 0;
-		np->rx_skbuff[i] = 0;
+		np->rx_skbuff[i] = NULL;
 	}
 
 	/* Fill in the Rx buffers.  Handle allocation failure gracefully. */
@@ -1049,7 +1049,7 @@
 	np->dirty_rx = (unsigned int)(i - RX_RING_SIZE);
 
 	for (i = 0; i < TX_RING_SIZE; i++) {
-		np->tx_skbuff[i] = 0;
+		np->tx_skbuff[i] = NULL;
 		np->tx_ring[i].status = 0;
 	}
 	return;
@@ -1153,7 +1153,7 @@
 				dev_kfree_skb_irq (skb);
 			else
 				dev_kfree_skb (skb);
-			np->tx_skbuff[i] = 0;
+			np->tx_skbuff[i] = NULL;
 			np->stats.tx_dropped++;
 		}
 	}
@@ -1256,7 +1256,7 @@
 					np->tx_ring[entry].frag[0].addr,
 					skb->len, PCI_DMA_TODEVICE);
 				dev_kfree_skb_irq (np->tx_skbuff[entry]);
-				np->tx_skbuff[entry] = 0;
+				np->tx_skbuff[entry] = NULL;
 				np->tx_ring[entry].frag[0].addr = 0;
 				np->tx_ring[entry].frag[0].length = 0;
 			}
@@ -1275,7 +1275,7 @@
 					np->tx_ring[entry].frag[0].addr,
 					skb->len, PCI_DMA_TODEVICE);
 				dev_kfree_skb_irq (np->tx_skbuff[entry]);
-				np->tx_skbuff[entry] = 0;
+				np->tx_skbuff[entry] = NULL;
 				np->tx_ring[entry].frag[0].addr = 0;
 				np->tx_ring[entry].frag[0].length = 0;
 			}
@@ -1753,7 +1753,7 @@
 				np->rx_ring[i].frag[0].addr, np->rx_buf_sz,
 				PCI_DMA_FROMDEVICE);
 			dev_kfree_skb(skb);
-			np->rx_skbuff[i] = 0;
+			np->rx_skbuff[i] = NULL;
 		}
 	}
 	for (i = 0; i < TX_RING_SIZE; i++) {
@@ -1763,7 +1763,7 @@
 				np->tx_ring[i].frag[0].addr, skb->len,
 				PCI_DMA_TODEVICE);
 			dev_kfree_skb(skb);
-			np->tx_skbuff[i] = 0;
+			np->tx_skbuff[i] = NULL;
 		}
 	}
 
diff -urN linux-2.6.8-rc2/drivers/net/sungem.c linux-2.6.8-rc3/drivers/net/sungem.c
--- linux-2.6.8-rc2/drivers/net/sungem.c	2004-08-03 15:21:08.273559441 -0700
+++ linux-2.6.8-rc3/drivers/net/sungem.c	2004-08-03 15:21:45.799098754 -0700
@@ -2024,8 +2024,7 @@
 	/* Let the chip settle down a bit, it seems that helps
 	 * for sleep mode on some models
 	 */
-	set_current_state(TASK_UNINTERRUPTIBLE);
-	schedule_timeout(HZ/100);
+	msleep(10);
 
 	/* Make sure we aren't polling PHY status change. We
 	 * don't currently use that feature though
@@ -2043,8 +2042,7 @@
 		 * dont wait a bit here, looks like the chip takes
 		 * some time to really shut down
 		 */
-		set_current_state(TASK_UNINTERRUPTIBLE);
-		schedule_timeout(HZ/100);
+		msleep(10);
 	}
 
 	writel(0, gp->regs + MAC_TXCFG);
diff -urN linux-2.6.8-rc2/drivers/net/sunlance.c linux-2.6.8-rc3/drivers/net/sunlance.c
--- linux-2.6.8-rc2/drivers/net/sunlance.c	2004-06-15 22:19:03.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/sunlance.c	2004-08-03 15:21:45.856101093 -0700
@@ -911,7 +911,7 @@
 	lp->tx_new = TX_NEXT(entry);
 }
 
-struct net_device *last_dev = 0;
+struct net_device *last_dev;
 
 static int lance_open(struct net_device *dev)
 {
@@ -1550,8 +1550,8 @@
 static int __init sparc_lance_probe(void)
 {
 	struct sbus_bus *bus;
-	struct sbus_dev *sdev = 0;
-	struct sbus_dma *ledma = 0;
+	struct sbus_dev *sdev = NULL;
+	struct sbus_dma *ledma = NULL;
 	static int called;
 	int cards = 0, v;
 
@@ -1565,7 +1565,7 @@
 		for_each_sbusdev (sdev, bus) {
 			if (strcmp(sdev->prom_name, "le") == 0) {
 				cards++;
-				if ((v = sparc_lance_init(sdev, 0, 0)))
+				if ((v = sparc_lance_init(sdev, NULL, NULL)))
 					return v;
 				continue;
 			}
@@ -1573,14 +1573,14 @@
 				cards++;
 				ledma = find_ledma(sdev);
 				if ((v = sparc_lance_init(sdev->child,
-							  ledma, 0)))
+							  ledma, NULL)))
 					return v;
 				continue;
 			}
 			if (strcmp(sdev->prom_name, "lebuffer") == 0){
 				cards++;
 				if ((v = sparc_lance_init(sdev->child,
-							  0, sdev)))
+							  NULL, sdev)))
 					return v;
 				continue;
 			}
diff -urN linux-2.6.8-rc2/drivers/net/sunqe.c linux-2.6.8-rc3/drivers/net/sunqe.c
--- linux-2.6.8-rc2/drivers/net/sunqe.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/sunqe.c	2004-08-03 15:21:45.888102406 -0700
@@ -981,7 +981,7 @@
 {
 	struct net_device *dev = NULL;
 	struct sbus_bus *bus;
-	struct sbus_dev *sdev = 0;
+	struct sbus_dev *sdev = NULL;
 	static int called;
 	int cards = 0, v;
 
diff -urN linux-2.6.8-rc2/drivers/net/tg3.c linux-2.6.8-rc3/drivers/net/tg3.c
--- linux-2.6.8-rc2/drivers/net/tg3.c	2004-08-03 15:21:08.285559932 -0700
+++ linux-2.6.8-rc3/drivers/net/tg3.c	2004-08-03 15:21:46.012107493 -0700
@@ -3635,9 +3635,25 @@
 	/* restore 5701 hardware bug workaround flag */
 	tp->tg3_flags = flags_save;
 
+	/* Unfortunately, we have to delay before the PCI read back.
+	 * Some 575X chips even will not respond to a PCI cfg access
+	 * when the reset command is given to the chip.
+	 *
+	 * How do these hardware designers expect things to work
+	 * properly if the PCI write is posted for a long period
+	 * of time?  It is always necessary to have some method by
+	 * which a register read back can occur to push the write
+	 * out which does the reset.
+	 *
+	 * For most tg3 variants the trick below was working.
+	 * Ho hum...
+	 */
+	udelay(120);
+
 	/* Flush PCI posted writes.  The normal MMIO registers
 	 * are inaccessible at this time so this is the only
-	 * way to make this reliably.  I tried to use indirect
+	 * way to make this reliably (actually, this is no longer
+	 * the case, see above).  I tried to use indirect
 	 * register read/write but this upset some 5701 variants.
 	 */
 	pci_read_config_dword(tp->pdev, PCI_COMMAND, &val);
diff -urN linux-2.6.8-rc2/drivers/net/tlan.c linux-2.6.8-rc3/drivers/net/tlan.c
--- linux-2.6.8-rc2/drivers/net/tlan.c	2004-06-15 22:18:58.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/tlan.c	2004-08-03 15:21:46.122112005 -0700
@@ -212,7 +212,7 @@
 /* Define this to enable Link beat monitoring */
 #undef MONITOR
 
-/* Turn on debugging. See linux/Documentation/networking/tlan.txt for details */
+/* Turn on debugging. See Documentation/networking/tlan.txt for details */
 static  int		debug;
 
 static	int		bbuf;
@@ -225,7 +225,7 @@
 
 const char *media[] = {
 	"10BaseT-HD ", "10BaseT-FD ","100baseTx-HD ", 
-	"100baseTx-FD", "100baseT4", 0
+	"100baseTx-FD", "100baseT4", NULL
 };
 
 int media_map[] = { 0x0020, 0x0040, 0x0080, 0x0100, 0x0200,};
diff -urN linux-2.6.8-rc2/drivers/net/tulip/xircom_cb.c linux-2.6.8-rc3/drivers/net/tulip/xircom_cb.c
--- linux-2.6.8-rc2/drivers/net/tulip/xircom_cb.c	2004-06-15 22:19:44.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/tulip/xircom_cb.c	2004-08-03 15:21:46.395123205 -0700
@@ -337,7 +337,7 @@
 	spin_lock(&card->lock);
 	status = inl(card->io_port+CSR5);
 
-#if DEBUG	
+#ifdef DEBUG	
 	print_binary(status);
 	printk("tx status 0x%08x 0x%08x \n",card->tx_buffer[0],card->tx_buffer[4]);
 	printk("rx status 0x%08x 0x%08x \n",card->rx_buffer[0],card->rx_buffer[4]);
diff -urN linux-2.6.8-rc2/drivers/net/tulip/xircom_tulip_cb.c linux-2.6.8-rc3/drivers/net/tulip/xircom_tulip_cb.c
--- linux-2.6.8-rc2/drivers/net/tulip/xircom_tulip_cb.c	2004-06-15 22:18:59.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/tulip/xircom_tulip_cb.c	2004-08-03 15:21:46.400123410 -0700
@@ -756,7 +756,7 @@
 	xircom_init_ring(dev);
 	/* Clear the tx ring */
 	for (i = 0; i < TX_RING_SIZE; i++) {
-		tp->tx_skbuff[i] = 0;
+		tp->tx_skbuff[i] = NULL;
 		tp->tx_ring[i].status = 0;
 	}
 
@@ -904,7 +904,7 @@
 	/* The Tx buffer descriptor is filled in as needed, but we
 	   do need to clear the ownership bit. */
 	for (i = 0; i < TX_RING_SIZE; i++) {
-		tp->tx_skbuff[i] = 0;
+		tp->tx_skbuff[i] = NULL;
 		tp->tx_ring[i].status = 0;
 		tp->tx_ring[i].buffer2 = virt_to_bus(&tp->tx_ring[i+1]);
 #ifdef CARDBUS
@@ -1128,7 +1128,7 @@
 
 				/* Free the original skb. */
 				dev_kfree_skb_irq(tp->tx_skbuff[entry]);
-				tp->tx_skbuff[entry] = 0;
+				tp->tx_skbuff[entry] = NULL;
 			}
 
 #ifndef final_version
@@ -1338,7 +1338,7 @@
 	/* Free all the skbuffs in the Rx queue. */
 	for (i = 0; i < RX_RING_SIZE; i++) {
 		struct sk_buff *skb = tp->rx_skbuff[i];
-		tp->rx_skbuff[i] = 0;
+		tp->rx_skbuff[i] = NULL;
 		tp->rx_ring[i].status = 0;		/* Not owned by Xircom chip. */
 		tp->rx_ring[i].length = 0;
 		tp->rx_ring[i].buffer1 = 0xBADF00D0; /* An invalid address. */
@@ -1349,7 +1349,7 @@
 	for (i = 0; i < TX_RING_SIZE; i++) {
 		if (tp->tx_skbuff[i])
 			dev_kfree_skb(tp->tx_skbuff[i]);
-		tp->tx_skbuff[i] = 0;
+		tp->tx_skbuff[i] = NULL;
 	}
 
 	tp->open = 0;
@@ -1629,7 +1629,7 @@
 
 		if (entry != 0) {
 			/* Avoid a chip errata by prefixing a dummy entry. */
-			tp->tx_skbuff[entry] = 0;
+			tp->tx_skbuff[entry] = NULL;
 			tp->tx_ring[entry].length =
 				(entry == TX_RING_SIZE - 1) ? Tx1RingWrap : 0;
 			tp->tx_ring[entry].buffer1 = 0;
@@ -1638,7 +1638,7 @@
 			entry = tp->cur_tx++ % TX_RING_SIZE;
 		}
 
-		tp->tx_skbuff[entry] = 0;
+		tp->tx_skbuff[entry] = NULL;
 		/* Put the setup frame on the Tx list. */
 		if (entry == TX_RING_SIZE - 1)
 			tx_flags |= Tx1RingWrap;		/* Wrap ring. */
diff -urN linux-2.6.8-rc2/drivers/net/via-rhine.c linux-2.6.8-rc3/drivers/net/via-rhine.c
--- linux-2.6.8-rc2/drivers/net/via-rhine.c	2004-08-03 15:21:08.334561940 -0700
+++ linux-2.6.8-rc3/drivers/net/via-rhine.c	2004-08-03 15:21:46.475126487 -0700
@@ -980,7 +980,7 @@
 		rp->rx_ring[i].desc_length = cpu_to_le32(rp->rx_buf_sz);
 		next += sizeof(struct rx_desc);
 		rp->rx_ring[i].next_desc = cpu_to_le32(next);
-		rp->rx_skbuff[i] = 0;
+		rp->rx_skbuff[i] = NULL;
 	}
 	/* Mark the last entry as wrapping the ring. */
 	rp->rx_ring[i-1].next_desc = cpu_to_le32(rp->rx_ring_dma);
@@ -1018,7 +1018,7 @@
 					 rp->rx_buf_sz, PCI_DMA_FROMDEVICE);
 			dev_kfree_skb(rp->rx_skbuff[i]);
 		}
-		rp->rx_skbuff[i] = 0;
+		rp->rx_skbuff[i] = NULL;
 	}
 }
 
@@ -1031,7 +1031,7 @@
 	rp->dirty_tx = rp->cur_tx = 0;
 	next = rp->tx_ring_dma;
 	for (i = 0; i < TX_RING_SIZE; i++) {
-		rp->tx_skbuff[i] = 0;
+		rp->tx_skbuff[i] = NULL;
 		rp->tx_ring[i].tx_status = 0;
 		rp->tx_ring[i].desc_length = cpu_to_le32(TXDESC);
 		next += sizeof(struct tx_desc);
@@ -1060,8 +1060,8 @@
 			}
 			dev_kfree_skb(rp->tx_skbuff[i]);
 		}
-		rp->tx_skbuff[i] = 0;
-		rp->tx_buf[i] = 0;
+		rp->tx_skbuff[i] = NULL;
+		rp->tx_buf[i] = NULL;
 	}
 }
 
diff -urN linux-2.6.8-rc2/drivers/net/via-velocity.c linux-2.6.8-rc3/drivers/net/via-velocity.c
--- linux-2.6.8-rc2/drivers/net/via-velocity.c	2004-08-03 15:21:08.340562186 -0700
+++ linux-2.6.8-rc3/drivers/net/via-velocity.c	2004-08-03 15:21:46.481126733 -0700
@@ -2892,7 +2892,7 @@
 	struct velocity_info *vptr = dev->priv;
 	struct mac_regs * regs = vptr->mac_regs;
 	unsigned long flags;
-	struct mii_ioctl_data *miidata = (struct mii_ioctl_data *) &(ifr->ifr_data);
+	struct mii_ioctl_data *miidata = if_mii(ifr);
 	int err;
 	
 	switch (cmd) {
diff -urN linux-2.6.8-rc2/drivers/net/wan/sbni.c linux-2.6.8-rc3/drivers/net/wan/sbni.c
--- linux-2.6.8-rc2/drivers/net/wan/sbni.c	2004-08-03 15:21:08.377563702 -0700
+++ linux-2.6.8-rc3/drivers/net/wan/sbni.c	2004-08-03 15:21:46.877142978 -0700
@@ -1578,7 +1578,7 @@
 	register u32  _crc;
 	_crc = crc;
 	
-	__asm __volatile (
+	__asm__ __volatile__ (
 		"xorl	%%ebx, %%ebx\n"
 		"movl	%2, %%esi\n" 
 		"movl	%3, %%ecx\n" 
diff -urN linux-2.6.8-rc2/drivers/net/wireless/Kconfig linux-2.6.8-rc3/drivers/net/wireless/Kconfig
--- linux-2.6.8-rc2/drivers/net/wireless/Kconfig	2004-08-03 15:21:08.381563865 -0700
+++ linux-2.6.8-rc3/drivers/net/wireless/Kconfig	2004-08-03 15:21:46.976147040 -0700
@@ -139,7 +139,7 @@
 
 config AIRO
 	tristate "Cisco/Aironet 34X/35X/4500/4800 ISA and PCI cards"
-	depends on NET_RADIO && (ISA || PCI)
+	depends on NET_RADIO && ISA && (PCI || BROKEN)
 	---help---
 	  This is the standard Linux driver to support Cisco/Aironet ISA and
 	  PCI 802.11 wireless cards.
diff -urN linux-2.6.8-rc2/drivers/net/wireless/airo.c linux-2.6.8-rc3/drivers/net/wireless/airo.c
--- linux-2.6.8-rc2/drivers/net/wireless/airo.c	2004-08-03 15:21:08.398564562 -0700
+++ linux-2.6.8-rc3/drivers/net/wireless/airo.c	2004-08-03 15:21:47.311160783 -0700
@@ -2615,10 +2615,10 @@
 
 static void wifi_setup(struct net_device *dev)
 {
-	dev->hard_header        = 0;
-	dev->rebuild_header     = 0;
-	dev->hard_header_cache  = 0;
-	dev->header_cache_update= 0;
+	dev->hard_header        = NULL;
+	dev->rebuild_header     = NULL;
+	dev->hard_header_cache  = NULL;
+	dev->header_cache_update= NULL;
 
 	dev->hard_header_parse  = wll_header_parse;
 	dev->hard_start_xmit = &airo_start_xmit11;
@@ -2699,7 +2699,7 @@
 	}
 
 	ai = dev->priv;
-	ai->wifidev = 0;
+	ai->wifidev = NULL;
 	ai->flags = 0;
 	if (pci && (pci->device == 0x5000 || pci->device == 0xa504)) {
 		printk(KERN_DEBUG "airo: Found an MPI350 card\n");
@@ -2829,7 +2829,7 @@
 
 struct net_device *init_airo_card( unsigned short irq, int port, int is_pcmcia )
 {
-	return _init_airo_card ( irq, port, is_pcmcia, 0);
+	return _init_airo_card ( irq, port, is_pcmcia, NULL);
 }
 
 EXPORT_SYMBOL(init_airo_card);
@@ -4351,7 +4351,7 @@
 	.release	= proc_close
 };
 
-static struct proc_dir_entry *airo_entry = 0;
+static struct proc_dir_entry *airo_entry;
 
 struct proc_data {
 	int release_buffer;
@@ -5139,7 +5139,7 @@
 	    (data->wbuffer[1] == ' ' || data->wbuffer[1] == '\n')) {
 		index = data->wbuffer[0] - '0';
 		if (data->wbuffer[1] == '\n') {
-			set_wep_key(ai, index, 0, 0, 1, 1);
+			set_wep_key(ai, index, NULL, 0, 1, 1);
 			return;
 		}
 		j = 2;
@@ -5324,8 +5324,8 @@
 	}
 	data->writelen = 0;
 	data->maxwritelen = 0;
-	data->wbuffer = 0;
-	data->on_close = 0;
+	data->wbuffer = NULL;
+	data->on_close = NULL;
 
 	if (file->f_mode & FMODE_WRITE) {
 		if (!(file->f_mode & FMODE_READ)) {
@@ -5386,7 +5386,7 @@
 static struct net_device_list {
 	struct net_device *dev;
 	struct net_device_list *next;
-} *airo_devices = 0;
+} *airo_devices;
 
 /* Since the card doesn't automatically switch to the right WEP mode,
    we will make it do it.  If the card isn't associated, every secs we
@@ -5407,13 +5407,13 @@
 			break;
 		case AUTH_SHAREDKEY:
 			if (apriv->keyindex < auto_wep) {
-				set_wep_key(apriv, apriv->keyindex, 0, 0, 0, 0);
+				set_wep_key(apriv, apriv->keyindex, NULL, 0, 0, 0);
 				apriv->config.authType = AUTH_SHAREDKEY;
 				apriv->keyindex++;
 			} else {
 			        /* Drop to ENCRYPT */
 				apriv->keyindex = 0;
-				set_wep_key(apriv, apriv->defindex, 0, 0, 0, 0);
+				set_wep_key(apriv, apriv->defindex, NULL, 0, 0, 0);
 				apriv->config.authType = AUTH_ENCRYPT;
 			}
 			break;
@@ -6207,7 +6207,7 @@
 		/* Do we want to just set the transmit key index ? */
 		int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
 		if ((index >= 0) && (index < ((cap_rid.softCap & 0x80)?4:1))) {
-			set_wep_key(local, index, 0, 0, 1, 1);
+			set_wep_key(local, index, NULL, 0, 1, 1);
 		} else
 			/* Don't complain if only change the mode */
 			if(!dwrq->flags & IW_ENCODE_MODE) {
diff -urN linux-2.6.8-rc2/drivers/net/wireless/airport.c linux-2.6.8-rc3/drivers/net/wireless/airport.c
--- linux-2.6.8-rc2/drivers/net/wireless/airport.c	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/wireless/airport.c	2004-08-03 15:21:47.405164639 -0700
@@ -139,7 +139,7 @@
 
 	if (card->vaddr)
 		iounmap(card->vaddr);
-	card->vaddr = 0;
+	card->vaddr = NULL;
 
 	macio_release_resource(mdev, 0);
 
diff -urN linux-2.6.8-rc2/drivers/net/wireless/arlan.h linux-2.6.8-rc3/drivers/net/wireless/arlan.h
--- linux-2.6.8-rc2/drivers/net/wireless/arlan.h	2004-06-15 22:19:36.000000000 -0700
+++ linux-2.6.8-rc3/drivers/net/wireless/arlan.h	2004-08-03 15:21:47.413164967 -0700
@@ -52,7 +52,6 @@
 extern int	arlan_entry_debug;
 extern int	arlan_exit_debug;
 extern int	testMemory;
-extern const char* arlan_version;
 extern int     arlan_command(struct net_device * dev, int command);
  
 #define SIDUNKNOWN -1
diff -urN linux-2.6.8-rc2/drivers/net/wireless/prism54/isl_38xx.c linux-2.6.8-rc3/drivers/net/wireless/prism54/isl_38xx.c
--- linux-2.6.8-rc2/drivers/net/wireless/prism54/isl_38xx.c	2004-08-03 15:21:08.409565013 -0700
+++ linux-2.6.8-rc3/drivers/net/wireless/prism54/isl_38xx.c	2004-08-03 15:21:47.571171449 -0700
@@ -18,8 +18,6 @@
  *
  */
 
-#define __KERNEL_SYSCALLS__
-
 #include <linux/version.h>
 #include <linux/module.h>
 #include <linux/types.h>
diff -urN linux-2.6.8-rc2/drivers/net/wireless/prism54/isl_ioctl.c linux-2.6.8-rc3/drivers/net/wireless/prism54/isl_ioctl.c
--- linux-2.6.8-rc2/drivers/net/wireless/prism54/isl_ioctl.c	2004-08-03 15:21:08.412565136 -0700
+++ linux-2.6.8-rc3/drivers/net/wireless/prism54/isl_ioctl.c	2004-08-03 15:21:47.604172803 -0700
@@ -1942,7 +1942,7 @@
 {
 	islpci_private *priv = netdev_priv(ndev);
 	struct islpci_mgmtframe *response = NULL;
-	int ret = -EIO, response_op = PIMFOR_OP_ERROR;
+	int ret = -EIO;
 
 	printk("%s: get_oid 0x%08X\n", ndev->name, priv->priv_oid);
 	data->length = 0;
@@ -1952,9 +1952,7 @@
 		    islpci_mgt_transaction(priv->ndev, PIMFOR_OP_GET,
 					   priv->priv_oid, extra, 256,
 					   &response);
-		response_op = response->header->operation;
 		printk("%s: ret: %i\n", ndev->name, ret);
-		printk("%s: response_op: %i\n", ndev->name, response_op);
 		if (ret || !response
 		    || response->header->operation == PIMFOR_OP_ERROR) {
 			if (response) {
@@ -1991,16 +1989,20 @@
 					   priv->priv_oid, extra, data->length,
 					   &response);
 		printk("%s: ret: %i\n", ndev->name, ret);
+		if (ret || !response
+		    || response->header->operation == PIMFOR_OP_ERROR) {
+			if (response) {
+				islpci_mgt_release(response);
+			}
+			printk("%s: EIO\n", ndev->name);
+			ret = -EIO;
+		}
 		if (!ret) {
 			response_op = response->header->operation;
 			printk("%s: response_op: %i\n", ndev->name,
 			       response_op);
 			islpci_mgt_release(response);
 		}
-		if (ret || response_op == PIMFOR_OP_ERROR) {
-			printk("%s: EIO\n", ndev->name);
-			ret = -EIO;
-		}
 	}
 
 	return (ret ? ret : -EINPROGRESS);
diff -urN linux-2.6.8-rc2/drivers/net/wireless/prism54/islpci_dev.c linux-2.6.8-rc3/drivers/net/wireless/prism54/islpci_dev.c
--- linux-2.6.8-rc2/drivers/net/wireless/prism54/islpci_dev.c	2004-08-03 15:21:08.414565217 -0700
+++ linux-2.6.8-rc3/drivers/net/wireless/prism54/islpci_dev.c	2004-08-03 15:21:47.606172885 -0700
@@ -82,7 +82,7 @@
 	mdelay(50);
 
 	{
-		const struct firmware *fw_entry = 0;
+		const struct firmware *fw_entry = NULL;
 		long fw_len;
 		const u32 *fw_ptr;
 
@@ -716,7 +716,7 @@
 
 	if (priv->device_base)
 		iounmap(priv->device_base);
-	priv->device_base = 0;
+	priv->device_base = NULL;
 
 	/* free consistent DMA area... */
 	if (priv->driver_mem_address)
@@ -725,10 +725,10 @@
 				    priv->device_host_address);
 
 	/* clear some dangling pointers */
-	priv->driver_mem_address = 0;
+	priv->driver_mem_address = NULL;
 	priv->device_host_address = 0;
 	priv->device_psm_buffer = 0;
-	priv->control_block = 0;
+	priv->control_block = NULL;
 
         /* clean up mgmt rx buffers */
         for (counter = 0; counter < ISL38XX_CB_MGMT_QSIZE; counter++) {
@@ -754,7 +754,7 @@
 
 		if (priv->data_low_rx[counter])
 			dev_kfree_skb(priv->data_low_rx[counter]);
-		priv->data_low_rx[counter] = 0;
+		priv->data_low_rx[counter] = NULL;
 	}
 
 	/* Free the acces control list and the WPA list */
@@ -880,9 +880,9 @@
       do_islpci_free_memory:
 	islpci_free_memory(priv);
       do_free_netdev:
-	pci_set_drvdata(pdev, 0);
+	pci_set_drvdata(pdev, NULL);
 	free_netdev(ndev);
-	priv = 0;
+	priv = NULL;
 	return NULL;
 }
 
diff -urN linux-2.6.8-rc2/drivers/net/wireless/prism54/islpci_hotplug.c linux-2.6.8-rc3/drivers/net/wireless/prism54/islpci_hotplug.c
--- linux-2.6.8-rc2/drivers/net/wireless/prism54/islpci_hotplug.c	2004-08-03 15:21:08.417565340 -0700
+++ linux-2.6.8-rc3/drivers/net/wireless/prism54/islpci_hotplug.c	2004-08-03 15:21:47.609173008 -0700
@@ -36,6 +36,9 @@
 MODULE_DESCRIPTION("The Prism54 802.11 Wireless LAN adapter");
 MODULE_LICENSE("GPL");
 
+static int	init_pcitm = 0;
+module_param(init_pcitm, int, 0);
+
 /* In this order: vendor, device, subvendor, subdevice, class, class_mask,
  * driver_data 
  * If you have an update for this please contact prism54-devel@prism54.org 
@@ -292,14 +295,14 @@
 	 *
 	 * 	Writing zero to both these two registers will disable both timeouts and
 	 * 	*can* solve problems caused by devices that are slow to respond.
+	 *	Make this configurable - MSW
 	 */
-	/*	I am taking these out, we should not be poking around in the
-	 *	programmable timers - MSW
-	*/
-/*	Do not zero the programmable timers
-	pci_write_config_byte(pdev, 0x40, 0);
-	pci_write_config_byte(pdev, 0x41, 0);
-*/
+	if ( init_pcitm >= 0 ) {
+		pci_write_config_byte(pdev, 0x40, (u8)init_pcitm);
+		pci_write_config_byte(pdev, 0x41, (u8)init_pcitm);
+	} else {
+		printk(KERN_INFO "PCI TRDY/RETRY unchanged\n");
+	}
 
 	/* request the pci device I/O regions */
 	rvalue = pci_request_regions(pdev, DRV_NAME);
@@ -359,9 +362,9 @@
       do_unregister_netdev:
 	unregister_netdev(ndev);
 	islpci_free_memory(priv);
-	pci_set_drvdata(pdev, 0);
+	pci_set_drvdata(pdev, NULL);
 	free_netdev(ndev);
-	priv = 0;
+	priv = NULL;
       do_pci_release_regions:
 	pci_release_regions(pdev);
       do_pci_disable_device:
@@ -377,7 +380,7 @@
 prism54_remove(struct pci_dev *pdev)
 {
 	struct net_device *ndev = pci_get_drvdata(pdev);
-	islpci_private *priv = ndev ? netdev_priv(ndev) : 0;
+	islpci_private *priv = ndev ? netdev_priv(ndev) : NULL;
 	BUG_ON(!priv);
 
 	if (!__in_cleanup_module) {
@@ -405,9 +408,9 @@
 	/* free the PCI memory and unmap the remapped page */
 	islpci_free_memory(priv);
 
-	pci_set_drvdata(pdev, 0);
+	pci_set_drvdata(pdev, NULL);
 	free_netdev(ndev);
-	priv = 0;
+	priv = NULL;
 
 	pci_release_regions(pdev);
 
@@ -418,7 +421,7 @@
 prism54_suspend(struct pci_dev *pdev, u32 state)
 {
 	struct net_device *ndev = pci_get_drvdata(pdev);
-	islpci_private *priv = ndev ? netdev_priv(ndev) : 0;
+	islpci_private *priv = ndev ? netdev_priv(ndev) : NULL;
 	BUG_ON(!priv);
 
 	printk(KERN_NOTICE "%s: got suspend request (state %d)\n",
@@ -443,7 +446,7 @@
 prism54_resume(struct pci_dev *pdev)
 {
 	struct net_device *ndev = pci_get_drvdata(pdev);
-	islpci_private *priv = ndev ? netdev_priv(ndev) : 0;
+	islpci_private *priv = ndev ? netdev_priv(ndev) : NULL;
 	BUG_ON(!priv);
 
 	printk(KERN_NOTICE "%s: got resume request\n", ndev->name);
diff -urN linux-2.6.8-rc2/drivers/net/wireless/prism54/islpci_mgt.c linux-2.6.8-rc3/drivers/net/wireless/prism54/islpci_mgt.c
--- linux-2.6.8-rc2/drivers/net/wireless/prism54/islpci_mgt.c	2004-08-03 15:21:08.418565381 -0700
+++ linux-2.6.8-rc3/drivers/net/wireless/prism54/islpci_mgt.c	2004-08-03 15:21:47.610173049 -0700
@@ -458,6 +458,8 @@
 	int err;
 	DEFINE_WAIT(wait);
 
+	*recvframe = NULL;
+
 	if (down_interruptible(&priv->mgmt_sem))
 		return -ERESTARTSYS;
 
diff -urN linux-2.6.8-rc2/drivers/net/wireless/prism54/oid_mgt.c linux-2.6.8-rc3/drivers/net/wireless/prism54/oid_mgt.c
--- linux-2.6.8-rc2/drivers/net/wireless/prism54/oid_mgt.c	2004-08-03 15:21:08.420565463 -0700
+++ linux-2.6.8-rc3/drivers/net/wireless/prism54/oid_mgt.c	2004-08-03 15:21:47.612173131 -0700
@@ -408,7 +408,7 @@
 mgt_set_request(islpci_private *priv, enum oid_num_t n, int extra, void *data)
 {
 	int ret = 0;
-	struct islpci_mgmtframe *response;
+	struct islpci_mgmtframe *response = NULL;
 	int response_op = PIMFOR_OP_ERROR;
 	int dlen;
 	void *cache, *_data = data;
@@ -613,14 +613,16 @@
 	DOT11_OID_DEFKEYID,
 	DOT11_OID_DOT1XENABLE,
 	OID_INL_DOT11D_CONFORMANCE,
+	/* Do not initialize this - fw < 1.0.4.3 rejects it
 	OID_INL_OUTPUTPOWER,
+	*/
 };
 
 /* update the MAC addr. */
 static int
 mgt_update_addr(islpci_private *priv)
 {
-	struct islpci_mgmtframe *res;
+	struct islpci_mgmtframe *res = NULL;
 	int ret;
 
 	ret = islpci_mgt_transaction(priv->ndev, PIMFOR_OP_GET,
diff -urN linux-2.6.8-rc2/drivers/net/yellowfin.c linux-2.6.8-rc3/drivers/net/yellowfin.c
--- linux-2.6.8-rc2/drivers/net/yellowfin.c	2004-08-03 15:21:08.433565996 -0700
+++ linux-2.6.8-rc3/drivers/net/yellowfin.c	2004-08-03 15:21:47.661175141 -0700
@@ -286,7 +286,7 @@
 	 FullTxStatus | IsGigabit | HasMulticastBug | HasMACAddrBug | DontUseEeprom},
 	{"Symbios SYM83C885", { 0x07011000, 0xffffffff},
 	 PCI_IOTYPE, YELLOWFIN_SIZE, HasMII | DontUseEeprom },
-	{0,},
+	{NULL,},
 };
 
 static struct pci_device_id yellowfin_pci_tbl[] = {
@@ -805,7 +805,7 @@
 #ifdef NO_TXSTATS
 	/* In this mode the Tx ring needs only a single descriptor. */
 	for (i = 0; i < TX_RING_SIZE; i++) {
-		yp->tx_skbuff[i] = 0;
+		yp->tx_skbuff[i] = NULL;
 		yp->tx_ring[i].dbdma_cmd = cpu_to_le32(CMD_STOP);
 		yp->tx_ring[i].branch_addr = cpu_to_le32(yp->tx_ring_dma +
 			((i+1)%TX_RING_SIZE)*sizeof(struct yellowfin_desc));
@@ -987,7 +987,7 @@
 			pci_unmap_single(yp->pci_dev, yp->tx_ring[entry].addr,
 				skb->len, PCI_DMA_TODEVICE);
 			dev_kfree_skb_irq(skb);
-			yp->tx_skbuff[entry] = 0;
+			yp->tx_skbuff[entry] = NULL;
 		}
 		if (yp->tx_full
 			&& yp->cur_tx - yp->dirty_tx < TX_QUEUE_SIZE - 4) {
@@ -1320,12 +1320,12 @@
 		if (yp->rx_skbuff[i]) {
 			dev_kfree_skb(yp->rx_skbuff[i]);
 		}
-		yp->rx_skbuff[i] = 0;
+		yp->rx_skbuff[i] = NULL;
 	}
 	for (i = 0; i < TX_RING_SIZE; i++) {
 		if (yp->tx_skbuff[i])
 			dev_kfree_skb(yp->tx_skbuff[i]);
-		yp->tx_skbuff[i] = 0;
+		yp->tx_skbuff[i] = NULL;
 	}
 
 #ifdef YF_PROTOTYPE			/* Support for prototype hardware errata. */
diff -urN linux-2.6.8-rc2/drivers/pci/Kconfig linux-2.6.8-rc3/drivers/pci/Kconfig
--- linux-2.6.8-rc2/drivers/pci/Kconfig	2004-08-03 15:21:08.454566856 -0700
+++ linux-2.6.8-rc3/drivers/pci/Kconfig	2004-08-03 15:21:47.840182485 -0700
@@ -1,22 +1,15 @@
 #
 # PCI configuration
 #
-config PCI_USE_VECTOR
-	bool "Vector-based interrupt indexing (MSI)"
+config PCI_MSI
+	bool "Message Signaled Interrupts (MSI and MSI-X)"
 	depends on (X86_LOCAL_APIC && X86_IO_APIC) || IA64
 	default n
 	help
-	   This replaces the current existing IRQ-based index interrupt scheme
-	   with the vector-base index scheme. The advantages of vector base
-	   over IRQ base are listed below:
-	   1) Support MSI implementation.
-	   2) Support future IOxAPIC hotplug
-
-	   Note that this allows the device drivers to enable MSI, Message
-	   Signaled Interrupt, on all MSI capable device functions detected.
-	   Message Signal Interrupt enables an MSI-capable hardware device to
-	   send an inbound Memory Write on its PCI bus instead of asserting
-	   IRQ signal on device IRQ pin.
+	   This allows device drivers to enable MSI (Message Signaled
+	   Interrupts).  Message Signaled Interrupts enable a device to
+	   generate an interrupt using an inbound Memory Write on its
+	   PCI bus instead of asserting a device IRQ pin.
 
 	   If you don't know what to do here, say N.
 
diff -urN linux-2.6.8-rc2/drivers/pci/Makefile linux-2.6.8-rc3/drivers/pci/Makefile
--- linux-2.6.8-rc2/drivers/pci/Makefile	2004-06-15 22:20:03.000000000 -0700
+++ linux-2.6.8-rc3/drivers/pci/Makefile	2004-08-03 15:21:47.846182731 -0700
@@ -26,7 +26,7 @@
 obj-$(CONFIG_PPC64) += setup-bus.o
 obj-$(CONFIG_MIPS) += setup-bus.o setup-irq.o
 obj-$(CONFIG_X86_VISWS) += setup-irq.o
-obj-$(CONFIG_PCI_USE_VECTOR) += msi.o
+obj-$(CONFIG_PCI_MSI) += msi.o
 
 # Cardbus & CompactPCI use setup-bus
 obj-$(CONFIG_HOTPLUG) += setup-bus.o
diff -urN linux-2.6.8-rc2/drivers/pci/msi.c linux-2.6.8-rc3/drivers/pci/msi.c
--- linux-2.6.8-rc2/drivers/pci/msi.c	2004-08-03 15:21:08.505568946 -0700
+++ linux-2.6.8-rc3/drivers/pci/msi.c	2004-08-03 15:21:48.132194464 -0700
@@ -64,15 +64,13 @@
 	case PCI_CAP_ID_MSI:
 	{
 		int		pos;
-		unsigned int	mask_bits;
+		u32		mask_bits;
 
 		pos = entry->mask_base;
-	        entry->dev->bus->ops->read(entry->dev->bus, entry->dev->devfn,
-				pos, 4, &mask_bits);
+		pci_read_config_dword(entry->dev, pos, &mask_bits);
 		mask_bits &= ~(1);
 		mask_bits |= flag;
-	        entry->dev->bus->ops->write(entry->dev->bus, entry->dev->devfn,
-				pos, 4, mask_bits);
+		pci_write_config_dword(entry->dev, pos, mask_bits);
 		break;
 	}
 	case PCI_CAP_ID_MSIX:
@@ -105,15 +103,13 @@
    		if (!(pos = pci_find_capability(entry->dev, PCI_CAP_ID_MSI)))
 			return;
 
-	        entry->dev->bus->ops->read(entry->dev->bus, entry->dev->devfn,
-			msi_lower_address_reg(pos), 4,
+		pci_read_config_dword(entry->dev, msi_lower_address_reg(pos),
 			&address.lo_address.value);
 		address.lo_address.value &= MSI_ADDRESS_DEST_ID_MASK;
 		address.lo_address.value |= (cpu_mask_to_apicid(cpu_mask) <<
 			MSI_TARGET_CPU_SHIFT);
 		entry->msi_attrib.current_cpu = cpu_mask_to_apicid(cpu_mask);
-		entry->dev->bus->ops->write(entry->dev->bus, entry->dev->devfn,
-			msi_lower_address_reg(pos), 4,
+		pci_write_config_dword(entry->dev, msi_lower_address_reg(pos),
 			address.lo_address.value);
 		break;
 	}
@@ -158,13 +154,25 @@
 
 static unsigned int startup_msi_irq_wo_maskbit(unsigned int vector)
 {
+	struct msi_desc *entry;
+	unsigned long flags;
+
+	spin_lock_irqsave(&msi_lock, flags);
+	entry = msi_desc[vector];
+	if (!entry || !entry->dev) {
+		spin_unlock_irqrestore(&msi_lock, flags);
+		return 0;
+	}
+	entry->msi_attrib.state = 1;	/* Mark it active */
+	spin_unlock_irqrestore(&msi_lock, flags);
+
 	return 0;	/* never anything pending */
 }
 
-static void pci_disable_msi(unsigned int vector);
+static void release_msi(unsigned int vector);
 static void shutdown_msi_irq(unsigned int vector)
 {
-	pci_disable_msi(vector);
+	release_msi(vector);
 }
 
 #define shutdown_msi_irq_wo_maskbit	shutdown_msi_irq
@@ -179,6 +187,18 @@
 
 static unsigned int startup_msi_irq_w_maskbit(unsigned int vector)
 {
+	struct msi_desc *entry;
+	unsigned long flags;
+
+	spin_lock_irqsave(&msi_lock, flags);
+	entry = msi_desc[vector];
+	if (!entry || !entry->dev) {
+		spin_unlock_irqrestore(&msi_lock, flags);
+		return 0;
+	}
+	entry->msi_attrib.state = 1;	/* Mark it active */
+	spin_unlock_irqrestore(&msi_lock, flags);
+
 	unmask_MSI_irq(vector);
 	return 0;	/* never anything pending */
 }
@@ -200,7 +220,7 @@
  * which implement the MSI-X Capability Structure.
  */
 static struct hw_interrupt_type msix_irq_type = {
-	.typename	= "PCI MSI-X",
+	.typename	= "PCI-MSI-X",
 	.startup	= startup_msi_irq_w_maskbit,
 	.shutdown	= shutdown_msi_irq_w_maskbit,
 	.enable		= enable_msi_irq_w_maskbit,
@@ -216,7 +236,7 @@
  * Mask-and-Pending Bits.
  */
 static struct hw_interrupt_type msi_irq_w_maskbit_type = {
-	.typename	= "PCI MSI",
+	.typename	= "PCI-MSI",
 	.startup	= startup_msi_irq_w_maskbit,
 	.shutdown	= shutdown_msi_irq_w_maskbit,
 	.enable		= enable_msi_irq_w_maskbit,
@@ -232,7 +252,7 @@
  * Mask-and-Pending Bits.
  */
 static struct hw_interrupt_type msi_irq_wo_maskbit_type = {
-	.typename	= "PCI MSI",
+	.typename	= "PCI-MSI",
 	.startup	= startup_msi_irq_wo_maskbit,
 	.shutdown	= shutdown_msi_irq_wo_maskbit,
 	.enable		= enable_msi_irq_wo_maskbit,
@@ -265,6 +285,7 @@
 	msi_address->lo_address.value |= (MSI_TARGET_CPU << MSI_TARGET_CPU_SHIFT);
 }
 
+static int msi_free_vector(struct pci_dev* dev, int vector, int reassign);
 static int assign_msi_vector(void)
 {
 	static int new_vector_avail = 1;
@@ -278,6 +299,8 @@
 	spin_lock_irqsave(&msi_lock, flags);
 
 	if (!new_vector_avail) {
+		int free_vector = 0;
+
 		/*
 	 	 * vector_irq[] = -1 indicates that this specific vector is:
 	 	 * - assigned for MSI (since MSI have no associated IRQ) or
@@ -294,13 +317,34 @@
 		for (vector = FIRST_DEVICE_VECTOR; vector < NR_IRQS; vector++) {
 			if (vector_irq[vector] != 0)
 				continue;
-			vector_irq[vector] = -1;
-			nr_released_vectors--;
+			free_vector = vector;
+			if (!msi_desc[vector])
+			      	break;
+			else
+				continue;
+		}
+		if (!free_vector) {
 			spin_unlock_irqrestore(&msi_lock, flags);
-			return vector;
+			return -EBUSY;
 		}
+		vector_irq[free_vector] = -1;
+		nr_released_vectors--;
 		spin_unlock_irqrestore(&msi_lock, flags);
-		return -EBUSY;
+		if (msi_desc[free_vector] != NULL) {
+			struct pci_dev *dev;
+			int tail;
+
+			/* free all linked vectors before re-assign */
+			do {
+				spin_lock_irqsave(&msi_lock, flags);
+				dev = msi_desc[free_vector]->dev;
+				tail = msi_desc[free_vector]->link.tail;
+				spin_unlock_irqrestore(&msi_lock, flags);
+				msi_free_vector(dev, tail, 1);
+			} while (free_vector != tail);
+		}
+
+		return free_vector;
 	}
 	vector = assign_irq_vector(AUTO_ASSIGN);
 	last_alloc_vector = vector;
@@ -333,6 +377,15 @@
 		printk(KERN_INFO "WARNING: MSI INIT FAILURE\n");
 		return status;
 	}
+	last_alloc_vector = assign_irq_vector(AUTO_ASSIGN);
+	if (last_alloc_vector < 0) {
+		pci_msi_enable = 0;
+		printk(KERN_INFO "WARNING: ALL VECTORS ARE BUSY\n");
+		status = -EBUSY;
+		return status;
+	}
+	vector_irq[last_alloc_vector] = 0;
+	nr_released_vectors++;
 	printk(KERN_INFO "MSI INIT SUCCESS\n");
 
 	return status;
@@ -383,55 +436,49 @@
 
 static void enable_msi_mode(struct pci_dev *dev, int pos, int type)
 {
-	u32 control;
+	u16 control;
 
-	dev->bus->ops->read(dev->bus, dev->devfn,
-		msi_control_reg(pos), 2, &control);
+	pci_read_config_word(dev, msi_control_reg(pos), &control);
 	if (type == PCI_CAP_ID_MSI) {
 		/* Set enabled bits to single MSI & enable MSI_enable bit */
 		msi_enable(control, 1);
-	        dev->bus->ops->write(dev->bus, dev->devfn,
-			msi_control_reg(pos), 2, control);
+		pci_write_config_word(dev, msi_control_reg(pos), control);
 	} else {
 		msix_enable(control);
-	        dev->bus->ops->write(dev->bus, dev->devfn,
-			msi_control_reg(pos), 2, control);
+		pci_write_config_word(dev, msi_control_reg(pos), control);
 	}
     	if (pci_find_capability(dev, PCI_CAP_ID_EXP)) {
 		/* PCI Express Endpoint device detected */
-		u32 cmd;
-	        dev->bus->ops->read(dev->bus, dev->devfn, PCI_COMMAND, 2, &cmd);
+		u16 cmd;
+		pci_read_config_word(dev, PCI_COMMAND, &cmd);
 		cmd |= PCI_COMMAND_INTX_DISABLE;
-	        dev->bus->ops->write(dev->bus, dev->devfn, PCI_COMMAND, 2, cmd);
+		pci_write_config_word(dev, PCI_COMMAND, cmd);
 	}
 }
 
 static void disable_msi_mode(struct pci_dev *dev, int pos, int type)
 {
-	u32 control;
+	u16 control;
 
-	dev->bus->ops->read(dev->bus, dev->devfn,
-		msi_control_reg(pos), 2, &control);
+	pci_read_config_word(dev, msi_control_reg(pos), &control);
 	if (type == PCI_CAP_ID_MSI) {
 		/* Set enabled bits to single MSI & enable MSI_enable bit */
 		msi_disable(control);
-	        dev->bus->ops->write(dev->bus, dev->devfn,
-			msi_control_reg(pos), 2, control);
+		pci_write_config_word(dev, msi_control_reg(pos), control);
 	} else {
 		msix_disable(control);
-	        dev->bus->ops->write(dev->bus, dev->devfn,
-			msi_control_reg(pos), 2, control);
+		pci_write_config_word(dev, msi_control_reg(pos), control);
 	}
     	if (pci_find_capability(dev, PCI_CAP_ID_EXP)) {
 		/* PCI Express Endpoint device detected */
-		u32 cmd;
-	        dev->bus->ops->read(dev->bus, dev->devfn, PCI_COMMAND, 2, &cmd);
+		u16 cmd;
+		pci_read_config_word(dev, PCI_COMMAND, &cmd);
 		cmd &= ~PCI_COMMAND_INTX_DISABLE;
-	        dev->bus->ops->write(dev->bus, dev->devfn, PCI_COMMAND, 2, cmd);
+		pci_write_config_word(dev, PCI_COMMAND, cmd);
 	}
 }
 
-static int msi_lookup_vector(struct pci_dev *dev)
+static int msi_lookup_vector(struct pci_dev *dev, int type)
 {
 	int vector;
 	unsigned long flags;
@@ -439,11 +486,11 @@
 	spin_lock_irqsave(&msi_lock, flags);
 	for (vector = FIRST_DEVICE_VECTOR; vector < NR_IRQS; vector++) {
 		if (!msi_desc[vector] || msi_desc[vector]->dev != dev ||
-			msi_desc[vector]->msi_attrib.entry_nr ||
+			msi_desc[vector]->msi_attrib.type != type ||
 			msi_desc[vector]->msi_attrib.default_vector != dev->irq)
-			continue;	/* not entry 0, skip */
+			continue;
 		spin_unlock_irqrestore(&msi_lock, flags);
-		/* This pre-assigned entry-0 MSI vector for this device
+		/* This pre-assigned MSI vector for this device
 		   already exits. Override dev->irq with this vector */
 		dev->irq = vector;
 		return 0;
@@ -458,10 +505,9 @@
 	if (!dev)
 		return;
 
-   	if (pci_find_capability(dev, PCI_CAP_ID_MSIX) > 0) {
-		nr_reserved_vectors++;
+   	if (pci_find_capability(dev, PCI_CAP_ID_MSIX) > 0)
 		nr_msix_devices++;
-	} else if (pci_find_capability(dev, PCI_CAP_ID_MSI) > 0)
+	else if (pci_find_capability(dev, PCI_CAP_ID_MSI) > 0)
 		nr_reserved_vectors++;
 }
 
@@ -480,22 +526,10 @@
 	struct msg_address address;
 	struct msg_data data;
 	int pos, vector;
-	u32 control;
+	u16 control;
 
    	pos = pci_find_capability(dev, PCI_CAP_ID_MSI);
-	if (!pos)
-		return -EINVAL;
-
-	dev->bus->ops->read(dev->bus, dev->devfn, msi_control_reg(pos),
-		2, &control);
-	if (control & PCI_MSI_FLAGS_ENABLE)
-		return 0;
-
-	if (!msi_lookup_vector(dev)) {
-		/* Lookup Sucess */
-		enable_msi_mode(dev, pos, PCI_CAP_ID_MSI);
-		return 0;
-	}
+	pci_read_config_word(dev, msi_control_reg(pos), &control);
 	/* MSI Entry Initialization */
 	if (!(entry = alloc_msi_entry()))
 		return -ENOMEM;
@@ -504,11 +538,14 @@
 		kmem_cache_free(msi_cachep, entry);
 		return -EBUSY;
 	}
+	entry->link.head = vector;
+	entry->link.tail = vector;
 	entry->msi_attrib.type = PCI_CAP_ID_MSI;
+	entry->msi_attrib.state = 0;			/* Mark it not active */
 	entry->msi_attrib.entry_nr = 0;
 	entry->msi_attrib.maskbit = is_mask_bit_support(control);
-	entry->msi_attrib.default_vector = dev->irq;
-	dev->irq = vector;	/* save default pre-assigned ioapic vector */
+	entry->msi_attrib.default_vector = dev->irq;	/* Save IOAPIC IRQ */
+	dev->irq = vector;
 	entry->dev = dev;
 	if (is_mask_bit_support(control)) {
 		entry->mask_base = msi_mask_bits_reg(pos,
@@ -521,27 +558,27 @@
 	msi_data_init(&data, vector);
 	entry->msi_attrib.current_cpu = ((address.lo_address.u.dest_id >>
 				MSI_TARGET_CPU_SHIFT) & MSI_TARGET_CPU_MASK);
-	dev->bus->ops->write(dev->bus, dev->devfn, msi_lower_address_reg(pos),
-				4, address.lo_address.value);
+	pci_write_config_dword(dev, msi_lower_address_reg(pos),
+			address.lo_address.value);
 	if (is_64bit_address(control)) {
-		dev->bus->ops->write(dev->bus, dev->devfn,
-			msi_upper_address_reg(pos), 4, address.hi_address);
-		dev->bus->ops->write(dev->bus, dev->devfn,
-			msi_data_reg(pos, 1), 2, *((u32*)&data));
+		pci_write_config_dword(dev,
+			msi_upper_address_reg(pos), address.hi_address);
+		pci_write_config_word(dev,
+			msi_data_reg(pos, 1), *((u32*)&data));
 	} else
-		dev->bus->ops->write(dev->bus, dev->devfn,
-			msi_data_reg(pos, 0), 2, *((u32*)&data));
+		pci_write_config_word(dev,
+			msi_data_reg(pos, 0), *((u32*)&data));
 	if (entry->msi_attrib.maskbit) {
 		unsigned int maskbits, temp;
 		/* All MSIs are unmasked by default, Mask them all */
-	        dev->bus->ops->read(dev->bus, dev->devfn,
-			msi_mask_bits_reg(pos, is_64bit_address(control)), 4,
+		pci_read_config_dword(dev,
+			msi_mask_bits_reg(pos, is_64bit_address(control)),
 			&maskbits);
 		temp = (1 << multi_msi_capable(control));
 		temp = ((temp - 1) & ~temp);
 		maskbits |= temp;
-		dev->bus->ops->write(dev->bus, dev->devfn,
-			msi_mask_bits_reg(pos, is_64bit_address(control)), 4,
+		pci_write_config_dword(dev,
+			msi_mask_bits_reg(pos, is_64bit_address(control)),
 			maskbits);
 	}
 	attach_msi_entry(entry, vector);
@@ -556,238 +593,219 @@
  * @dev: pointer to the pci_dev data structure of MSI-X device function
  *
  * Setup the MSI-X capability structure of device funtion with a
- * single MSI-X vector. A return of zero indicates the successful setup
- * of an entry zero with the new MSI-X vector or non-zero for otherwise.
- * To request for additional MSI-X vectors, the device drivers are
- * required to utilize the following supported APIs:
- * 1) msi_alloc_vectors(...) for requesting one or more MSI-X vectors
- * 2) msi_free_vectors(...) for releasing one or more MSI-X vectors
- *    back to PCI subsystem before calling free_irq(...)
+ * single MSI-X vector. A return of zero indicates the successful setup of
+ * requested MSI-X entries with allocated vectors or non-zero for otherwise.
  **/
-static int msix_capability_init(struct pci_dev	*dev)
+static int msix_capability_init(struct pci_dev *dev,
+				struct msix_entry *entries, int nvec)
 {
-	struct msi_desc *entry;
+	struct msi_desc *head = NULL, *tail = NULL, *entry = NULL;
 	struct msg_address address;
 	struct msg_data data;
-	int vector = 0, pos, dev_msi_cap, i;
+	int vector, pos, i, j, nr_entries, temp = 0;
 	u32 phys_addr, table_offset;
-	u32 control;
+ 	u16 control;
 	u8 bir;
 	void *base;
 
    	pos = pci_find_capability(dev, PCI_CAP_ID_MSIX);
-	if (!pos)
-		return -EINVAL;
-
 	/* Request & Map MSI-X table region */
-	dev->bus->ops->read(dev->bus, dev->devfn, msi_control_reg(pos), 2,
-		&control);
-	if (control & PCI_MSIX_FLAGS_ENABLE)
-		return 0;
-
-	if (!msi_lookup_vector(dev)) {
-		/* Lookup Sucess */
-		enable_msi_mode(dev, pos, PCI_CAP_ID_MSIX);
-		return 0;
-	}
-
-	dev_msi_cap = multi_msix_capable(control);
-	dev->bus->ops->read(dev->bus, dev->devfn,
-		msix_table_offset_reg(pos), 4, &table_offset);
+ 	pci_read_config_word(dev, msi_control_reg(pos), &control);
+	nr_entries = multi_msix_capable(control);
+ 	pci_read_config_dword(dev, msix_table_offset_reg(pos),
+ 		&table_offset);
 	bir = (u8)(table_offset & PCI_MSIX_FLAGS_BIRMASK);
 	phys_addr = pci_resource_start (dev, bir);
 	phys_addr += (u32)(table_offset & ~PCI_MSIX_FLAGS_BIRMASK);
 	if (!request_mem_region(phys_addr,
-		dev_msi_cap * PCI_MSIX_ENTRY_SIZE,
-		"MSI-X iomap Failure"))
+		nr_entries * PCI_MSIX_ENTRY_SIZE,
+		"MSI-X vector table"))
 		return -ENOMEM;
-	base = ioremap_nocache(phys_addr, dev_msi_cap * PCI_MSIX_ENTRY_SIZE);
-	if (base == NULL)
-		goto free_region;
-	/* MSI Entry Initialization */
-	entry = alloc_msi_entry();
-	if (!entry)
-		goto free_iomap;
-	if ((vector = get_msi_vector(dev)) < 0)
-		goto free_entry;
+	base = ioremap_nocache(phys_addr, nr_entries * PCI_MSIX_ENTRY_SIZE);
+	if (base == NULL) {
+		release_mem_region(phys_addr, nr_entries * PCI_MSIX_ENTRY_SIZE);
+		return -ENOMEM;
+	}
+	/* MSI-X Table Initialization */
+	for (i = 0; i < nvec; i++) {
+		entry = alloc_msi_entry();
+		if (!entry)
+			break;
+		if ((vector = get_msi_vector(dev)) < 0)
+			break;
 
-	entry->msi_attrib.type = PCI_CAP_ID_MSIX;
-	entry->msi_attrib.entry_nr = 0;
-	entry->msi_attrib.maskbit = 1;
-	entry->msi_attrib.default_vector = dev->irq;
-	dev->irq = vector;	/* save default pre-assigned ioapic vector */
-	entry->dev = dev;
-	entry->mask_base = (unsigned long)base;
-	/* Replace with MSI handler */
-	irq_handler_init(PCI_CAP_ID_MSIX, vector, 1);
-	/* Configure MSI-X capability structure */
-	msi_address_init(&address);
-	msi_data_init(&data, vector);
-	entry->msi_attrib.current_cpu = ((address.lo_address.u.dest_id >>
-				MSI_TARGET_CPU_SHIFT) & MSI_TARGET_CPU_MASK);
-	writel(address.lo_address.value, base + PCI_MSIX_ENTRY_LOWER_ADDR_OFFSET);
-	writel(address.hi_address, base + PCI_MSIX_ENTRY_UPPER_ADDR_OFFSET);
-	writel(*(u32*)&data, base + PCI_MSIX_ENTRY_DATA_OFFSET);
-	/* Initialize all entries from 1 up to 0 */
-	for (i = 1; i < dev_msi_cap; i++) {
-		writel(0, base + i * PCI_MSIX_ENTRY_SIZE +
+ 		j = entries[i].entry;
+ 		entries[i].vector = vector;
+		entry->msi_attrib.type = PCI_CAP_ID_MSIX;
+ 		entry->msi_attrib.state = 0;		/* Mark it not active */
+		entry->msi_attrib.entry_nr = j;
+		entry->msi_attrib.maskbit = 1;
+		entry->msi_attrib.default_vector = dev->irq;
+		entry->dev = dev;
+		entry->mask_base = (unsigned long)base;
+		if (!head) {
+			entry->link.head = vector;
+			entry->link.tail = vector;
+			head = entry;
+		} else {
+			entry->link.head = temp;
+			entry->link.tail = tail->link.tail;
+			tail->link.tail = vector;
+			head->link.head = vector;
+		}
+		temp = vector;
+		tail = entry;
+		/* Replace with MSI-X handler */
+		irq_handler_init(PCI_CAP_ID_MSIX, vector, 1);
+		/* Configure MSI-X capability structure */
+		msi_address_init(&address);
+		msi_data_init(&data, vector);
+		entry->msi_attrib.current_cpu =
+			((address.lo_address.u.dest_id >>
+			MSI_TARGET_CPU_SHIFT) & MSI_TARGET_CPU_MASK);
+		writel(address.lo_address.value,
+			base + j * PCI_MSIX_ENTRY_SIZE +
 			PCI_MSIX_ENTRY_LOWER_ADDR_OFFSET);
-		writel(0, base + i * PCI_MSIX_ENTRY_SIZE +
+		writel(address.hi_address,
+			base + j * PCI_MSIX_ENTRY_SIZE +
 			PCI_MSIX_ENTRY_UPPER_ADDR_OFFSET);
-		writel(0, base + i * PCI_MSIX_ENTRY_SIZE +
+		writel(*(u32*)&data,
+			base + j * PCI_MSIX_ENTRY_SIZE +
 			PCI_MSIX_ENTRY_DATA_OFFSET);
+		attach_msi_entry(entry, vector);
 	}
-	attach_msi_entry(entry, vector);
-	/* Set MSI enabled bits	 */
+	if (i != nvec) {
+		i--;
+		for (; i >= 0; i--) {
+			vector = (entries + i)->vector;
+			msi_free_vector(dev, vector, 0);
+			(entries + i)->vector = 0;
+		}
+		return -EBUSY;
+	}
+	/* Set MSI-X enabled bits */
 	enable_msi_mode(dev, pos, PCI_CAP_ID_MSIX);
 
 	return 0;
-
-free_entry:
-	kmem_cache_free(msi_cachep, entry);
-free_iomap:
-	iounmap(base);
-free_region:
-	release_mem_region(phys_addr, dev_msi_cap * PCI_MSIX_ENTRY_SIZE);
-
-	return ((vector < 0) ? -EBUSY : -ENOMEM);
 }
 
 /**
- * pci_enable_msi - configure device's MSI(X) capability structure
- * @dev: pointer to the pci_dev data structure of MSI(X) device function
+ * pci_enable_msi - configure device's MSI capability structure
+ * @dev: pointer to the pci_dev data structure of MSI device function
  *
- * Setup the MSI/MSI-X capability structure of device function with
- * a single MSI(X) vector upon its software driver call to request for
- * MSI(X) mode enabled on its hardware device function. A return of zero
- * indicates the successful setup of an entry zero with the new MSI(X)
+ * Setup the MSI capability structure of device function with
+ * a single MSI vector upon its software driver call to request for
+ * MSI mode enabled on its hardware device function. A return of zero
+ * indicates the successful setup of an entry zero with the new MSI
  * vector or non-zero for otherwise.
  **/
 int pci_enable_msi(struct pci_dev* dev)
 {
-	int status = -EINVAL;
+	int pos, temp = dev->irq, status = -EINVAL;
+	u16 control;
 
 	if (!pci_msi_enable || !dev)
  		return status;
 
-	if (msi_init() < 0)
-		return -ENOMEM;
+	if ((status = msi_init()) < 0)
+		return status;
 
-	if ((status = msix_capability_init(dev)) == -EINVAL)
-		status = msi_capability_init(dev);
-	if (!status)
-		nr_reserved_vectors--;
+   	if (!(pos = pci_find_capability(dev, PCI_CAP_ID_MSI)))
+		return -EINVAL;
+
+	pci_read_config_word(dev, msi_control_reg(pos), &control);
+	if (control & PCI_MSI_FLAGS_ENABLE)
+		return 0;			/* Already in MSI mode */
+
+	if (!msi_lookup_vector(dev, PCI_CAP_ID_MSI)) {
+		/* Lookup Sucess */
+		unsigned long flags;
+
+		spin_lock_irqsave(&msi_lock, flags);
+		if (!vector_irq[dev->irq]) {
+			msi_desc[dev->irq]->msi_attrib.state = 0;
+			vector_irq[dev->irq] = -1;
+			nr_released_vectors--;
+			spin_unlock_irqrestore(&msi_lock, flags);
+			enable_msi_mode(dev, pos, PCI_CAP_ID_MSI);
+			return 0;
+		}
+		spin_unlock_irqrestore(&msi_lock, flags);
+		dev->irq = temp;
+	}
+	/* Check whether driver already requested for MSI-X vectors */
+   	if ((pos = pci_find_capability(dev, PCI_CAP_ID_MSIX)) > 0 &&
+		!msi_lookup_vector(dev, PCI_CAP_ID_MSIX)) {
+			printk(KERN_INFO "Can't enable MSI. Device already had MSI-X vectors assigned\n");
+			dev->irq = temp;
+			return -EINVAL;
+	}
+	status = msi_capability_init(dev);
+	if (!status) {
+   		if (!pos)
+			nr_reserved_vectors--;	/* Only MSI capable */
+		else if (nr_msix_devices > 0)
+			nr_msix_devices--;	/* Both MSI and MSI-X capable,
+						   but choose enabling MSI */
+	}
 
 	return status;
 }
 
-static int msi_free_vector(struct pci_dev* dev, int vector);
-static void pci_disable_msi(unsigned int vector)
+void pci_disable_msi(struct pci_dev* dev)
 {
-	int head, tail, type, default_vector;
 	struct msi_desc *entry;
-	struct pci_dev *dev;
+	int pos, default_vector;
+	u16 control;
 	unsigned long flags;
 
+   	if (!dev || !(pos = pci_find_capability(dev, PCI_CAP_ID_MSI)))
+		return;
+
+	pci_read_config_word(dev, msi_control_reg(pos), &control);
+	if (!(control & PCI_MSI_FLAGS_ENABLE))
+		return;
+
 	spin_lock_irqsave(&msi_lock, flags);
-	entry = msi_desc[vector];
-	if (!entry || !entry->dev) {
+	entry = msi_desc[dev->irq];
+	if (!entry || !entry->dev || entry->msi_attrib.type != PCI_CAP_ID_MSI) {
 		spin_unlock_irqrestore(&msi_lock, flags);
 		return;
 	}
-	dev = entry->dev;
-	type = entry->msi_attrib.type;
-	head = entry->link.head;
-	tail = entry->link.tail;
-	default_vector = entry->msi_attrib.default_vector;
-	spin_unlock_irqrestore(&msi_lock, flags);
-
-	disable_msi_mode(dev, pci_find_capability(dev, type), type);
-	/* Restore dev->irq to its default pin-assertion vector */
-	dev->irq = default_vector;
-	if (type == PCI_CAP_ID_MSIX && head != tail) {
-		/* Bad driver, which do not call msi_free_vectors before exit.
-		   We must do a cleanup here */
-		while (1) {
-			spin_lock_irqsave(&msi_lock, flags);
-			entry = msi_desc[vector];
-			head = entry->link.head;
-			tail = entry->link.tail;
-			spin_unlock_irqrestore(&msi_lock, flags);
-			if (tail == head)
-				break;
-			if (msi_free_vector(dev, entry->link.tail))
-				break;
-		}
+	if (entry->msi_attrib.state) {
+		spin_unlock_irqrestore(&msi_lock, flags);
+		printk(KERN_DEBUG "Driver[%d:%d:%d] unloaded wo doing free_irq on vector->%d\n",
+		dev->bus->number, PCI_SLOT(dev->devfn),	PCI_FUNC(dev->devfn),
+		dev->irq);
+		BUG_ON(entry->msi_attrib.state > 0);
+	} else {
+		vector_irq[dev->irq] = 0; /* free it */
+		nr_released_vectors++;
+		default_vector = entry->msi_attrib.default_vector;
+		spin_unlock_irqrestore(&msi_lock, flags);
+		/* Restore dev->irq to its default pin-assertion vector */
+		dev->irq = default_vector;
+		disable_msi_mode(dev, pci_find_capability(dev, PCI_CAP_ID_MSI),
+					PCI_CAP_ID_MSI);
 	}
 }
 
-static int msi_alloc_vector(struct pci_dev* dev, int head)
+static void release_msi(unsigned int vector)
 {
 	struct msi_desc *entry;
-	struct msg_address address;
-	struct msg_data data;
-	int i, offset, pos, dev_msi_cap, vector;
-	u32 low_address, control;
-	unsigned long base = 0L;
 	unsigned long flags;
 
 	spin_lock_irqsave(&msi_lock, flags);
-	entry = msi_desc[dev->irq];
-	if (!entry) {
-		spin_unlock_irqrestore(&msi_lock, flags);
-		return -EINVAL;
-	}
-	base = entry->mask_base;
+	entry = msi_desc[vector];
+	if (entry && entry->dev)
+		entry->msi_attrib.state = 0;	/* Mark it not active */
 	spin_unlock_irqrestore(&msi_lock, flags);
-
-   	pos = pci_find_capability(dev, PCI_CAP_ID_MSIX);
-	dev->bus->ops->read(dev->bus, dev->devfn, msi_control_reg(pos),
-		2, &control);
-	dev_msi_cap = multi_msix_capable(control);
-	for (i = 1; i < dev_msi_cap; i++) {
-		if (!(low_address = readl(base + i * PCI_MSIX_ENTRY_SIZE)))
-			 break;
-	}
-	if (i >= dev_msi_cap)
-		return -EINVAL;
-
-	/* MSI Entry Initialization */
-	if (!(entry = alloc_msi_entry()))
-		return -ENOMEM;
-
-	if ((vector = get_new_vector()) < 0) {
-		kmem_cache_free(msi_cachep, entry);
-		return vector;
-	}
-	entry->msi_attrib.type = PCI_CAP_ID_MSIX;
-	entry->msi_attrib.entry_nr = i;
-	entry->msi_attrib.maskbit = 1;
-	entry->dev = dev;
-	entry->link.head = head;
-	entry->mask_base = base;
-	irq_handler_init(PCI_CAP_ID_MSIX, vector, 1);
-	/* Configure MSI-X capability structure */
-	msi_address_init(&address);
-	msi_data_init(&data, vector);
-	entry->msi_attrib.current_cpu = ((address.lo_address.u.dest_id >>
-				MSI_TARGET_CPU_SHIFT) & MSI_TARGET_CPU_MASK);
-	offset = entry->msi_attrib.entry_nr * PCI_MSIX_ENTRY_SIZE;
-	writel(address.lo_address.value, base + offset +
-		PCI_MSIX_ENTRY_LOWER_ADDR_OFFSET);
-	writel(address.hi_address, base + offset +
-		PCI_MSIX_ENTRY_UPPER_ADDR_OFFSET);
-	writel(*(u32*)&data, base + offset + PCI_MSIX_ENTRY_DATA_OFFSET);
-	writel(1, base + offset + PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET);
-	attach_msi_entry(entry, vector);
-
-	return vector;
 }
 
-static int msi_free_vector(struct pci_dev* dev, int vector)
+static int msi_free_vector(struct pci_dev* dev, int vector, int reassign)
 {
 	struct msi_desc *entry;
-	int entry_nr, type;
+	int head, entry_nr, type;
 	unsigned long base = 0L;
 	unsigned long flags;
 
@@ -799,66 +817,177 @@
 	}
 	type = entry->msi_attrib.type;
 	entry_nr = entry->msi_attrib.entry_nr;
+	head = entry->link.head;
 	base = entry->mask_base;
-	if (entry->link.tail != entry->link.head) {
-		msi_desc[entry->link.head]->link.tail = entry->link.tail;
-		if (entry->link.tail)
-			msi_desc[entry->link.tail]->link.head = entry->link.head;
-	}
+	msi_desc[entry->link.head]->link.tail = entry->link.tail;
+	msi_desc[entry->link.tail]->link.head = entry->link.head;
 	entry->dev = NULL;
-	vector_irq[vector] = 0;
-	nr_released_vectors++;
+	if (!reassign) {
+		vector_irq[vector] = 0;
+		nr_released_vectors++;
+	}
 	msi_desc[vector] = NULL;
 	spin_unlock_irqrestore(&msi_lock, flags);
 
 	kmem_cache_free(msi_cachep, entry);
+
 	if (type == PCI_CAP_ID_MSIX) {
-		int offset;
+		if (!reassign)
+			writel(1, base +
+				entry_nr * PCI_MSIX_ENTRY_SIZE +
+				PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET);
+
+		if (head == vector) {
+			/*
+			 * Detect last MSI-X vector to be released.
+			 * Release the MSI-X memory-mapped table.
+			 */
+			int pos, nr_entries;
+			u32 phys_addr, table_offset;
+			u16 control;
+			u8 bir;
+
+   			pos = pci_find_capability(dev, PCI_CAP_ID_MSIX);
+			pci_read_config_word(dev, msi_control_reg(pos),
+				&control);
+			nr_entries = multi_msix_capable(control);
+			pci_read_config_dword(dev, msix_table_offset_reg(pos),
+				&table_offset);
+			bir = (u8)(table_offset & PCI_MSIX_FLAGS_BIRMASK);
+			phys_addr = pci_resource_start (dev, bir);
+			phys_addr += (u32)(table_offset &
+				~PCI_MSIX_FLAGS_BIRMASK);
+			iounmap((void*)base);
+			release_mem_region(phys_addr,
+				nr_entries * PCI_MSIX_ENTRY_SIZE);
+		}
+	}
+
+	return 0;
+}
+
+static int reroute_msix_table(int head, struct msix_entry *entries, int *nvec)
+{
+	int vector = head, tail = 0;
+	int i = 0, j = 0, nr_entries = 0;
+	unsigned long base = 0L;
+	unsigned long flags;
 
-		offset = entry_nr * PCI_MSIX_ENTRY_SIZE;
-		writel(1, base + offset + PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET);
-		writel(0, base + offset + PCI_MSIX_ENTRY_LOWER_ADDR_OFFSET);
+	spin_lock_irqsave(&msi_lock, flags);
+	while (head != tail) {
+		nr_entries++;
+		tail = msi_desc[vector]->link.tail;
+		if (entries[0].entry == msi_desc[vector]->msi_attrib.entry_nr)
+			j = vector;
+		vector = tail;
 	}
+	if (*nvec > nr_entries) {
+		spin_unlock_irqrestore(&msi_lock, flags);
+		*nvec = nr_entries;
+		return -EINVAL;
+	}
+	vector = ((j > 0) ? j : head);
+	for (i = 0; i < *nvec; i++) {
+		j = msi_desc[vector]->msi_attrib.entry_nr;
+		msi_desc[vector]->msi_attrib.state = 0;	/* Mark it not active */
+		vector_irq[vector] = -1;		/* Mark it busy */
+		nr_released_vectors--;
+		entries[i].vector = vector;
+		if (j != (entries + i)->entry) {
+			base = msi_desc[vector]->mask_base;
+			msi_desc[vector]->msi_attrib.entry_nr =
+				(entries + i)->entry;
+			writel( readl(base + j * PCI_MSIX_ENTRY_SIZE +
+				PCI_MSIX_ENTRY_LOWER_ADDR_OFFSET), base +
+				(entries + i)->entry * PCI_MSIX_ENTRY_SIZE +
+				PCI_MSIX_ENTRY_LOWER_ADDR_OFFSET);
+			writel(	readl(base + j * PCI_MSIX_ENTRY_SIZE +
+				PCI_MSIX_ENTRY_UPPER_ADDR_OFFSET), base +
+				(entries + i)->entry * PCI_MSIX_ENTRY_SIZE +
+				PCI_MSIX_ENTRY_UPPER_ADDR_OFFSET);
+			writel( (readl(base + j * PCI_MSIX_ENTRY_SIZE +
+				PCI_MSIX_ENTRY_DATA_OFFSET) & 0xff00) | vector,
+				base + (entries+i)->entry*PCI_MSIX_ENTRY_SIZE +
+				PCI_MSIX_ENTRY_DATA_OFFSET);
+		}
+		vector = msi_desc[vector]->link.tail;
+	}
+	spin_unlock_irqrestore(&msi_lock, flags);
 
 	return 0;
 }
 
 /**
- * msi_alloc_vectors - allocate additional MSI-X vectors
+ * pci_enable_msix - configure device's MSI-X capability structure
  * @dev: pointer to the pci_dev data structure of MSI-X device function
- * @vector: pointer to an array of new allocated MSI-X vectors
+ * @data: pointer to an array of MSI-X entries
  * @nvec: number of MSI-X vectors requested for allocation by device driver
  *
- * Allocate additional MSI-X vectors requested by device driver. A
- * return of zero indicates the successful setup of MSI-X capability
- * structure with new allocated MSI-X vectors or non-zero for otherwise.
+ * Setup the MSI-X capability structure of device function with the number
+ * of requested vectors upon its software driver call to request for
+ * MSI-X mode enabled on its hardware device function. A return of zero
+ * indicates the successful configuration of MSI-X capability structure
+ * with new allocated MSI-X vectors. A return of < 0 indicates a failure.
+ * Or a return of > 0 indicates that driver request is exceeding the number
+ * of vectors available. Driver should use the returned value to re-send
+ * its request.
  **/
-int msi_alloc_vectors(struct pci_dev* dev, int *vector, int nvec)
+int pci_enable_msix(struct pci_dev* dev, struct msix_entry *entries, int nvec)
 {
-	struct msi_desc *entry;
-	int i, head, pos, vec, free_vectors, alloc_vectors;
-	int *vectors = (int *)vector;
-	u32 control;
+	int status, pos, nr_entries, free_vectors;
+	int i, j, temp;
+	u16 control;
 	unsigned long flags;
 
-	if (!pci_msi_enable || !dev)
+	if (!pci_msi_enable || !dev || !entries)
  		return -EINVAL;
 
+	if ((status = msi_init()) < 0)
+		return status;
+
    	if (!(pos = pci_find_capability(dev, PCI_CAP_ID_MSIX)))
  		return -EINVAL;
 
-	dev->bus->ops->read(dev->bus, dev->devfn, msi_control_reg(pos), 			2, &control);
-	if (nvec > multi_msix_capable(control))
+	pci_read_config_word(dev, msi_control_reg(pos), &control);
+	if (control & PCI_MSIX_FLAGS_ENABLE)
+		return -EINVAL;			/* Already in MSI-X mode */
+
+	nr_entries = multi_msix_capable(control);
+	if (nvec > nr_entries)
 		return -EINVAL;
 
-	spin_lock_irqsave(&msi_lock, flags);
-	entry = msi_desc[dev->irq];
-	if (!entry || entry->dev != dev ||		/* legal call */
-	   entry->msi_attrib.type != PCI_CAP_ID_MSIX || /* must be MSI-X */
-	   entry->link.head != entry->link.tail) {	/* already multi */
-		spin_unlock_irqrestore(&msi_lock, flags);
+	/* Check for any invalid entries */
+	for (i = 0; i < nvec; i++) {
+		if (entries[i].entry >= nr_entries)
+			return -EINVAL;		/* invalid entry */
+		for (j = i + 1; j < nvec; j++) {
+			if (entries[i].entry == entries[j].entry)
+				return -EINVAL;	/* duplicate entry */
+		}
+	}
+	temp = dev->irq;
+	if (!msi_lookup_vector(dev, PCI_CAP_ID_MSIX)) {
+		/* Lookup Sucess */
+		nr_entries = nvec;
+		/* Reroute MSI-X table */
+		if (reroute_msix_table(dev->irq, entries, &nr_entries)) {
+			/* #requested > #previous-assigned */
+			dev->irq = temp;
+			return nr_entries;
+		}
+		dev->irq = temp;
+		enable_msi_mode(dev, pos, PCI_CAP_ID_MSIX);
+		return 0;
+	}
+	/* Check whether driver already requested for MSI vector */
+   	if (pci_find_capability(dev, PCI_CAP_ID_MSI) > 0 &&
+		!msi_lookup_vector(dev, PCI_CAP_ID_MSI)) {
+		printk(KERN_INFO "Can't enable MSI-X. Device already had MSI vector assigned\n");
+		dev->irq = temp;
 		return -EINVAL;
 	}
+
+	spin_lock_irqsave(&msi_lock, flags);
 	/*
 	 * msi_lock is provided to ensure that enough vectors resources are
 	 * available before granting.
@@ -874,71 +1003,65 @@
 		free_vectors /= nr_msix_devices;
 	spin_unlock_irqrestore(&msi_lock, flags);
 
-	if (nvec > free_vectors)
-		return -EBUSY;
-
-	alloc_vectors = 0;
-	head = dev->irq;
-	for (i = 0; i < nvec; i++) {
-		if ((vec = msi_alloc_vector(dev, head)) < 0)
-			break;
-		*(vectors + i) = vec;
-		head = vec;
-		alloc_vectors++;
-	}
-	if (alloc_vectors != nvec) {
-		for (i = 0; i < alloc_vectors; i++) {
-			vec = *(vectors + i);
-			msi_free_vector(dev, vec);
-		}
-		spin_lock_irqsave(&msi_lock, flags);
-		msi_desc[dev->irq]->link.tail = msi_desc[dev->irq]->link.head;
-		spin_unlock_irqrestore(&msi_lock, flags);
-		return -EBUSY;
+	if (nvec > free_vectors) {
+		if (free_vectors > 0)
+			return free_vectors;
+		else
+			return -EBUSY;
 	}
-	if (nr_msix_devices > 0)
+
+	status = msix_capability_init(dev, entries, nvec);
+	if (!status && nr_msix_devices > 0)
 		nr_msix_devices--;
 
-	return 0;
+	return status;
 }
 
-/**
- * msi_free_vectors - reclaim MSI-X vectors to unused state
- * @dev: pointer to the pci_dev data structure of MSI-X device function
- * @vector: pointer to an array of released MSI-X vectors
- * @nvec: number of MSI-X vectors requested for release by device driver
- *
- * Reclaim MSI-X vectors released by device driver to unused state,
- * which may be used later on. A return of zero indicates the
- * success or non-zero for otherwise. Device driver should call this
- * before calling function free_irq.
- **/
-int msi_free_vectors(struct pci_dev* dev, int *vector, int nvec)
+void pci_disable_msix(struct pci_dev* dev)
 {
-	struct msi_desc *entry;
-	int i;
-	unsigned long flags;
+	int pos, temp;
+	u16 control;
 
-	if (!pci_msi_enable)
- 		return -EINVAL;
+   	if (!dev || !(pos = pci_find_capability(dev, PCI_CAP_ID_MSIX)))
+		return;
 
-	spin_lock_irqsave(&msi_lock, flags);
-	entry = msi_desc[dev->irq];
-	if (!entry || entry->dev != dev ||
-	   	entry->msi_attrib.type != PCI_CAP_ID_MSIX ||
-		entry->link.head == entry->link.tail) {	/* Nothing to free */
+	pci_read_config_word(dev, msi_control_reg(pos), &control);
+	if (!(control & PCI_MSIX_FLAGS_ENABLE))
+		return;
+
+	temp = dev->irq;
+	if (!msi_lookup_vector(dev, PCI_CAP_ID_MSIX)) {
+		int state, vector, head, tail = 0, warning = 0;
+		unsigned long flags;
+
+		vector = head = dev->irq;
+		spin_lock_irqsave(&msi_lock, flags);
+		while (head != tail) {
+			state = msi_desc[vector]->msi_attrib.state;
+			if (state)
+				warning = 1;
+			else {
+				vector_irq[vector] = 0; /* free it */
+				nr_released_vectors++;
+			}
+			tail = msi_desc[vector]->link.tail;
+			vector = tail;
+		}
 		spin_unlock_irqrestore(&msi_lock, flags);
-		return -EINVAL;
-	}
-	spin_unlock_irqrestore(&msi_lock, flags);
+		if (warning) {
+			dev->irq = temp;
+			printk(KERN_DEBUG "Driver[%d:%d:%d] unloaded wo doing free_irq on all vectors\n",
+			dev->bus->number, PCI_SLOT(dev->devfn),
+			PCI_FUNC(dev->devfn));
+			BUG_ON(warning > 0);
+		} else {
+			dev->irq = temp;
+			disable_msi_mode(dev,
+				pci_find_capability(dev, PCI_CAP_ID_MSIX),
+				PCI_CAP_ID_MSIX);
 
-	for (i = 0; i < nvec; i++) {
-		if (*(vector + i) == dev->irq)
-			continue;/* Don't free entry 0 if mistaken by driver */
-		msi_free_vector(dev, *(vector + i));
+		}
 	}
-
-	return 0;
 }
 
 /**
@@ -952,62 +1075,73 @@
  **/
 void msi_remove_pci_irq_vectors(struct pci_dev* dev)
 {
-	struct msi_desc *entry;
-	int type, temp;
+	int state, pos, temp;
 	unsigned long flags;
 
 	if (!pci_msi_enable || !dev)
  		return;
 
-   	if (!pci_find_capability(dev, PCI_CAP_ID_MSI)) {
-   		if (!pci_find_capability(dev, PCI_CAP_ID_MSIX))
-			return;
-	}
-	temp = dev->irq;
-	if (msi_lookup_vector(dev))
-		return;
-
-	spin_lock_irqsave(&msi_lock, flags);
-	entry = msi_desc[dev->irq];
-	if (!entry || entry->dev != dev) {
+	temp = dev->irq;		/* Save IOAPIC IRQ */
+   	if ((pos = pci_find_capability(dev, PCI_CAP_ID_MSI)) > 0 &&
+		!msi_lookup_vector(dev, PCI_CAP_ID_MSI)) {
+		spin_lock_irqsave(&msi_lock, flags);
+		state = msi_desc[dev->irq]->msi_attrib.state;
 		spin_unlock_irqrestore(&msi_lock, flags);
-		return;
-	}
-	type = entry->msi_attrib.type;
-	spin_unlock_irqrestore(&msi_lock, flags);
+		if (state) {
+			printk(KERN_DEBUG "Driver[%d:%d:%d] unloaded wo doing free_irq on vector->%d\n",
+			dev->bus->number, PCI_SLOT(dev->devfn),
+			PCI_FUNC(dev->devfn), dev->irq);
+			BUG_ON(state > 0);
+		} else /* Release MSI vector assigned to this device */
+			msi_free_vector(dev, dev->irq, 0);
+		dev->irq = temp;		/* Restore IOAPIC IRQ */
+	}
+   	if ((pos = pci_find_capability(dev, PCI_CAP_ID_MSIX)) > 0 &&
+		!msi_lookup_vector(dev, PCI_CAP_ID_MSIX)) {
+		int vector, head, tail = 0, warning = 0;
+		unsigned long base = 0L;
 
-	msi_free_vector(dev, dev->irq);
-	if (type == PCI_CAP_ID_MSIX) {
-		int i, pos, dev_msi_cap;
-		u32 phys_addr, table_offset;
-		u32 control;
-		u8 bir;
-
-   		pos = pci_find_capability(dev, PCI_CAP_ID_MSIX);
-		dev->bus->ops->read(dev->bus, dev->devfn, msi_control_reg(pos), 			2, &control);
-		dev_msi_cap = multi_msix_capable(control);
-		dev->bus->ops->read(dev->bus, dev->devfn,
-			msix_table_offset_reg(pos), 4, &table_offset);
-		bir = (u8)(table_offset & PCI_MSIX_FLAGS_BIRMASK);
-		phys_addr = pci_resource_start (dev, bir);
-		phys_addr += (u32)(table_offset & ~PCI_MSIX_FLAGS_BIRMASK);
-		for (i = FIRST_DEVICE_VECTOR; i < NR_IRQS; i++) {
+		vector = head = dev->irq;
+		while (head != tail) {
 			spin_lock_irqsave(&msi_lock, flags);
-			if (!msi_desc[i] || msi_desc[i]->dev != dev) {
-				spin_unlock_irqrestore(&msi_lock, flags);
-				continue;
-			}
+			state = msi_desc[vector]->msi_attrib.state;
+			tail = msi_desc[vector]->link.tail;
+			base = msi_desc[vector]->mask_base;
 			spin_unlock_irqrestore(&msi_lock, flags);
-			msi_free_vector(dev, i);
+			if (state)
+				warning = 1;
+			else if (vector != head) /* Release MSI-X vector */
+				msi_free_vector(dev, vector, 0);
+			vector = tail;
+		}
+		msi_free_vector(dev, vector, 0);
+		if (warning) {
+			/* Force to release the MSI-X memory-mapped table */
+			u32 phys_addr, table_offset;
+			u16 control;
+			u8 bir;
+
+			pci_read_config_word(dev, msi_control_reg(pos),
+				&control);
+			pci_read_config_dword(dev, msix_table_offset_reg(pos),
+				&table_offset);
+			bir = (u8)(table_offset & PCI_MSIX_FLAGS_BIRMASK);
+			phys_addr = pci_resource_start (dev, bir);
+			phys_addr += (u32)(table_offset &
+				~PCI_MSIX_FLAGS_BIRMASK);
+			iounmap((void*)base);
+			release_mem_region(phys_addr, PCI_MSIX_ENTRY_SIZE *
+				multi_msix_capable(control));
+			printk(KERN_DEBUG "Driver[%d:%d:%d] unloaded wo doing free_irq on all vectors\n",
+				dev->bus->number, PCI_SLOT(dev->devfn),
+				PCI_FUNC(dev->devfn));
+			BUG_ON(warning > 0);
 		}
-		writel(1, entry->mask_base + PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET);
-		iounmap((void*)entry->mask_base);
-		release_mem_region(phys_addr, dev_msi_cap * PCI_MSIX_ENTRY_SIZE);
+		dev->irq = temp;		/* Restore IOAPIC IRQ */
 	}
-	dev->irq = temp;
-	nr_reserved_vectors++;
 }
 
 EXPORT_SYMBOL(pci_enable_msi);
-EXPORT_SYMBOL(msi_alloc_vectors);
-EXPORT_SYMBOL(msi_free_vectors);
+EXPORT_SYMBOL(pci_disable_msi);
+EXPORT_SYMBOL(pci_enable_msix);
+EXPORT_SYMBOL(pci_disable_msix);
diff -urN linux-2.6.8-rc2/drivers/pci/msi.h linux-2.6.8-rc3/drivers/pci/msi.h
--- linux-2.6.8-rc2/drivers/pci/msi.h	2004-06-15 22:19:42.000000000 -0700
+++ linux-2.6.8-rc3/drivers/pci/msi.h	2004-08-03 15:21:48.134194546 -0700
@@ -140,7 +140,8 @@
 	struct {
 		__u8	type	: 5; 	/* {0: unused, 5h:MSI, 11h:MSI-X} */
 		__u8	maskbit	: 1; 	/* mask-pending bit supported ?   */
-		__u8	reserved: 2; 	/* reserved			  */
+		__u8	state	: 1; 	/* {0: free, 1: busy}		  */
+		__u8	reserved: 1; 	/* reserved			  */
 		__u8	entry_nr;    	/* specific enabled entry 	  */
 		__u8	default_vector; /* default pre-assigned vector    */
 		__u8	current_cpu; 	/* current destination cpu	  */
diff -urN linux-2.6.8-rc2/drivers/pci/quirks.c linux-2.6.8-rc3/drivers/pci/quirks.c
--- linux-2.6.8-rc2/drivers/pci/quirks.c	2004-08-03 15:21:08.548570707 -0700
+++ linux-2.6.8-rc3/drivers/pci/quirks.c	2004-08-03 15:21:48.281200576 -0700
@@ -718,6 +718,11 @@
 			case 0x8070: /* P4G8X Deluxe */
 				asus_hides_smbus = 1;
 			}
+		if (dev->device == PCI_DEVICE_ID_INTEL_82855GM_HB)
+			switch (dev->subsystem_device) {
+			case 0x1751: /* M2N notebook */
+				asus_hides_smbus = 1;
+			}
 	} else if (unlikely(dev->subsystem_vendor == PCI_VENDOR_ID_HP)) {
 		if (dev->device ==  PCI_DEVICE_ID_INTEL_82855PM_HB)
 			switch(dev->subsystem_device) {
@@ -1020,6 +1025,7 @@
 	{ PCI_FIXUP_HEADER,	PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_82850_HB,	asus_hides_smbus_hostbridge },
 	{ PCI_FIXUP_HEADER,	PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_7205_0,	asus_hides_smbus_hostbridge },
 	{ PCI_FIXUP_HEADER,	PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_82855PM_HB,	asus_hides_smbus_hostbridge },
+	{ PCI_FIXUP_HEADER,	PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_82855GM_HB,	asus_hides_smbus_hostbridge },
 	{ PCI_FIXUP_HEADER,	PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_82801DB_0,	asus_hides_smbus_lpc },
 	{ PCI_FIXUP_HEADER,	PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_82801BA_0,	asus_hides_smbus_lpc },
 	{ PCI_FIXUP_HEADER,	PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_82801DB_12,	asus_hides_smbus_lpc },
diff -urN linux-2.6.8-rc2/drivers/pcmcia/sa1100_generic.c linux-2.6.8-rc3/drivers/pcmcia/sa1100_generic.c
--- linux-2.6.8-rc2/drivers/pcmcia/sa1100_generic.c	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/drivers/pcmcia/sa1100_generic.c	2004-08-03 15:21:48.450207509 -0700
@@ -29,10 +29,6 @@
     file under either the MPL or the GPL.
     
 ======================================================================*/
-/*
- * Please see linux/Documentation/arm/SA1100/PCMCIA for more information
- * on the low-level kernel interface.
- */
 
 #include <linux/module.h>
 #include <linux/init.h>
diff -urN linux-2.6.8-rc2/drivers/pnp/pnpbios/bioscalls.c linux-2.6.8-rc3/drivers/pnp/pnpbios/bioscalls.c
--- linux-2.6.8-rc2/drivers/pnp/pnpbios/bioscalls.c	2004-08-03 15:21:08.650574886 -0700
+++ linux-2.6.8-rc3/drivers/pnp/pnpbios/bioscalls.c	2004-08-03 15:21:48.589213212 -0700
@@ -353,7 +353,7 @@
 	if (!pnp_bios_present())
 		return PNP_FUNCTION_NOT_SUPPORTED;
 	status = call_pnp_bios(PNP_GET_EVENT, 0, PNP_TS1, PNP_DS, 0, 0 ,0 ,0,
-			       event, sizeof(u16), 0, 0);
+			       event, sizeof(u16), NULL, 0);
 	return status;
 }
 #endif
@@ -411,7 +411,7 @@
 	if (!pnp_bios_present())
 		return PNP_FUNCTION_NOT_SUPPORTED;
 	status = call_pnp_bios(PNP_GET_STATIC_ALLOCED_RES_INFO, 0, PNP_TS1, PNP_DS, 0, 0, 0, 0,
-			       info, 65536, 0, 0);
+			       info, 65536, NULL, 0);
 	return status;
 }
 
@@ -448,7 +448,7 @@
 	if (!pnp_bios_present())
 		return PNP_FUNCTION_NOT_SUPPORTED;
 	status = call_pnp_bios(PNP_GET_PNP_ISA_CONFIG_STRUC, 0, PNP_TS1, PNP_DS, 0, 0, 0, 0,
-			       data, sizeof(struct pnp_isa_config_struc), 0, 0);
+			       data, sizeof(struct pnp_isa_config_struc), NULL, 0);
 	return status;
 }
 
@@ -470,7 +470,7 @@
 	if (!pnp_bios_present())
 		return ESCD_FUNCTION_NOT_SUPPORTED;
 	status = call_pnp_bios(PNP_GET_ESCD_INFO, 0, PNP_TS1, 2, PNP_TS1, 4, PNP_TS1, PNP_DS,
-			       data, sizeof(struct escd_info_struc), 0, 0);
+			       data, sizeof(struct escd_info_struc), NULL, 0);
 	return status;
 }
 
diff -urN linux-2.6.8-rc2/drivers/s390/cio/device_ops.c linux-2.6.8-rc3/drivers/s390/cio/device_ops.c
--- linux-2.6.8-rc2/drivers/s390/cio/device_ops.c	2004-08-03 15:21:08.668575624 -0700
+++ linux-2.6.8-rc3/drivers/s390/cio/device_ops.c	2004-08-03 15:21:48.893225683 -0700
@@ -1,7 +1,7 @@
 /*
  *  drivers/s390/cio/device_ops.c
  *
- *   $Revision: 1.47 $
+ *   $Revision: 1.49 $
  *
  *    Copyright (C) 2002 IBM Deutschland Entwicklung GmbH,
  *			 IBM Corporation
@@ -15,6 +15,7 @@
 #include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/device.h>
+#include <linux/delay.h>
 
 #include <asm/ccwdev.h>
 #include <asm/idals.h>
@@ -268,7 +269,7 @@
 		if ((ret == -EBUSY) || (ret == -EACCES)) {
 			/* Try again later. */
 			spin_unlock_irq(&sch->lock);
-			schedule_timeout(1);
+			msleep(10);
 			spin_lock_irq(&sch->lock);
 			continue;
 		}
diff -urN linux-2.6.8-rc2/drivers/s390/net/ctcdbug.c linux-2.6.8-rc3/drivers/s390/net/ctcdbug.c
--- linux-2.6.8-rc2/drivers/s390/net/ctcdbug.c	2004-08-03 15:21:08.677575992 -0700
+++ linux-2.6.8-rc3/drivers/s390/net/ctcdbug.c	2004-08-03 15:21:48.921226832 -0700
@@ -1,15 +1,15 @@
 /*
  *
- * linux/drivers/s390/net/ctcdbug.c ($Revision: 1.1 $)
+ * linux/drivers/s390/net/ctcdbug.c ($Revision: 1.2 $)
  *
- * Linux on zSeries OSA Express and HiperSockets support
+ * CTC / ESCON network driver - s390 dbf exploit.
  *
  * Copyright 2000,2003 IBM Corporation
  *
  *    Author(s): Original Code written by
  *			  Peter Tiedemann (ptiedem@de.ibm.com)
  *
- *    $Revision: 1.1 $	 $Date: 2004/07/02 16:31:22 $
+ *    $Revision: 1.2 $	 $Date: 2004/07/15 16:03:08 $
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
diff -urN linux-2.6.8-rc2/drivers/s390/net/ctcdbug.h linux-2.6.8-rc3/drivers/s390/net/ctcdbug.h
--- linux-2.6.8-rc2/drivers/s390/net/ctcdbug.h	2004-08-03 15:21:08.678576033 -0700
+++ linux-2.6.8-rc3/drivers/s390/net/ctcdbug.h	2004-08-03 15:21:48.922226873 -0700
@@ -1,15 +1,15 @@
 /*
  *
- * linux/drivers/s390/net/ctcdbug.h ($Revision: 1.1 $)
+ * linux/drivers/s390/net/ctcdbug.h ($Revision: 1.2 $)
  *
- * Linux on zSeries OSA Express and HiperSockets support
+ * CTC / ESCON network driver - s390 dbf exploit.
  *
  * Copyright 2000,2003 IBM Corporation
  *
  *    Author(s): Original Code written by
  *			  Peter Tiedemann (ptiedem@de.ibm.com)
  *
- *    $Revision: 1.1 $	 $Date: 2004/07/02 16:31:22 $
+ *    $Revision: 1.2 $	 $Date: 2004/07/15 16:03:08 $
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
diff -urN linux-2.6.8-rc2/drivers/s390/net/ctcmain.c linux-2.6.8-rc3/drivers/s390/net/ctcmain.c
--- linux-2.6.8-rc2/drivers/s390/net/ctcmain.c	2004-08-03 15:21:08.681576156 -0700
+++ linux-2.6.8-rc3/drivers/s390/net/ctcmain.c	2004-08-03 15:21:48.950228022 -0700
@@ -1,5 +1,5 @@
 /*
- * $Id: ctcmain.c,v 1.61 2004/07/02 16:31:22 ptiedem Exp $
+ * $Id: ctcmain.c,v 1.62 2004/07/15 16:03:08 ptiedem Exp $
  *
  * CTC / ESCON network driver
  *
@@ -36,7 +36,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * RELEASE-TAG: CTC/ESCON network driver $Revision: 1.61 $
+ * RELEASE-TAG: CTC/ESCON network driver $Revision: 1.62 $
  *
  */
 
@@ -320,7 +320,7 @@
 print_banner(void)
 {
 	static int printed = 0;
-	char vbuf[] = "$Revision: 1.61 $";
+	char vbuf[] = "$Revision: 1.62 $";
 	char *version = vbuf;
 
 	if (printed)
@@ -619,7 +619,7 @@
 	struct ctc_priv *privptr = (struct ctc_priv *) dev->priv;
 	__u16 len = *((__u16 *) pskb->data);
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	skb_put(pskb, 2 + LL_HEADER_LENGTH);
 	skb_pull(pskb, 2);
 	pskb->dev = dev;
@@ -724,7 +724,7 @@
 		if (ch->protocol == CTC_PROTO_LINUX_TTY)
 			ctc_tty_netif_rx(skb);
 		else
-			netif_rx(skb);
+			netif_rx_ni(skb);
 		/**
 		 * Successful rx; reset logflags
 		 */
@@ -761,7 +761,7 @@
 static void inline
 ccw_check_return_code(struct channel *ch, int return_code, char *msg)
 {
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 5, __FUNCTION__);
 	switch (return_code) {
 		case 0:
 			fsm_event(ch->fsm, CH_EVENT_IO_SUCCESS, ch);
@@ -796,7 +796,7 @@
 static void inline
 ccw_unit_check(struct channel *ch, unsigned char sense)
 {
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 5, __FUNCTION__);
 	if (sense & SNS0_INTERVENTION_REQ) {
 		if (sense & 0x01) {
 			if (ch->protocol != CTC_PROTO_LINUX_TTY)
@@ -842,7 +842,7 @@
 {
 	struct sk_buff *skb;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 5, __FUNCTION__);
 
 	while ((skb = skb_dequeue(q))) {
 		atomic_dec(&skb->users);
@@ -853,7 +853,7 @@
 static __inline__ int
 ctc_checkalloc_buffer(struct channel *ch, int warn)
 {
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 5, __FUNCTION__);
 	if ((ch->trans_skb == NULL) ||
 	    (ch->flags & CHANNEL_FLAGS_BUFSIZE_CHANGED)) {
 		if (ch->trans_skb != NULL)
@@ -923,7 +923,7 @@
 	unsigned long duration;
 	struct timespec done_stamp = xtime;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 4, __FUNCTION__);
 
 	duration =
 	    (done_stamp.tv_sec - ch->prof.send_stamp.tv_sec) * 1000000 +
@@ -1006,7 +1006,7 @@
 {
 	struct channel *ch = (struct channel *) arg;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	fsm_deltimer(&ch->timer);
 	fsm_newstate(fi, CH_STATE_TXIDLE);
 	fsm_event(((struct ctc_priv *) ch->netdev->priv)->fsm, DEV_EVENT_TXUP,
@@ -1033,7 +1033,7 @@
 	int check_len;
 	int rc;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	fsm_deltimer(&ch->timer);
 	if (len < 8) {
 		ctc_pr_debug("%s: got packet with length %d < 8\n",
@@ -1104,7 +1104,7 @@
 	struct channel *ch = (struct channel *) arg;
 	int rc;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 4, __FUNCTION__);
 
 	if (fsm_getstate(fi) == CH_STATE_TXIDLE)
 		ctc_pr_debug("%s: remote side issued READ?, init ...\n", ch->id);
@@ -1180,7 +1180,7 @@
 	__u16 buflen;
 	int rc;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	fsm_deltimer(&ch->timer);
 	buflen = *((__u16 *) ch->trans_skb->data);
 #ifdef DEBUG
@@ -1220,7 +1220,7 @@
 	int rc;
 	unsigned long saveflags;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	fsm_deltimer(&ch->timer);
 	fsm_addtimer(&ch->timer, CTC_TIMEOUT_5SEC, CH_EVENT_TIMER, ch);
 	fsm_newstate(fi, CH_STATE_SETUPWAIT);
@@ -1252,7 +1252,7 @@
 	int rc;
 	struct net_device *dev;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	if (ch == NULL) {
 		ctc_pr_warn("ch_action_start ch=NULL\n");
 		return;
@@ -1332,7 +1332,7 @@
 	int rc;
 	int oldstate;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	fsm_deltimer(&ch->timer);
 	fsm_addtimer(&ch->timer, CTC_TIMEOUT_5SEC, CH_EVENT_TIMER, ch);
 	if (event == CH_EVENT_STOP)
@@ -1365,7 +1365,7 @@
 	struct channel *ch = (struct channel *) arg;
 	struct net_device *dev = ch->netdev;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	fsm_deltimer(&ch->timer);
 	fsm_newstate(fi, CH_STATE_STOPPED);
 	if (ch->trans_skb != NULL) {
@@ -1417,7 +1417,7 @@
 	struct channel *ch = (struct channel *) arg;
 	struct net_device *dev = ch->netdev;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	fsm_deltimer(&ch->timer);
 	fsm_newstate(fi, CH_STATE_NOTOP);
 	if (CHANNEL_DIRECTION(ch->flags) == READ) {
@@ -1448,7 +1448,7 @@
 	struct channel *ch = (struct channel *) arg;
 	struct net_device *dev = ch->netdev;
 
-	DBF_TEXT(setup, 2, __FUNCTION__);
+	DBF_TEXT(setup, 3, __FUNCTION__);
 	/**
 	 * Special case: Got UC_RCRESET on setmode.
 	 * This means that remote side isn't setup. In this case
@@ -1501,7 +1501,7 @@
 	struct channel *ch = (struct channel *) arg;
 	struct net_device *dev = ch->netdev;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	fsm_deltimer(&ch->timer);
 	ctc_pr_debug("%s: %s channel restart\n", dev->name,
 		     (CHANNEL_DIRECTION(ch->flags) == READ) ? "RX" : "TX");
@@ -1536,7 +1536,7 @@
 	struct channel *ch = (struct channel *) arg;
 	struct net_device *dev = ch->netdev;
 
-	DBF_TEXT(setup, 2, __FUNCTION__);
+	DBF_TEXT(setup, 3, __FUNCTION__);
 	if (event == CH_EVENT_TIMER) {
 		fsm_deltimer(&ch->timer);
 		ctc_pr_debug("%s: Timeout during RX init handshake\n", dev->name);
@@ -1565,7 +1565,7 @@
 	struct channel *ch = (struct channel *) arg;
 	struct net_device *dev = ch->netdev;
 
-	DBF_TEXT(setup, 2, __FUNCTION__);
+	DBF_TEXT(setup, 3, __FUNCTION__);
 	fsm_newstate(fi, CH_STATE_RXERR);
 	ctc_pr_warn("%s: RX initialization failed\n", dev->name);
 	ctc_pr_warn("%s: RX <-> RX connection detected\n", dev->name);
@@ -1586,7 +1586,7 @@
 	struct channel *ch2;
 	struct net_device *dev = ch->netdev;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	fsm_deltimer(&ch->timer);
 	ctc_pr_debug("%s: Got remote disconnect, re-initializing ...\n",
 		     dev->name);
@@ -1647,7 +1647,7 @@
 	struct net_device *dev = ch->netdev;
 	unsigned long saveflags;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	fsm_deltimer(&ch->timer);
 	if (ch->retry++ > 3) {
 		ctc_pr_debug("%s: TX retry failed, restarting channel\n",
@@ -1705,7 +1705,7 @@
 	struct channel *ch = (struct channel *) arg;
 	struct net_device *dev = ch->netdev;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	fsm_deltimer(&ch->timer);
 	if (CHANNEL_DIRECTION(ch->flags) == READ) {
 		ctc_pr_debug("%s: RX I/O error\n", dev->name);
@@ -1727,7 +1727,7 @@
  	struct net_device *dev = ch->netdev;
  	struct ctc_priv *privptr = dev->priv;
  
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 4, __FUNCTION__);
  	ch_action_iofatal(fi, event, arg);
  	fsm_addtimer(&privptr->restart_timer, 1000, DEV_EVENT_RESTART, dev);
 }
@@ -2021,7 +2021,7 @@
 {
 	struct channel *ch = channels;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 #ifdef DEBUG
 	ctc_pr_debug("ctc: %s(): searching for ch with id %s and type %d\n",
 		     __func__, id, type);
@@ -2117,7 +2117,7 @@
 	struct net_device *dev;
 	struct ctc_priv *priv;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 5, __FUNCTION__);
 	if (__ctc_check_irb_error(cdev, irb))
 		return;
 
@@ -2211,7 +2211,7 @@
 	struct ctc_priv *privptr = dev->priv;
 	int direction;
 
-	DBF_TEXT(setup, 2, __FUNCTION__);
+	DBF_TEXT(setup, 3, __FUNCTION__);
 	fsm_deltimer(&privptr->restart_timer);
 	fsm_newstate(fi, DEV_STATE_STARTWAIT_RXTX);
 	for (direction = READ; direction <= WRITE; direction++) {
@@ -2234,7 +2234,7 @@
 	struct ctc_priv *privptr = dev->priv;
 	int direction;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	fsm_newstate(fi, DEV_STATE_STOPWAIT_RXTX);
 	for (direction = READ; direction <= WRITE; direction++) {
 		struct channel *ch = privptr->channel[direction];
@@ -2247,7 +2247,7 @@
 	struct net_device *dev = (struct net_device *)arg;
 	struct ctc_priv *privptr = dev->priv;
 	
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	ctc_pr_debug("%s: Restarting\n", dev->name);
 	dev_action_stop(fi, event, arg);
 	fsm_event(privptr->fsm, DEV_EVENT_STOP, dev);
@@ -2269,7 +2269,7 @@
 	struct net_device *dev = (struct net_device *) arg;
 	struct ctc_priv *privptr = dev->priv;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	switch (fsm_getstate(fi)) {
 		case DEV_STATE_STARTWAIT_RXTX:
 			if (event == DEV_EVENT_RXUP)
@@ -2322,7 +2322,7 @@
 	struct net_device *dev = (struct net_device *) arg;
 	struct ctc_priv *privptr = dev->priv;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	switch (fsm_getstate(fi)) {
 		case DEV_STATE_RUNNING:
 			if (privptr->protocol == CTC_PROTO_LINUX_TTY)
@@ -2424,7 +2424,7 @@
 	struct ll_header header;
 	int rc = 0;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 5, __FUNCTION__);
 	if (fsm_getstate(ch->fsm) != CH_STATE_TXIDLE) {
 		int l = skb->len + LL_HEADER_LENGTH;
 
@@ -2561,6 +2561,7 @@
 static int
 ctc_open(struct net_device * dev)
 {
+	DBF_TEXT(trace, 5, __FUNCTION__);
 	fsm_event(((struct ctc_priv *) dev->priv)->fsm, DEV_EVENT_START, dev);
 	return 0;
 }
@@ -2576,6 +2577,7 @@
 static int
 ctc_close(struct net_device * dev)
 {
+	DBF_TEXT(trace, 5, __FUNCTION__);
 	fsm_event(((struct ctc_priv *) dev->priv)->fsm, DEV_EVENT_STOP, dev);
 	return 0;
 }
@@ -2597,7 +2599,7 @@
 	int rc = 0;
 	struct ctc_priv *privptr = (struct ctc_priv *) dev->priv;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 5, __FUNCTION__);
 	/**
 	 * Some sanity checks ...
 	 */
@@ -2655,7 +2657,7 @@
 {
 	struct ctc_priv *privptr = (struct ctc_priv *) dev->priv;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	if ((new_mtu < 576) || (new_mtu > 65527) ||
 	    (new_mtu > (privptr->channel[READ]->max_bufsize -
 			LL_HEADER_LENGTH - 2)))
@@ -2700,7 +2702,7 @@
 	struct net_device *ndev;
 	int bs1;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 5, __FUNCTION__);
 	priv = dev->driver_data;
 	if (!priv)
 		return -ENODEV;
@@ -2745,7 +2747,7 @@
 	struct ctc_priv *priv;
 	int ll1;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 5, __FUNCTION__);
 	priv = dev->driver_data;
 	if (!priv)
 		return -ENODEV;
@@ -2763,7 +2765,7 @@
 	char *sbuf;
 	char *p;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	if (!priv)
 		return;
 	sbuf = (char *)kmalloc(2048, GFP_KERNEL);
@@ -2893,7 +2895,7 @@
 	if (!privptr)
 		return NULL;
 
-	DBF_TEXT(setup, 2, __FUNCTION__);
+	DBF_TEXT(setup, 3, __FUNCTION__);
 	if (alloc_device) {
 		dev = kmalloc(sizeof (struct net_device), GFP_KERNEL);
 		if (!dev)
@@ -2945,7 +2947,7 @@
 	struct ctc_priv *priv;
 	int value;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	pr_debug("%s() called\n", __FUNCTION__);
 
 	priv = dev->driver_data;
@@ -3017,7 +3019,7 @@
 	int rc;
 
 	pr_debug("%s() called\n", __FUNCTION__);
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 
 	if (!get_device(&cgdev->dev))
 		return -ENODEV;
@@ -3064,7 +3066,7 @@
 	int ret;
 
 	pr_debug("%s() called\n", __FUNCTION__);
-	DBF_TEXT(setup, 2, __FUNCTION__);
+	DBF_TEXT(setup, 3, __FUNCTION__);
 
 	privptr = cgdev->dev.driver_data;
 	if (!privptr)
@@ -3158,7 +3160,7 @@
 	struct ctc_priv *priv;
 	struct net_device *ndev;
 		
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	pr_debug("%s() called\n", __FUNCTION__);
 
 	priv = cgdev->dev.driver_data;
@@ -3209,7 +3211,7 @@
 	struct ctc_priv *priv;
 
 	pr_debug("%s() called\n", __FUNCTION__);
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 
 	priv = cgdev->dev.driver_data;
 	if (!priv)
diff -urN linux-2.6.8-rc2/drivers/s390/net/ctctty.c linux-2.6.8-rc3/drivers/s390/net/ctctty.c
--- linux-2.6.8-rc2/drivers/s390/net/ctctty.c	2004-08-03 15:21:08.683576238 -0700
+++ linux-2.6.8-rc3/drivers/s390/net/ctctty.c	2004-08-03 15:21:49.022230975 -0700
@@ -1,5 +1,5 @@
 /*
- * $Id: ctctty.c,v 1.21 2004/07/02 16:31:22 ptiedem Exp $
+ * $Id: ctctty.c,v 1.24 2004/07/15 16:03:08 ptiedem Exp $
  *
  * CTC / ESCON network driver, tty interface.
  *
@@ -104,7 +104,7 @@
 	int len;
 	struct tty_struct *tty;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 5, __FUNCTION__);
 	if ((tty = info->tty)) {
 		if (info->mcr & UART_MCR_RTS) {
 			c = TTY_FLIPBUF_SIZE - tty->flip.count;
@@ -134,7 +134,7 @@
 	int ret = 1;
 	struct tty_struct *tty;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 5, __FUNCTION__);
 	if ((tty = info->tty)) {
 		if (info->mcr & UART_MCR_RTS) {
 			int c = TTY_FLIPBUF_SIZE - tty->flip.count;
@@ -168,7 +168,7 @@
 {
 	int i;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	if ((!driver) || ctc_tty_shuttingdown)
 		return;
 	for (i = 0; i < CTC_TTY_MAX_DEVICES; i++)
@@ -189,7 +189,7 @@
 	int i;
 	ctc_tty_info *info = NULL;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 5, __FUNCTION__);
 	if (!skb)
 		return;
 	if ((!skb->dev) || (!driver) || ctc_tty_shuttingdown) {
@@ -254,7 +254,7 @@
 	int wake = 1;
 	int rc;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	if (!info->netdev) {
 		if (skb)
 			kfree_skb(skb);
@@ -347,7 +347,7 @@
 	int skb_res;
 	struct sk_buff *skb;
 	
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	if (ctc_tty_shuttingdown)
 		return;
 	skb_res = info->netdev->hard_header_len + sizeof(info->mcr) +
@@ -368,7 +368,7 @@
 static void
 ctc_tty_transmit_status(ctc_tty_info *info)
 {
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 5, __FUNCTION__);
 	if (ctc_tty_shuttingdown)
 		return;
 	info->flags |= CTC_ASYNC_TX_LINESTAT;
@@ -382,7 +382,7 @@
 	unsigned int quot;
 	int i;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	if (!info->tty || !info->tty->termios)
 		return;
 	cflag = info->tty->termios->c_cflag;
@@ -421,7 +421,7 @@
 static int
 ctc_tty_startup(ctc_tty_info * info)
 {
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	if (info->flags & CTC_ASYNC_INITIALIZED)
 		return 0;
 #ifdef CTC_DEBUG_MODEM_OPEN
@@ -464,7 +464,7 @@
 static void
 ctc_tty_shutdown(ctc_tty_info * info)
 {
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	if (!(info->flags & CTC_ASYNC_INITIALIZED))
 		return;
 #ifdef CTC_DEBUG_MODEM_OPEN
@@ -497,7 +497,7 @@
 	int total = 0;
 	ctc_tty_info *info = (ctc_tty_info *) tty->driver_data;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 5, __FUNCTION__);
 	if (ctc_tty_shuttingdown)
 		goto ex;
 	if (ctc_tty_paranoia_check(info, tty->name, "ctc_tty_write"))
@@ -575,7 +575,7 @@
 	ctc_tty_info *info;
 	unsigned long flags;
 
-	DBF_TEXT(trace, 2, __FUNCTION__);
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	if (!tty)
 		goto ex;
 	spin_lock_irqsave(&ctc_tty_lock, flags);
@@ -601,6 +601,7 @@
 {
 	ctc_tty_info *info = (ctc_tty_info *) tty->driver_data;
 
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	if (ctc_tty_shuttingdown)
 		return;
 	if (ctc_tty_paranoia_check(info, tty->name, "ctc_tty_flush_chars"))
@@ -623,6 +624,7 @@
 {
 	ctc_tty_info *info = (ctc_tty_info *) tty->driver_data;
 
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	if (ctc_tty_paranoia_check(info, tty->name, "ctc_tty_throttle"))
 		return;
 	info->mcr &= ~UART_MCR_RTS;
@@ -636,6 +638,7 @@
 {
 	ctc_tty_info *info = (ctc_tty_info *) tty->driver_data;
 
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	if (ctc_tty_paranoia_check(info, tty->name, "ctc_tty_unthrottle"))
 		return;
 	info->mcr |= UART_MCR_RTS;
@@ -667,6 +670,7 @@
 	uint result;
 	ulong flags;
 
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	spin_lock_irqsave(&ctc_tty_lock, flags);
 	status = info->lsr;
 	spin_unlock_irqrestore(&ctc_tty_lock, flags);
@@ -684,6 +688,7 @@
 	uint result;
 	ulong flags;
 
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	if (ctc_tty_paranoia_check(info, tty->name, "ctc_tty_ioctl"))
 		return -ENODEV;
 	if (tty->flags & (1 << TTY_IO_ERROR))
@@ -708,6 +713,7 @@
 {
 	ctc_tty_info *info = (ctc_tty_info *) tty->driver_data;
 
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	if (ctc_tty_paranoia_check(info, tty->name, "ctc_tty_ioctl"))
 		return -ENODEV;
 	if (tty->flags & (1 << TTY_IO_ERROR))
@@ -736,6 +742,7 @@
 	int error;
 	int retval;
 
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	if (ctc_tty_paranoia_check(info, tty->name, "ctc_tty_ioctl"))
 		return -ENODEV;
 	if (tty->flags & (1 << TTY_IO_ERROR))
@@ -803,6 +810,8 @@
 {
 	ctc_tty_info *info = (ctc_tty_info *) tty->driver_data;
 	unsigned int cflag = tty->termios->c_cflag;
+
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	ctc_tty_change_speed(info);
 
 	/* Handle transition to B0 */
@@ -840,6 +849,7 @@
 	unsigned long flags;
 	int retval;
 
+	DBF_TEXT(trace, 4, __FUNCTION__);
 	/*
 	 * If the device is in the middle of being closed, then block
 	 * until it's done, and then try again.
@@ -944,6 +954,7 @@
 	int retval,
 	 line;
 
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	line = tty->index;
 	if (line < 0 || line > CTC_TTY_MAX_DEVICES)
 		return -ENODEV;
@@ -990,7 +1001,7 @@
 	ctc_tty_info *info = (ctc_tty_info *) tty->driver_data;
 	ulong flags;
 	ulong timeout;
-
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	if (!info || ctc_tty_paranoia_check(info, tty->name, "ctc_tty_close"))
 		return;
 	spin_lock_irqsave(&ctc_tty_lock, flags);
@@ -1080,6 +1091,7 @@
 {
 	ctc_tty_info *info = (ctc_tty_info *)tty->driver_data;
 	unsigned long saveflags;
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	if (ctc_tty_paranoia_check(info, tty->name, "ctc_tty_hangup"))
 		return;
 	ctc_tty_shutdown(info);
@@ -1103,6 +1115,7 @@
 	unsigned long saveflags;
 	int again;
 
+	DBF_TEXT(trace, 3, __FUNCTION__);
 	spin_lock_irqsave(&ctc_tty_lock, saveflags);
 	if ((!ctc_tty_shuttingdown) && info) {
 		again = ctc_tty_tint(info);
@@ -1140,6 +1153,7 @@
 	ctc_tty_info *info;
 	struct tty_driver *device;
 
+	DBF_TEXT(trace, 2, __FUNCTION__);
 	driver = kmalloc(sizeof(ctc_tty_driver), GFP_KERNEL);
 	if (driver == NULL) {
 		printk(KERN_WARNING "Out of memory in ctc_tty_modem_init\n");
@@ -1199,6 +1213,7 @@
 	char *err;
 	char *p;
 
+	DBF_TEXT(trace, 2, __FUNCTION__);
 	if ((!dev) || (!dev->name)) {
 		printk(KERN_WARNING
 		       "ctc_tty_register_netdev called "
@@ -1246,6 +1261,7 @@
 	unsigned long saveflags;
 	ctc_tty_info *info = NULL;
 
+	DBF_TEXT(trace, 2, __FUNCTION__);
 	spin_lock_irqsave(&ctc_tty_lock, saveflags);
 	for (i = 0; i < CTC_TTY_MAX_DEVICES; i++)
 		if (driver->info[i].netdev == dev) {
@@ -1264,6 +1280,7 @@
 ctc_tty_cleanup(void) {
 	unsigned long saveflags;
 	
+	DBF_TEXT(trace, 2, __FUNCTION__);
 	spin_lock_irqsave(&ctc_tty_lock, saveflags);
 	ctc_tty_shuttingdown = 1;
 	spin_unlock_irqrestore(&ctc_tty_lock, saveflags);
diff -urN linux-2.6.8-rc2/drivers/s390/net/iucv.c linux-2.6.8-rc3/drivers/s390/net/iucv.c
--- linux-2.6.8-rc2/drivers/s390/net/iucv.c	2004-08-03 15:21:08.686576361 -0700
+++ linux-2.6.8-rc3/drivers/s390/net/iucv.c	2004-08-03 15:21:49.063232657 -0700
@@ -1,5 +1,5 @@
 /* 
- * $Id: iucv.c,v 1.38 2004/07/09 15:59:53 mschwide Exp $
+ * $Id: iucv.c,v 1.39 2004/07/12 06:54:14 braunu Exp $
  *
  * IUCV network driver
  *
@@ -29,7 +29,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * RELEASE-TAG: IUCV lowlevel driver $Revision: 1.38 $
+ * RELEASE-TAG: IUCV lowlevel driver $Revision: 1.39 $
  *
  */
 
@@ -354,7 +354,7 @@
 static void
 iucv_banner(void)
 {
-	char vbuf[] = "$Revision: 1.38 $";
+	char vbuf[] = "$Revision: 1.39 $";
 	char *version = vbuf;
 
 	if ((version = strchr(version, ':'))) {
@@ -874,9 +874,6 @@
 		iucv_remove_handler(new_handler);
 		kfree(new_handler);
 		switch(rc) {
-		case -ENODEV:
-			err = "No CPU can be reserved";
-			break;
 		case 0x03:
 			err = "Directory error";
 			break;
diff -urN linux-2.6.8-rc2/drivers/s390/net/iucv.h linux-2.6.8-rc3/drivers/s390/net/iucv.h
--- linux-2.6.8-rc2/drivers/s390/net/iucv.h	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/drivers/s390/net/iucv.h	2004-08-03 15:21:49.102234257 -0700
@@ -30,6 +30,94 @@
  */
 
 #include <linux/types.h>
+#include <asm/debug.h>
+
+/**
+ * Debug Facility stuff
+ */
+#define IUCV_DBF_SETUP_NAME "iucv_setup"
+#define IUCV_DBF_SETUP_LEN 32
+#define IUCV_DBF_SETUP_INDEX 1
+#define IUCV_DBF_SETUP_NR_AREAS 1
+#define IUCV_DBF_SETUP_LEVEL 3
+
+#define IUCV_DBF_DATA_NAME "iucv_data"
+#define IUCV_DBF_DATA_LEN 128
+#define IUCV_DBF_DATA_INDEX 1
+#define IUCV_DBF_DATA_NR_AREAS 1
+#define IUCV_DBF_DATA_LEVEL 2
+
+#define IUCV_DBF_TRACE_NAME "iucv_trace"
+#define IUCV_DBF_TRACE_LEN 16
+#define IUCV_DBF_TRACE_INDEX 2
+#define IUCV_DBF_TRACE_NR_AREAS 1
+#define IUCV_DBF_TRACE_LEVEL 3
+
+#define IUCV_DBF_TEXT(name,level,text) \
+	do { \
+		debug_text_event(iucv_dbf_##name,level,text); \
+	} while (0)
+
+#define IUCV_DBF_HEX(name,level,addr,len) \
+	do { \
+		debug_event(iucv_dbf_##name,level,(void*)(addr),len); \
+	} while (0)
+
+extern DEFINE_PER_CPU(char[256], iucv_dbf_txt_buf);
+
+#define IUCV_DBF_TEXT_(name,level,text...)				\
+	do {								\
+		char* iucv_dbf_txt_buf = get_cpu_var(iucv_dbf_txt_buf);	\
+		sprintf(iucv_dbf_txt_buf, text);		  	\
+		debug_text_event(iucv_dbf_##name,level,iucv_dbf_txt_buf); \
+		put_cpu_var(iucv_dbf_txt_buf);				\
+	} while (0)
+
+#define IUCV_DBF_SPRINTF(name,level,text...) \
+	do { \
+		debug_sprintf_event(iucv_dbf_trace, level, ##text ); \
+		debug_sprintf_event(iucv_dbf_trace, level, text ); \
+	} while (0)
+
+/**
+ * some more debug stuff
+ */
+#define IUCV_HEXDUMP16(importance,header,ptr) \
+PRINT_##importance(header "%02x %02x %02x %02x  %02x %02x %02x %02x  " \
+		   "%02x %02x %02x %02x  %02x %02x %02x %02x\n", \
+		   *(((char*)ptr)),*(((char*)ptr)+1),*(((char*)ptr)+2), \
+		   *(((char*)ptr)+3),*(((char*)ptr)+4),*(((char*)ptr)+5), \
+		   *(((char*)ptr)+6),*(((char*)ptr)+7),*(((char*)ptr)+8), \
+		   *(((char*)ptr)+9),*(((char*)ptr)+10),*(((char*)ptr)+11), \
+		   *(((char*)ptr)+12),*(((char*)ptr)+13), \
+		   *(((char*)ptr)+14),*(((char*)ptr)+15)); \
+PRINT_##importance(header "%02x %02x %02x %02x  %02x %02x %02x %02x  " \
+		   "%02x %02x %02x %02x  %02x %02x %02x %02x\n", \
+		   *(((char*)ptr)+16),*(((char*)ptr)+17), \
+		   *(((char*)ptr)+18),*(((char*)ptr)+19), \
+		   *(((char*)ptr)+20),*(((char*)ptr)+21), \
+		   *(((char*)ptr)+22),*(((char*)ptr)+23), \
+		   *(((char*)ptr)+24),*(((char*)ptr)+25), \
+		   *(((char*)ptr)+26),*(((char*)ptr)+27), \
+		   *(((char*)ptr)+28),*(((char*)ptr)+29), \
+		   *(((char*)ptr)+30),*(((char*)ptr)+31));
+
+static inline void
+iucv_hex_dump(unsigned char *buf, size_t len)
+{
+	size_t i;
+
+	for (i = 0; i < len; i++) {
+		if (i && !(i % 16))
+			printk("\n");
+		printk("%02x ", *(buf + i));
+	}
+	printk("\n");
+}
+/**
+ * end of debug stuff
+ */
+
 #define uchar  unsigned char
 #define ushort unsigned short
 #define ulong  unsigned long
diff -urN linux-2.6.8-rc2/drivers/s390/net/lcs.c linux-2.6.8-rc3/drivers/s390/net/lcs.c
--- linux-2.6.8-rc2/drivers/s390/net/lcs.c	2004-08-03 15:21:08.687576402 -0700
+++ linux-2.6.8-rc3/drivers/s390/net/lcs.c	2004-08-03 15:21:49.119234955 -0700
@@ -11,7 +11,7 @@
  *			  Frank Pavlic (pavlic@de.ibm.com) and
  *		 	  Martin Schwidefsky <schwidefsky@de.ibm.com>
  *
- *    $Revision: 1.83 $	 $Date: 2004/06/30 12:48:14 $
+ *    $Revision: 1.84 $	 $Date: 2004/07/14 07:23:15 $
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -58,7 +58,7 @@
 /**
  * initialization string for output
  */
-#define VERSION_LCS_C  "$Revision: 1.83 $"
+#define VERSION_LCS_C  "$Revision: 1.84 $"
 
 static char version[] __initdata = "LCS driver ("VERSION_LCS_C "/" VERSION_LCS_H ")";
 static char debug_buffer[255];
@@ -1420,7 +1420,7 @@
 				   card->dev->name);
 			return 0;
 		}
-		schedule_timeout(3 * HZ);
+		msleep(30);
 	}
 	PRINT_ERR("Error in Reseting LCS card!\n");
 	return -EIO;
diff -urN linux-2.6.8-rc2/drivers/s390/net/netiucv.c linux-2.6.8-rc3/drivers/s390/net/netiucv.c
--- linux-2.6.8-rc2/drivers/s390/net/netiucv.c	2004-08-03 15:21:08.690576525 -0700
+++ linux-2.6.8-rc3/drivers/s390/net/netiucv.c	2004-08-03 15:21:49.142235898 -0700
@@ -1,5 +1,5 @@
 /*
- * $Id: netiucv.c,v 1.57 2004/06/30 09:26:40 braunu Exp $
+ * $Id: netiucv.c,v 1.63 2004/07/27 13:36:05 mschwide Exp $
  *
  * IUCV network driver
  *
@@ -30,7 +30,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * RELEASE-TAG: IUCV network driver $Revision: 1.57 $
+ * RELEASE-TAG: IUCV network driver $Revision: 1.63 $
  *
  */
 
@@ -69,6 +69,13 @@
 MODULE_DESCRIPTION ("Linux for S/390 IUCV network driver");
 
 
+#define PRINTK_HEADER " iucv: "       /* for debugging */
+
+static struct device_driver netiucv_driver = {
+	.name = "netiucv",
+	.bus  = &iucv_bus,
+};
+
 /**
  * Per connection profiling data
  */
@@ -108,7 +115,7 @@
 /**
  * Linked list of all connection structs.
  */
-static struct iucv_connection *connections;
+static struct iucv_connection *iucv_connections;
 
 /**
  * Representation of event-data for the
@@ -172,7 +179,7 @@
  * match exactly as specified in order to give connection_pending()
  * control.
  */
-static __u8 mask[] = {
+static __u8 netiucv_mask[] = {
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
@@ -362,6 +369,58 @@
 
 
 /**
+ * Debug Facility Stuff
+ */
+static debug_info_t *iucv_dbf_setup = NULL;
+static debug_info_t *iucv_dbf_data = NULL;
+static debug_info_t *iucv_dbf_trace = NULL;
+
+DEFINE_PER_CPU(char[256], iucv_dbf_txt_buf);
+
+static void
+iucv_unregister_dbf_views(void)
+{
+	if (iucv_dbf_setup)
+		debug_unregister(iucv_dbf_setup);
+	if (iucv_dbf_data)
+		debug_unregister(iucv_dbf_data);
+	if (iucv_dbf_trace)
+		debug_unregister(iucv_dbf_trace);
+}
+static int
+iucv_register_dbf_views(void)
+{
+	iucv_dbf_setup = debug_register(IUCV_DBF_SETUP_NAME,
+					IUCV_DBF_SETUP_INDEX,
+					IUCV_DBF_SETUP_NR_AREAS,
+					IUCV_DBF_SETUP_LEN);
+	iucv_dbf_data = debug_register(IUCV_DBF_DATA_NAME,
+				       IUCV_DBF_DATA_INDEX,
+				       IUCV_DBF_DATA_NR_AREAS,
+				       IUCV_DBF_DATA_LEN);
+	iucv_dbf_trace = debug_register(IUCV_DBF_TRACE_NAME,
+					IUCV_DBF_TRACE_INDEX,
+					IUCV_DBF_TRACE_NR_AREAS,
+					IUCV_DBF_TRACE_LEN);
+
+	if ((iucv_dbf_setup == NULL) || (iucv_dbf_data == NULL) ||
+	    (iucv_dbf_trace == NULL)) {
+		iucv_unregister_dbf_views();
+		return -ENOMEM;
+	}
+	debug_register_view(iucv_dbf_setup, &debug_hex_ascii_view);
+	debug_set_level(iucv_dbf_setup, IUCV_DBF_SETUP_LEVEL);
+
+	debug_register_view(iucv_dbf_data, &debug_hex_ascii_view);
+	debug_set_level(iucv_dbf_data, IUCV_DBF_DATA_LEVEL);
+
+	debug_register_view(iucv_dbf_trace, &debug_hex_ascii_view);
+	debug_set_level(iucv_dbf_trace, IUCV_DBF_TRACE_LEVEL);
+
+	return 0;
+}
+
+/**
  * Callback-wrappers, called from lowlevel iucv layer.
  *****************************************************************************/
 
@@ -490,7 +549,7 @@
 		struct sk_buff *skb;
 		ll_header *header = (ll_header *)pskb->data;
 
-		if (header->next == 0)
+		if (!header->next)
 			break;
 
 		skb_pull(pskb, NETIUCV_HDRLEN);
@@ -498,19 +557,21 @@
 		offset += header->next;
 		header->next -= NETIUCV_HDRLEN;
 		if (skb_tailroom(pskb) < header->next) {
-			printk(KERN_WARNING
-			       "%s: Illegal next field in iucv header: "
+			PRINT_WARN("%s: Illegal next field in iucv header: "
 			       "%d > %d\n",
 			       dev->name, header->next, skb_tailroom(pskb));
+			IUCV_DBF_TEXT_(data, 2, "Illegal next field: %d > %d\n",
+				header->next, skb_tailroom(pskb));
 			return;
 		}
 		skb_put(pskb, header->next);
 		pskb->mac.raw = pskb->data;
 		skb = dev_alloc_skb(pskb->len);
 		if (!skb) {
-			printk(KERN_WARNING
-			       "%s Out of memory in netiucv_unpack_skb\n",
+			PRINT_WARN("%s Out of memory in netiucv_unpack_skb\n",
 			       dev->name);
+			IUCV_DBF_TEXT(data, 2,
+				"Out of memory in netiucv_unpack_skb\n");
 			privptr->stats.rx_dropped++;
 			return;
 		}
@@ -538,31 +599,37 @@
 	struct iucv_event *ev = (struct iucv_event *)arg;
 	struct iucv_connection *conn = ev->conn;
 	iucv_MessagePending *eib = (iucv_MessagePending *)ev->data;
-	struct netiucv_priv *privptr = (struct netiucv_priv *)conn->netdev->priv;
+	struct netiucv_priv *privptr =(struct netiucv_priv *)conn->netdev->priv;
 
 	__u32 msglen = eib->ln1msg2.ipbfln1f;
 	int rc;
 
-	pr_debug("%s() called\n", __FUNCTION__);
+	IUCV_DBF_TEXT(trace, 4, __FUNCTION__);
 
 	if (!conn->netdev) {
 		/* FRITZ: How to tell iucv LL to drop the msg? */
-		printk(KERN_WARNING
-		       "Received data for unlinked connection\n"); 
+		PRINT_WARN("Received data for unlinked connection\n");
+		IUCV_DBF_TEXT(data, 2,
+			"Received data for unlinked connection\n");
 		return;
 	}
 	if (msglen > conn->max_buffsize) {
 		/* FRITZ: How to tell iucv LL to drop the msg? */
 		privptr->stats.rx_dropped++;
+		PRINT_WARN("msglen %d > max_buffsize %d\n",
+			msglen, conn->max_buffsize);
+		IUCV_DBF_TEXT_(data, 2, "msglen %d > max_buffsize %d\n",
+			msglen, conn->max_buffsize);
 		return;
 	}
 	conn->rx_buff->data = conn->rx_buff->tail = conn->rx_buff->head;
 	conn->rx_buff->len = 0;
 	rc = iucv_receive(conn->pathid, eib->ipmsgid, eib->iptrgcls,
 			  conn->rx_buff->data, msglen, NULL, NULL, NULL);
-	if (rc != 0 || msglen < 5) {
+	if (rc || msglen < 5) {
 		privptr->stats.rx_errors++;
-		printk(KERN_INFO "iucv_receive returned %08x\n", rc);
+		PRINT_WARN("iucv_receive returned %08x\n", rc);
+		IUCV_DBF_TEXT_(data, 2, "rc %d from iucv_receive\n", rc);
 		return;
 	}
 	netiucv_unpack_skb(conn, conn->rx_buff);
@@ -584,7 +651,7 @@
 	unsigned long saveflags;
 	ll_header header;
 
-	pr_debug("%s() called\n", __FUNCTION__);
+	IUCV_DBF_TEXT(trace, 4, __FUNCTION__);
 
 	if (conn && conn->netdev && conn->netdev->priv)
 		privptr = (struct netiucv_priv *)conn->netdev->priv;
@@ -634,13 +701,13 @@
 		conn->prof.tx_pending++;
 		if (conn->prof.tx_pending > conn->prof.tx_max_pending)
 			conn->prof.tx_max_pending = conn->prof.tx_pending;
-		if (rc != 0) {
+		if (rc) {
 			conn->prof.tx_pending--;
 			fsm_newstate(fi, CONN_STATE_IDLE);
 			if (privptr)
 				privptr->stats.tx_errors += txpackets;
-			printk(KERN_INFO "iucv_send returned %08x\n",
-				rc);
+			PRINT_WARN("iucv_send returned %08x\n",	rc);
+			IUCV_DBF_TEXT_(data, 2, "rc %d from iucv_send\n", rc);
 		} else {
 			if (privptr) {
 				privptr->stats.tx_packets += txpackets;
@@ -665,14 +732,14 @@
 	__u16 msglimit;
 	__u8 udata[16];
 
-	pr_debug("%s() called\n", __FUNCTION__);
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 
 	rc = iucv_accept(eib->ippathid, NETIUCV_QUEUELEN_DEFAULT, udata, 0,
 			 conn->handle, conn, NULL, &msglimit);
-	if (rc != 0) {
-		printk(KERN_WARNING
-		       "%s: IUCV accept failed with error %d\n",
+	if (rc) {
+		PRINT_WARN("%s: IUCV accept failed with error %d\n",
 		       netdev->name, rc);
+		IUCV_DBF_TEXT_(setup, 2, "rc %d from iucv_accept", rc);
 		return;
 	}
 	fsm_newstate(fi, CONN_STATE_IDLE);
@@ -690,13 +757,16 @@
 	iucv_ConnectionPending *eib = (iucv_ConnectionPending *)ev->data;
 	__u8 udata[16];
 
-	pr_debug("%s() called\n", __FUNCTION__);
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 
 	iucv_sever(eib->ippathid, udata);
 	if (eib->ippathid != conn->pathid) {
-		printk(KERN_INFO
-			"%s: IR Connection Pending; pathid %d does not match original pathid %d\n",
+		PRINT_INFO("%s: IR Connection Pending; "
+			"pathid %d does not match original pathid %d\n",
 			netdev->name, eib->ippathid, conn->pathid);
+		IUCV_DBF_TEXT_(data, 2,
+			"connreject: IR pathid %d, conn. pathid %d\n",
+			eib->ippathid, conn->pathid);
 		iucv_sever(conn->pathid, udata);
 	}
 }
@@ -710,14 +780,17 @@
 	struct net_device *netdev = conn->netdev;
 	struct netiucv_priv *privptr = (struct netiucv_priv *)netdev->priv;
 
-	pr_debug("%s() called\n", __FUNCTION__);
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 
 	fsm_deltimer(&conn->timer);
 	fsm_newstate(fi, CONN_STATE_IDLE);
 	if (eib->ippathid != conn->pathid) {
-		printk(KERN_INFO
-			"%s: IR Connection Complete; pathid %d does not match original pathid %d\n",
+		PRINT_INFO("%s: IR Connection Complete; "
+			"pathid %d does not match original pathid %d\n",
 			netdev->name, eib->ippathid, conn->pathid);
+		IUCV_DBF_TEXT_(data, 2,
+			"connack: IR pathid %d, conn. pathid %d\n",
+			eib->ippathid, conn->pathid);
 		conn->pathid = eib->ippathid;
 	}
 	netdev->tx_queue_len = eib->ipmsglim;
@@ -730,7 +803,7 @@
 	struct iucv_connection *conn = (struct iucv_connection *)arg;
 	__u8 udata[16];
 
-	pr_debug("%s() called\n", __FUNCTION__);
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 
 	fsm_deltimer(&conn->timer);
 	iucv_sever(conn->pathid, udata);
@@ -746,12 +819,13 @@
 	struct netiucv_priv *privptr = (struct netiucv_priv *)netdev->priv;
 	__u8 udata[16];
 
-	pr_debug("%s() called\n", __FUNCTION__);
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 
 	fsm_deltimer(&conn->timer);
 	iucv_sever(conn->pathid, udata);
-	printk(KERN_INFO "%s: Remote dropped connection\n",
-	       netdev->name);
+	PRINT_INFO("%s: Remote dropped connection\n", netdev->name);
+	IUCV_DBF_TEXT(data, 2,
+		"conn_action_connsever: Remote dropped connection\n");
 	fsm_newstate(fi, CONN_STATE_STARTWAIT);
 	fsm_event(privptr->fsm, DEV_EVENT_CONDOWN, netdev);
 }
@@ -764,24 +838,28 @@
 	__u16 msglimit;
 	int rc;
 
-	pr_debug("%s() called\n", __FUNCTION__);
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 
-	if (conn->handle == 0) {
+	if (!conn->handle) {
+		IUCV_DBF_TEXT(trace, 5, "calling iucv_register_program\n");
 		conn->handle =
-			iucv_register_program(iucvMagic, conn->userid, mask,
+			iucv_register_program(iucvMagic, conn->userid,
+					      netiucv_mask,
 					      &netiucv_ops, conn);
 		fsm_newstate(fi, CONN_STATE_STARTWAIT);
-		if (conn->handle <= 0) {
+		if (!conn->handle) {
 			fsm_newstate(fi, CONN_STATE_REGERR);
-			conn->handle = 0;
+			conn->handle = NULL;
+			IUCV_DBF_TEXT(setup, 2,
+				"NULL from iucv_register_program\n");
 			return;
 		}
 
-		pr_debug("%s('%s'): registered successfully\n",
+		PRINT_DEBUG("%s('%s'): registered successfully\n",
 			 conn->netdev->name, conn->userid);
 	}
 
-	pr_debug("%s('%s'): connecting ...\n",
+	PRINT_DEBUG("%s('%s'): connecting ...\n",
 		 conn->netdev->name, conn->userid);
 
 	/* We must set the state before calling iucv_connect because the callback
@@ -790,8 +868,8 @@
 
 	fsm_newstate(fi, CONN_STATE_SETUPWAIT);
 	rc = iucv_connect(&(conn->pathid), NETIUCV_QUEUELEN_DEFAULT, iucvMagic,
-			  conn->userid, iucv_host, 0, NULL, &msglimit, conn->handle,
-			  conn);
+			  conn->userid, iucv_host, 0, NULL, &msglimit,
+			  conn->handle, conn);
 	switch (rc) {
 		case 0:
 			conn->netdev->tx_queue_len = msglimit;
@@ -799,47 +877,45 @@
 				CONN_EVENT_TIMER, conn);
 			return;
 		case 11:
-			printk(KERN_NOTICE
-			       "%s: User %s is currently not available.\n",
+			PRINT_INFO("%s: User %s is currently not available.\n",
 			       conn->netdev->name,
 			       netiucv_printname(conn->userid));
 			fsm_newstate(fi, CONN_STATE_STARTWAIT);
 			return;
 		case 12:
-			printk(KERN_NOTICE
-			       "%s: User %s is currently not ready.\n",
+			PRINT_INFO("%s: User %s is currently not ready.\n",
 			       conn->netdev->name,
 			       netiucv_printname(conn->userid));
 			fsm_newstate(fi, CONN_STATE_STARTWAIT);
 			return;
 		case 13:
-			printk(KERN_WARNING
-			       "%s: Too many IUCV connections.\n",
+			PRINT_WARN("%s: Too many IUCV connections.\n",
 			       conn->netdev->name);
 			fsm_newstate(fi, CONN_STATE_CONNERR);
 			break;
 		case 14:
-			printk(KERN_WARNING
+			PRINT_WARN(
 			       "%s: User %s has too many IUCV connections.\n",
 			       conn->netdev->name,
 			       netiucv_printname(conn->userid));
 			fsm_newstate(fi, CONN_STATE_CONNERR);
 			break;
 		case 15:
-			printk(KERN_WARNING
+			PRINT_WARN(
 			       "%s: No IUCV authorization in CP directory.\n",
 			       conn->netdev->name);
 			fsm_newstate(fi, CONN_STATE_CONNERR);
 			break;
 		default:
-			printk(KERN_WARNING
-			       "%s: iucv_connect returned error %d\n",
+			PRINT_WARN("%s: iucv_connect returned error %d\n",
 			       conn->netdev->name, rc);
 			fsm_newstate(fi, CONN_STATE_CONNERR);
 			break;
 	}
+	IUCV_DBF_TEXT_(setup, 5, "iucv_connect rc is %d\n", rc);
+	IUCV_DBF_TEXT(trace, 5, "calling iucv_unregister_program\n");
 	iucv_unregister_program(conn->handle);
-	conn->handle = 0;
+	conn->handle = NULL;
 }
 
 static void
@@ -861,14 +937,15 @@
 	struct net_device *netdev = conn->netdev;
 	struct netiucv_priv *privptr = (struct netiucv_priv *)netdev->priv;
 
-	pr_debug("%s() called\n", __FUNCTION__);
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 
 	fsm_deltimer(&conn->timer);
 	fsm_newstate(fi, CONN_STATE_STOPPED);
 	netiucv_purge_skb_queue(&conn->collect_queue);
 	if (conn->handle)
+		IUCV_DBF_TEXT(trace, 5, "calling iucv_unregister_program\n");
 		iucv_unregister_program(conn->handle);
-	conn->handle = 0;
+	conn->handle = NULL;
 	netiucv_purge_skb_queue(&conn->commit_queue);
 	fsm_event(privptr->fsm, DEV_EVENT_CONDOWN, netdev);
 }
@@ -880,9 +957,9 @@
 	struct iucv_connection *conn = ev->conn;
 	struct net_device *netdev = conn->netdev;
 
-	printk(KERN_WARNING
-	       "%s: Cannot connect without username\n",
+	PRINT_WARN("%s: Cannot connect without username\n",
 	       netdev->name);
+	IUCV_DBF_TEXT(data, 2, "conn_action_inval called\n");
 }
 
 static const fsm_node conn_fsm[] = {
@@ -938,7 +1015,7 @@
 	struct netiucv_priv *privptr = dev->priv;
 	struct iucv_event   ev;
 
-	pr_debug("%s() called\n", __FUNCTION__);
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 
 	ev.conn = privptr->conn;
 	fsm_newstate(fi, DEV_STATE_STARTWAIT);
@@ -959,7 +1036,7 @@
 	struct netiucv_priv *privptr = dev->priv;
 	struct iucv_event   ev;
 
-	pr_debug("%s() called\n", __FUNCTION__);
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 
 	ev.conn = privptr->conn;
 
@@ -981,19 +1058,22 @@
 	struct net_device   *dev = (struct net_device *)arg;
 	struct netiucv_priv *privptr = dev->priv;
 
-	pr_debug("%s() called\n", __FUNCTION__);
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 
 	switch (fsm_getstate(fi)) {
 		case DEV_STATE_STARTWAIT:
 			fsm_newstate(fi, DEV_STATE_RUNNING);
-			printk(KERN_INFO
-			       "%s: connected with remote side %s\n",
+			PRINT_INFO("%s: connected with remote side %s\n",
 			       dev->name, privptr->conn->userid);
+			IUCV_DBF_TEXT(setup, 3,
+				"connection is up and running\n");
 			break;
 		case DEV_STATE_STOPWAIT:
-			printk(KERN_INFO
-			       "%s: got connection UP event during shutdown!!\n",
+			PRINT_INFO(
+			       "%s: got connection UP event during shutdown!\n",
 			       dev->name);
+			IUCV_DBF_TEXT(data, 2,
+				"dev_action_connup: in DEV_STATE_STOPWAIT\n");
 			break;
 	}
 }
@@ -1009,7 +1089,7 @@
 static void
 dev_action_conndown(fsm_instance *fi, int event, void *arg)
 {
-	pr_debug("%s() called\n", __FUNCTION__);
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 
 	switch (fsm_getstate(fi)) {
 		case DEV_STATE_RUNNING:
@@ -1017,6 +1097,7 @@
 			break;
 		case DEV_STATE_STOPWAIT:
 			fsm_newstate(fi, DEV_STATE_STOPPED);
+			IUCV_DBF_TEXT(setup, 3, "connection is down\n");
 			break;
 	}
 }
@@ -1059,9 +1140,11 @@
 
 		spin_lock_irqsave(&conn->collect_lock, saveflags);
 		if (conn->collect_len + l >
-		    (conn->max_buffsize - NETIUCV_HDRLEN))
+		    (conn->max_buffsize - NETIUCV_HDRLEN)) {
 			rc = -EBUSY;
-		else {
+			IUCV_DBF_TEXT(data, 2,
+				"EBUSY from netiucv_transmit_skb\n");
+		} else {
 			atomic_inc(&skb->users);
 			skb_queue_tail(&conn->collect_queue, skb);
 			conn->collect_len += l;
@@ -1080,9 +1163,9 @@
 			nskb = alloc_skb(skb->len + NETIUCV_HDRLEN +
 					 NETIUCV_HDRLEN, GFP_ATOMIC | GFP_DMA);
 			if (!nskb) {
-				printk(KERN_WARNING
-				       "%s: Could not allocate tx_skb\n",
+				PRINT_WARN("%s: Could not allocate tx_skb\n",
 				       conn->netdev->name);
+				IUCV_DBF_TEXT(data, 2, "alloc_skb failed\n");
 				rc = -ENOMEM;
 				return rc;
 			} else {
@@ -1111,7 +1194,7 @@
 		conn->prof.tx_pending++;
 		if (conn->prof.tx_pending > conn->prof.tx_max_pending)
 			conn->prof.tx_max_pending = conn->prof.tx_pending;
-		if (rc != 0) {
+		if (rc) {
 			struct netiucv_priv *privptr;
 			fsm_newstate(conn->fsm, CONN_STATE_IDLE);
 			conn->prof.tx_pending--;
@@ -1128,8 +1211,8 @@
 				skb_pull(skb, NETIUCV_HDRLEN);
 				skb_trim(skb, skb->len - NETIUCV_HDRLEN);
 			}
-			printk(KERN_INFO "iucv_send returned %08x\n",
-				rc);
+			PRINT_WARN("iucv_send returned %08x\n",	rc);
+			IUCV_DBF_TEXT_(data, 2, "rc %d from iucv_send\n", rc);
 		} else {
 			if (copied)
 				dev_kfree_skb(skb);
@@ -1155,7 +1238,7 @@
  */
 static int
 netiucv_open(struct net_device *dev) {
-	fsm_event(((struct netiucv_priv *)dev->priv)->fsm, DEV_EVENT_START, dev);
+	fsm_event(((struct netiucv_priv *)dev->priv)->fsm, DEV_EVENT_START,dev);
 	return 0;
 }
 
@@ -1189,18 +1272,21 @@
 	int          rc = 0;
 	struct netiucv_priv *privptr = dev->priv;
 
+	IUCV_DBF_TEXT(trace, 4, __FUNCTION__);
 	/**
 	 * Some sanity checks ...
 	 */
 	if (skb == NULL) {
-		printk(KERN_WARNING "%s: NULL sk_buff passed\n", dev->name);
+		PRINT_WARN("%s: NULL sk_buff passed\n", dev->name);
+		IUCV_DBF_TEXT(data, 2, "netiucv_tx: skb is NULL\n");
 		privptr->stats.tx_dropped++;
 		return 0;
 	}
-	if (skb_headroom(skb) < (NETIUCV_HDRLEN)) {
-		printk(KERN_WARNING
-		       "%s: Got sk_buff with head room < %ld bytes\n",
+	if (skb_headroom(skb) < NETIUCV_HDRLEN) {
+		PRINT_WARN("%s: Got sk_buff with head room < %ld bytes\n",
 		       dev->name, NETIUCV_HDRLEN);
+		IUCV_DBF_TEXT(data, 2,
+			"netiucv_tx: skb_headroom < NETIUCV_HDRLEN\n");
 		dev_kfree_skb(skb);
 		privptr->stats.tx_dropped++;
 		return 0;
@@ -1219,11 +1305,12 @@
 		return 0;
 	}
 
-	if (netiucv_test_and_set_busy(dev))
+	if (netiucv_test_and_set_busy(dev)) {
+		IUCV_DBF_TEXT(data, 2, "EBUSY from netiucv_tx\n");
 		return -EBUSY;
-
+	}
 	dev->trans_start = jiffies;
-	if (netiucv_transmit_skb(privptr->conn, skb) != 0)
+	if (netiucv_transmit_skb(privptr->conn, skb))
 		rc = 1;
 	netiucv_clear_busy(dev);
 	return rc;
@@ -1239,6 +1326,7 @@
 static struct net_device_stats *
 netiucv_stats (struct net_device * dev)
 {
+	IUCV_DBF_TEXT(trace, 5, __FUNCTION__);
 	return &((struct netiucv_priv *)dev->priv)->stats;
 }
 
@@ -1254,8 +1342,11 @@
 static int
 netiucv_change_mtu (struct net_device * dev, int new_mtu)
 {
-	if ((new_mtu < 576) || (new_mtu > NETIUCV_MTU_MAX))
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
+	if ((new_mtu < 576) || (new_mtu > NETIUCV_MTU_MAX)) {
+		IUCV_DBF_TEXT(setup, 2, "given MTU out of valid range\n");
 		return -EINVAL;
+	}
 	dev->mtu = new_mtu;
 	return 0;
 }
@@ -1269,6 +1360,7 @@
 {
 	struct netiucv_priv *priv = dev->driver_data;
 
+	IUCV_DBF_TEXT(trace, 5, __FUNCTION__);
 	return sprintf(buf, "%s\n", netiucv_printname(priv->conn->userid));
 }
 
@@ -1282,9 +1374,11 @@
 	char 	username[10];
 	int 	i;
 
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 	if (count>9) {
-		printk(KERN_WARNING
-			"netiucv: username too long (%d)!\n", (int)count);
+		PRINT_WARN("netiucv: username too long (%d)!\n", (int)count);
+		IUCV_DBF_TEXT_(setup, 2,
+			"%d is length of username\n", (int)count);
 		return -EINVAL;
 	}
 
@@ -1296,8 +1390,11 @@
 			/* trailing lf, grr */
 			break;
 		} else {
-			printk(KERN_WARNING
-				"netiucv: Invalid character in username!\n");
+			PRINT_WARN("netiucv: Invalid char %c in username!\n",
+				*p);
+			IUCV_DBF_TEXT_(setup, 2,
+				"username: invalid character %c\n",
+				*p);
 			return -EINVAL;
 		}
 	}
@@ -1305,14 +1402,14 @@
 		username[i++] = ' ';
 	username[9] = '\0';
 
-	if (memcmp(username, priv->conn->userid, 8) != 0) {
+	if (memcmp(username, priv->conn->userid, 8)) {
 		/* username changed */
 		if (ndev->flags & (IFF_UP | IFF_RUNNING)) {
-			printk(KERN_WARNING
+			PRINT_WARN(
 				"netiucv: device %s active, connected to %s\n",
 				dev->bus_id, priv->conn->userid);
-			printk(KERN_WARNING
-				"netiucv: user cannot be updated\n");
+			PRINT_WARN("netiucv: user cannot be updated\n");
+			IUCV_DBF_TEXT(setup, 2, "user_write: device active\n");
 			return -EBUSY;
 		}
 	}
@@ -1329,6 +1426,7 @@
 {
 	struct netiucv_priv *priv = dev->driver_data;
 
+	IUCV_DBF_TEXT(trace, 5, __FUNCTION__);
 	return sprintf(buf, "%d\n", priv->conn->max_buffsize);
 }
 
@@ -1340,28 +1438,42 @@
 	char         *e;
 	int          bs1;
 
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 	if (count >= 39)
 		return -EINVAL;
 
 	bs1 = simple_strtoul(buf, &e, 0);
 
 	if (e && (!isspace(*e))) {
-		printk(KERN_WARNING
-			"netiucv: Invalid character in buffer!\n");
+		PRINT_WARN("netiucv: Invalid character in buffer!\n");
+		IUCV_DBF_TEXT_(setup, 2, "buffer_write: invalid char %c\n", *e);
 		return -EINVAL;
 	}
 	if (bs1 > NETIUCV_BUFSIZE_MAX) {
-		printk(KERN_WARNING
-			"netiucv: Given buffer size %d too large.\n",
+		PRINT_WARN("netiucv: Given buffer size %d too large.\n",
+			bs1);
+		IUCV_DBF_TEXT_(setup, 2,
+			"buffer_write: buffer size %d too large\n",
 			bs1);
-
 		return -EINVAL;
 	}
 	if ((ndev->flags & IFF_RUNNING) &&
-	    (bs1 < (ndev->mtu + NETIUCV_HDRLEN + 2)))
+	    (bs1 < (ndev->mtu + NETIUCV_HDRLEN + 2))) {
+		PRINT_WARN("netiucv: Given buffer size %d too small.\n",
+			bs1);
+		IUCV_DBF_TEXT_(setup, 2,
+			"buffer_write: buffer size %d too small\n",
+			bs1);
 		return -EINVAL;
-	if (bs1 < (576 + NETIUCV_HDRLEN + NETIUCV_HDRLEN))
+	}
+	if (bs1 < (576 + NETIUCV_HDRLEN + NETIUCV_HDRLEN)) {
+		PRINT_WARN("netiucv: Given buffer size %d too small.\n",
+			bs1);
+		IUCV_DBF_TEXT_(setup, 2,
+			"buffer_write: buffer size %d too small\n",
+			bs1);
 		return -EINVAL;
+	}
 
 	priv->conn->max_buffsize = bs1;
 	if (!(ndev->flags & IFF_RUNNING))
@@ -1377,7 +1489,8 @@
 dev_fsm_show (struct device *dev, char *buf)
 {
 	struct netiucv_priv *priv = dev->driver_data;
-	
+
+	IUCV_DBF_TEXT(trace, 5, __FUNCTION__);
 	return sprintf(buf, "%s\n", fsm_getstate_str(priv->fsm));
 }
 
@@ -1387,7 +1500,8 @@
 conn_fsm_show (struct device *dev, char *buf)
 {
 	struct netiucv_priv *priv = dev->driver_data;
-	
+
+	IUCV_DBF_TEXT(trace, 5, __FUNCTION__);
 	return sprintf(buf, "%s\n", fsm_getstate_str(priv->conn->fsm));
 }
 
@@ -1397,7 +1511,8 @@
 maxmulti_show (struct device *dev, char *buf)
 {
 	struct netiucv_priv *priv = dev->driver_data;
-	
+
+	IUCV_DBF_TEXT(trace, 5, __FUNCTION__);
 	return sprintf(buf, "%ld\n", priv->conn->prof.maxmulti);
 }
 
@@ -1405,7 +1520,8 @@
 maxmulti_write (struct device *dev, const char *buf, size_t count)
 {
 	struct netiucv_priv *priv = dev->driver_data;
-	
+
+	IUCV_DBF_TEXT(trace, 4, __FUNCTION__);
 	priv->conn->prof.maxmulti = 0;
 	return count;
 }
@@ -1416,7 +1532,8 @@
 maxcq_show (struct device *dev, char *buf)
 {
 	struct netiucv_priv *priv = dev->driver_data;
-	
+
+	IUCV_DBF_TEXT(trace, 5, __FUNCTION__);
 	return sprintf(buf, "%ld\n", priv->conn->prof.maxcqueue);
 }
 
@@ -1425,6 +1542,7 @@
 {
 	struct netiucv_priv *priv = dev->driver_data;
 	
+	IUCV_DBF_TEXT(trace, 4, __FUNCTION__);
 	priv->conn->prof.maxcqueue = 0;
 	return count;
 }
@@ -1435,7 +1553,8 @@
 sdoio_show (struct device *dev, char *buf)
 {
 	struct netiucv_priv *priv = dev->driver_data;
-	
+
+	IUCV_DBF_TEXT(trace, 5, __FUNCTION__);
 	return sprintf(buf, "%ld\n", priv->conn->prof.doios_single);
 }
 
@@ -1444,6 +1563,7 @@
 {
 	struct netiucv_priv *priv = dev->driver_data;
 	
+	IUCV_DBF_TEXT(trace, 4, __FUNCTION__);
 	priv->conn->prof.doios_single = 0;
 	return count;
 }
@@ -1454,7 +1574,8 @@
 mdoio_show (struct device *dev, char *buf)
 {
 	struct netiucv_priv *priv = dev->driver_data;
-	
+
+	IUCV_DBF_TEXT(trace, 5, __FUNCTION__);
 	return sprintf(buf, "%ld\n", priv->conn->prof.doios_multi);
 }
 
@@ -1463,6 +1584,7 @@
 {
 	struct netiucv_priv *priv = dev->driver_data;
 	
+	IUCV_DBF_TEXT(trace, 5, __FUNCTION__);
 	priv->conn->prof.doios_multi = 0;
 	return count;
 }
@@ -1473,7 +1595,8 @@
 txlen_show (struct device *dev, char *buf)
 {
 	struct netiucv_priv *priv = dev->driver_data;
-	
+
+	IUCV_DBF_TEXT(trace, 5, __FUNCTION__);
 	return sprintf(buf, "%ld\n", priv->conn->prof.txlen);
 }
 
@@ -1482,6 +1605,7 @@
 {
 	struct netiucv_priv *priv = dev->driver_data;
 	
+	IUCV_DBF_TEXT(trace, 4, __FUNCTION__);
 	priv->conn->prof.txlen = 0;
 	return count;
 }
@@ -1492,7 +1616,8 @@
 txtime_show (struct device *dev, char *buf)
 {
 	struct netiucv_priv *priv = dev->driver_data;
-	
+
+	IUCV_DBF_TEXT(trace, 5, __FUNCTION__);
 	return sprintf(buf, "%ld\n", priv->conn->prof.tx_time);
 }
 
@@ -1501,6 +1626,7 @@
 {
 	struct netiucv_priv *priv = dev->driver_data;
 	
+	IUCV_DBF_TEXT(trace, 4, __FUNCTION__);
 	priv->conn->prof.tx_time = 0;
 	return count;
 }
@@ -1512,6 +1638,7 @@
 {
 	struct netiucv_priv *priv = dev->driver_data;
 
+	IUCV_DBF_TEXT(trace, 5, __FUNCTION__);
 	return sprintf(buf, "%ld\n", priv->conn->prof.tx_pending);
 }
 
@@ -1520,6 +1647,7 @@
 {
 	struct netiucv_priv *priv = dev->driver_data;
 
+	IUCV_DBF_TEXT(trace, 4, __FUNCTION__);
 	priv->conn->prof.tx_pending = 0;
 	return count;
 }
@@ -1531,6 +1659,7 @@
 {
 	struct netiucv_priv *priv = dev->driver_data;
 
+	IUCV_DBF_TEXT(trace, 5, __FUNCTION__);
 	return sprintf(buf, "%ld\n", priv->conn->prof.tx_max_pending);
 }
 
@@ -1539,6 +1668,7 @@
 {
 	struct netiucv_priv *priv = dev->driver_data;
 
+	IUCV_DBF_TEXT(trace, 4, __FUNCTION__);
 	priv->conn->prof.tx_max_pending = 0;
 	return count;
 }
@@ -1579,8 +1709,7 @@
 {
 	int ret;
 
-	pr_debug("%s() called\n", __FUNCTION__);
-
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 	ret = sysfs_create_group(&dev->kobj, &netiucv_attr_group);
 	if (ret)
 		return ret;
@@ -1593,7 +1722,7 @@
 static inline void
 netiucv_remove_files(struct device *dev)
 {
-	pr_debug("%s() called\n", __FUNCTION__);
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 	sysfs_remove_group(&dev->kobj, &netiucv_stat_attr_group);
 	sysfs_remove_group(&dev->kobj, &netiucv_attr_group);
 }
@@ -1606,7 +1735,7 @@
 	int ret;
 
 
-	pr_debug("%s() called\n", __FUNCTION__);
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 
 	if (dev) {
 		memset(dev, 0, sizeof(struct device));
@@ -1621,6 +1750,7 @@
 		 * but legitime ...).
 		 */
 		dev->release = (void (*)(struct device *))kfree;
+		dev->driver = &netiucv_driver;
 	} else
 		return -ENOMEM;
 
@@ -1631,8 +1761,8 @@
 	ret = netiucv_add_files(dev);
 	if (ret)
 		goto out_unreg;
-	dev->driver_data = priv;
 	priv->dev = dev;
+	dev->driver_data = priv;
 	return 0;
 
 out_unreg:
@@ -1643,19 +1773,19 @@
 static void
 netiucv_unregister_device(struct device *dev)
 {
-	pr_debug("%s() called\n", __FUNCTION__);
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 	netiucv_remove_files(dev);
 	device_unregister(dev);
 }
 
 /**
  * Allocate and initialize a new connection structure.
- * Add it to the list of connections;
+ * Add it to the list of netiucv connections;
  */
 static struct iucv_connection *
 netiucv_new_connection(struct net_device *dev, char *username)
 {
-	struct iucv_connection **clist = &connections;
+	struct iucv_connection **clist = &iucv_connections;
 	struct iucv_connection *conn =
 		(struct iucv_connection *)
 		kmalloc(sizeof(struct iucv_connection), GFP_KERNEL);
@@ -1706,23 +1836,22 @@
 
 /**
  * Release a connection structure and remove it from the
- * list of connections.
+ * list of netiucv connections.
  */
 static void
 netiucv_remove_connection(struct iucv_connection *conn)
 {
-	struct iucv_connection **clist = &connections;
-
-	pr_debug("%s() called\n", __FUNCTION__);
+	struct iucv_connection **clist = &iucv_connections;
 
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 	if (conn == NULL)
 		return;
 	while (*clist) {
 		if (*clist == conn) {
 			*clist = conn->next;
-			if (conn->handle != 0) {
+			if (conn->handle) {
 				iucv_unregister_program(conn->handle);
-				conn->handle = 0;
+				conn->handle = NULL;
 			}
 			fsm_deltimer(&conn->timer);
 			kfree_fsm(conn->fsm);
@@ -1742,7 +1871,7 @@
 {
 	struct netiucv_priv *privptr;
 
-	pr_debug("%s() called\n", __FUNCTION__);
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 
 	if (!dev)
 		return;
@@ -1753,7 +1882,7 @@
 			netiucv_remove_connection(privptr->conn);
 		if (privptr->fsm)
 			kfree_fsm(privptr->fsm);
-		privptr->conn = 0; privptr->fsm = 0;
+		privptr->conn = NULL; privptr->fsm = NULL;
 		/* privptr gets freed by free_netdev() */
 	}
 	free_netdev(dev);
@@ -1795,12 +1924,16 @@
 			   netiucv_setup_netdevice);
 	if (!dev)
 		return NULL;
+	if (dev_alloc_name(dev, dev->name) < 0) {
+		free_netdev(dev);
+		return NULL;
+	}
 
-        privptr = (struct netiucv_priv *)dev->priv;
+	privptr = (struct netiucv_priv *)dev->priv;
 	privptr->fsm = init_fsm("netiucvdev", dev_state_names,
 				dev_event_names, NR_DEV_STATES, NR_DEV_EVENTS,
 				dev_fsm, DEV_FSM_LEN, GFP_KERNEL);
-	if (privptr->fsm == NULL) {
+	if (!privptr->fsm) {
 		free_netdev(dev);
 		return NULL;
 	}
@@ -1808,6 +1941,7 @@
 	if (!privptr->conn) {
 		kfree_fsm(privptr->fsm);
 		free_netdev(dev);
+		IUCV_DBF_TEXT(setup, 2, "NULL from netiucv_new_connection\n");
 		return NULL;
 	}
 	fsm_newstate(privptr->fsm, DEV_STATE_STOPPED);
@@ -1823,9 +1957,10 @@
 	int i, ret;
 	struct net_device *dev;
 
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 	if (count>9) {
-		printk(KERN_WARNING
-		       "netiucv: username too long (%d)!\n", (int)count);
+		PRINT_WARN("netiucv: username too long (%d)!\n", (int)count);
+		IUCV_DBF_TEXT(setup, 2, "conn_write: too long\n");
 		return -EINVAL;
 	}
 
@@ -1836,8 +1971,9 @@
 			/* trailing lf, grr */
 			break;
 		} else {
-			printk(KERN_WARNING
-			       "netiucv: Invalid character in username!\n");
+			PRINT_WARN("netiucv: Invalid character in username!\n");
+			IUCV_DBF_TEXT_(setup, 2,
+				"conn_write: invalid character %c\n", *p);
 			return -EINVAL;
 		}
 	}
@@ -1846,30 +1982,36 @@
 	username[9] = '\0';
 	dev = netiucv_init_netdevice(username);
 	if (!dev) {
-		printk(KERN_WARNING
+		PRINT_WARN(
 		       "netiucv: Could not allocate network device structure "
 		       "for user '%s'\n", netiucv_printname(username));
+		IUCV_DBF_TEXT(setup, 2, "NULL from netiucv_init_netdevice\n");
 		return -ENODEV;
 	}
-	
-	if ((ret = register_netdev(dev))) {
-		goto out_free_ndev;
-	}
 
 	if ((ret = netiucv_register_device(dev))) {
-		unregister_netdev(dev);
+		IUCV_DBF_TEXT_(setup, 2,
+			"ret %d from netiucv_register_device\n", ret);
 		goto out_free_ndev;
 	}
 
 	/* sysfs magic */
-	SET_NETDEV_DEV(dev, (struct device*)((struct netiucv_priv*)dev->priv)->dev);
-	printk(KERN_INFO "%s: '%s'\n", dev->name, netiucv_printname(username));
+	SET_NETDEV_DEV(dev,
+			(struct device*)((struct netiucv_priv*)dev->priv)->dev);
+
+	if ((ret = register_netdev(dev))) {
+		netiucv_unregister_device((struct device*)
+			((struct netiucv_priv*)dev->priv)->dev);
+		goto out_free_ndev;
+	}
+
+	PRINT_INFO("%s: '%s'\n", dev->name, netiucv_printname(username));
 	
 	return count;
 
 out_free_ndev:
-	printk(KERN_WARNING
-		       "netiucv: Could not register '%s'\n", dev->name);
+	PRINT_WARN("netiucv: Could not register '%s'\n", dev->name);
+	IUCV_DBF_TEXT(setup, 2, "conn_write: could not register\n");
 	netiucv_free_netdevice(dev);
 	return ret;
 }
@@ -1879,7 +2021,7 @@
 static ssize_t
 remove_write (struct device_driver *drv, const char *buf, size_t count)
 {
-	struct iucv_connection **clist = &connections;
+	struct iucv_connection **clist = &iucv_connections;
         struct net_device *ndev;
         struct netiucv_priv *priv;
         struct device *dev;
@@ -1887,7 +2029,7 @@
         char *p;
         int i;
 
-        pr_debug("%s() called\n", __FUNCTION__);
+        IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 
         if (count >= IFNAMSIZ)
                 count = IFNAMSIZ-1;
@@ -1912,34 +2054,29 @@
                         continue;
                 }
                 if (ndev->flags & (IFF_UP | IFF_RUNNING)) {
-                        printk(KERN_WARNING
+                        PRINT_WARN(
                                 "netiucv: net device %s active with peer %s\n",
                                 ndev->name, priv->conn->userid);
-                        printk(KERN_WARNING
-                                "netiucv: %s cannot be removed\n",
+                        PRINT_WARN("netiucv: %s cannot be removed\n",
                                 ndev->name);
+			IUCV_DBF_TEXT(data, 2, "remove_write: still active\n");
                         return -EBUSY;
                 }
                 unregister_netdev(ndev);
                 netiucv_unregister_device(dev);
                 return count;
         }
-        printk(KERN_WARNING
-                "netiucv: net device %s unknown\n", name);
+        PRINT_WARN("netiucv: net device %s unknown\n", name);
+	IUCV_DBF_TEXT(data, 2, "remove_write: unknown device\n");
         return -EINVAL;
 }
 
 DRIVER_ATTR(remove, 0200, NULL, remove_write);
 
-static struct device_driver netiucv_driver = {
-	.name = "netiucv",
-	.bus  = &iucv_bus,
-};
-
 static void
 netiucv_banner(void)
 {
-	char vbuf[] = "$Revision: 1.57 $";
+	char vbuf[] = "$Revision: 1.63 $";
 	char *version = vbuf;
 
 	if ((version = strchr(version, ':'))) {
@@ -1948,14 +2085,15 @@
 			*p = '\0';
 	} else
 		version = " ??? ";
-	printk(KERN_INFO "NETIUCV driver Version%s initialized\n", version);
+	PRINT_INFO("NETIUCV driver Version%s initialized\n", version);
 }
 
 static void __exit
 netiucv_exit(void)
 {
-	while (connections) {
-		struct net_device *ndev = connections->netdev;
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
+	while (iucv_connections) {
+		struct net_device *ndev = iucv_connections->netdev;
 		struct netiucv_priv *priv = (struct netiucv_priv*)ndev->priv;
 		struct device *dev = priv->dev;
 
@@ -1966,8 +2104,9 @@
 	driver_remove_file(&netiucv_driver, &driver_attr_connection);
 	driver_remove_file(&netiucv_driver, &driver_attr_remove);
 	driver_unregister(&netiucv_driver);
+	iucv_unregister_dbf_views();
 
-	printk(KERN_INFO "NETIUCV driver unloaded\n");
+	PRINT_INFO("NETIUCV driver unloaded\n");
 	return;
 }
 
@@ -1976,20 +2115,31 @@
 {
 	int ret;
 	
+	ret = iucv_register_dbf_views();
+	if (ret) {
+		PRINT_WARN("netiucv_init failed, "
+			"iucv_register_dbf_views rc = %d\n", ret);
+		return ret;
+	}
+	IUCV_DBF_TEXT(trace, 3, __FUNCTION__);
 	ret = driver_register(&netiucv_driver);
-	if (ret != 0) {
-		printk(KERN_ERR "NETIUCV: failed to register driver.\n");
+	if (ret) {
+		PRINT_ERR("NETIUCV: failed to register driver.\n");
+		IUCV_DBF_TEXT_(setup, 2, "ret %d from driver_register\n", ret);
+		iucv_unregister_dbf_views();
 		return ret;
 	}
 
 	/* Add entry for specifying connections. */
 	ret = driver_create_file(&netiucv_driver, &driver_attr_connection);
-	if (ret == 0) {
+	if (!ret) {
 		ret = driver_create_file(&netiucv_driver, &driver_attr_remove);
 		netiucv_banner();
 	} else {
-		printk(KERN_ERR "NETIUCV: failed to add driver attribute.\n");
+		PRINT_ERR("NETIUCV: failed to add driver attribute.\n");
+		IUCV_DBF_TEXT_(setup, 2, "ret %d from driver_create_file\n", ret);
 		driver_unregister(&netiucv_driver);
+		iucv_unregister_dbf_views();
 	}
 	return ret;
 }
diff -urN linux-2.6.8-rc2/drivers/s390/net/qeth_fs.h linux-2.6.8-rc3/drivers/s390/net/qeth_fs.h
--- linux-2.6.8-rc2/drivers/s390/net/qeth_fs.h	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/drivers/s390/net/qeth_fs.h	2004-08-03 15:21:49.159236596 -0700
@@ -12,7 +12,7 @@
 #ifndef __QETH_FS_H__
 #define __QETH_FS_H__
 
-#define VERSION_QETH_FS_H "$Revision: 1.8 $"
+#define VERSION_QETH_FS_H "$Revision: 1.9 $"
 
 extern const char *VERSION_QETH_PROC_C;
 extern const char *VERSION_QETH_SYS_C;
@@ -138,6 +138,8 @@
 				return "HSTR";
 			case QETH_LINK_TYPE_GBIT_ETH:
 				return "OSD_1000";
+			case QETH_LINK_TYPE_10GBIT_ETH:
+				return "OSD_10GIG";
 			case QETH_LINK_TYPE_LANE_ETH100:
 				return "OSD_FE_LANE";
 			case QETH_LINK_TYPE_LANE_TR:
diff -urN linux-2.6.8-rc2/drivers/s390/net/qeth_main.c linux-2.6.8-rc3/drivers/s390/net/qeth_main.c
--- linux-2.6.8-rc2/drivers/s390/net/qeth_main.c	2004-08-03 15:21:08.695576730 -0700
+++ linux-2.6.8-rc3/drivers/s390/net/qeth_main.c	2004-08-03 15:21:49.166236883 -0700
@@ -1,6 +1,6 @@
 /*
  *
- * linux/drivers/s390/net/qeth_main.c ($Revision: 1.125 $)
+ * linux/drivers/s390/net/qeth_main.c ($Revision: 1.127 $)
  *
  * Linux on zSeries OSA Express and HiperSockets support
  *
@@ -12,7 +12,7 @@
  *			  Frank Pavlic (pavlic@de.ibm.com) and
  *		 	  Thomas Spatzier <tspat@de.ibm.com>
  *
- *    $Revision: 1.125 $	 $Date: 2004/06/29 17:28:24 $
+ *    $Revision: 1.127 $	 $Date: 2004/07/14 21:46:40 $
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -78,7 +78,7 @@
 #include "qeth_mpc.h"
 #include "qeth_fs.h"
 
-#define VERSION_QETH_C "$Revision: 1.125 $"
+#define VERSION_QETH_C "$Revision: 1.127 $"
 static const char *version = "qeth S/390 OSA-Express driver";
 
 /**
@@ -3853,7 +3853,8 @@
 	switch(regnum){
 	case MII_BMCR: /* Basic mode control register */
 		rc = BMCR_FULLDPLX;
-		if(card->info.link_type != QETH_LINK_TYPE_GBIT_ETH)
+		if ((card->info.link_type != QETH_LINK_TYPE_GBIT_ETH)&&
+		    (card->info.link_type != QETH_LINK_TYPE_10GBIT_ETH))
 			rc |= BMCR_SPEED100;
 		break;
 	case MII_BMSR: /* Basic mode status register */
diff -urN linux-2.6.8-rc2/drivers/s390/net/qeth_sys.c linux-2.6.8-rc3/drivers/s390/net/qeth_sys.c
--- linux-2.6.8-rc2/drivers/s390/net/qeth_sys.c	2004-06-15 22:19:36.000000000 -0700
+++ linux-2.6.8-rc3/drivers/s390/net/qeth_sys.c	2004-08-03 15:21:49.168236965 -0700
@@ -1,6 +1,6 @@
 /*
  *
- * linux/drivers/s390/net/qeth_sys.c ($Revision: 1.32 $)
+ * linux/drivers/s390/net/qeth_sys.c ($Revision: 1.33 $)
  *
  * Linux on zSeries OSA Express and HiperSockets support
  * This file contains code related to sysfs.
@@ -20,7 +20,7 @@
 #include "qeth_mpc.h"
 #include "qeth_fs.h"
 
-const char *VERSION_QETH_SYS_C = "$Revision: 1.32 $";
+const char *VERSION_QETH_SYS_C = "$Revision: 1.33 $";
 
 /*****************************************************************************/
 /*                                                                           */
@@ -476,7 +476,7 @@
 	    (card->state != CARD_STATE_RECOVER))
 		return -EPERM;
 
-	i = simple_strtoul(buf, &tmp, 16);
+	i = simple_strtoul(buf, &tmp, 10);
 	if ((i < 0) || (i > MAX_ADD_HHLEN)) {
 		PRINT_WARN("add_hhlen out of range\n");
 		return -EINVAL;
diff -urN linux-2.6.8-rc2/drivers/s390/scsi/zfcp_def.h linux-2.6.8-rc3/drivers/s390/scsi/zfcp_def.h
--- linux-2.6.8-rc2/drivers/s390/scsi/zfcp_def.h	2004-08-03 15:21:08.699576894 -0700
+++ linux-2.6.8-rc3/drivers/s390/scsi/zfcp_def.h	2004-08-03 15:21:49.294242134 -0700
@@ -33,7 +33,7 @@
 #define ZFCP_DEF_H
 
 /* this drivers version (do not edit !!! generated and updated by cvs) */
-#define ZFCP_DEF_REVISION "$Revision: 1.75 $"
+#define ZFCP_DEF_REVISION "$Revision: 1.78 $"
 
 /*************************** INCLUDES *****************************************/
 
@@ -1125,32 +1125,6 @@
 		if (ZFCP_LOG_CHECK(level)) { \
 			_zfcp_hex_dump(addr, count); \
 		}
-/*
- * Not yet optimal but useful:
- * Waits until the condition is met or the timeout occurs.
- * The condition may be a function call. This allows to
- * execute some additional instructions in addition
- * to a simple condition check.
- * The timeout is modified on exit and holds the remaining time.
- * Thus it is zero if a timeout ocurred, i.e. the condition was 
- * not met in the specified interval.
- */
-#define __ZFCP_WAIT_EVENT_TIMEOUT(timeout, condition) \
-do { \
-	set_current_state(TASK_UNINTERRUPTIBLE); \
-	while (!(condition) && timeout) \
-		timeout = schedule_timeout(timeout); \
-	current->state = TASK_RUNNING; \
-} while (0);
-
-#define ZFCP_WAIT_EVENT_TIMEOUT(waitqueue, timeout, condition) \
-do { \
-	wait_queue_t entry; \
-	init_waitqueue_entry(&entry, current); \
-	add_wait_queue(&waitqueue, &entry); \
-	__ZFCP_WAIT_EVENT_TIMEOUT(timeout, condition) \
-	remove_wait_queue(&waitqueue, &entry); \
-} while (0);
 
 #define zfcp_get_busid_by_adapter(adapter) (adapter->ccw_device->dev.bus_id)
 #define zfcp_get_busid_by_port(port) (zfcp_get_busid_by_adapter(port->adapter))
diff -urN linux-2.6.8-rc2/drivers/s390/scsi/zfcp_erp.c linux-2.6.8-rc3/drivers/s390/scsi/zfcp_erp.c
--- linux-2.6.8-rc2/drivers/s390/scsi/zfcp_erp.c	2004-08-03 15:21:08.701576976 -0700
+++ linux-2.6.8-rc3/drivers/s390/scsi/zfcp_erp.c	2004-08-03 15:21:49.327243488 -0700
@@ -31,7 +31,7 @@
 #define ZFCP_LOG_AREA			ZFCP_LOG_AREA_ERP
 
 /* this drivers version (do not edit !!! generated and updated by cvs) */
-#define ZFCP_ERP_REVISION "$Revision: 1.56 $"
+#define ZFCP_ERP_REVISION "$Revision: 1.60 $"
 
 #include "zfcp_ext.h"
 
@@ -436,8 +436,8 @@
 	int retval = 0;
 
 	if (send_els->status != 0) {
-		ZFCP_LOG_NORMAL("ELS request timed out, physical port reopen "
-				"of port 0x%016Lx on adapter %s failed\n",
+		ZFCP_LOG_NORMAL("ELS request timed out, force physical port "
+				"reopen of port 0x%016Lx on adapter %s\n",
 				port->wwpn, zfcp_get_busid_by_port(port));
 		debug_text_event(port->adapter->erp_dbf, 3, "forcreop");
 		retval = zfcp_erp_port_forced_reopen(port, 0);
@@ -2187,11 +2187,6 @@
 		ZFCP_LOG_INFO("Waiting to allow the adapter %s "
 			      "to recover itself\n",
 			      zfcp_get_busid_by_adapter(adapter));
-		/*
-		 * SUGGESTION: substitute by
-		 * timeout = ZFCP_TYPE2_RECOVERY_TIME;
-		 * __ZFCP_WAIT_EVENT_TIMEOUT(timeout, 0);
-		 */
 		timeout = ZFCP_TYPE2_RECOVERY_TIME;
 		set_current_state(TASK_UNINTERRUPTIBLE);
 		schedule_timeout(timeout);
diff -urN linux-2.6.8-rc2/drivers/s390/scsi/zfcp_fsf.c linux-2.6.8-rc3/drivers/s390/scsi/zfcp_fsf.c
--- linux-2.6.8-rc2/drivers/s390/scsi/zfcp_fsf.c	2004-08-03 15:21:08.706577181 -0700
+++ linux-2.6.8-rc3/drivers/s390/scsi/zfcp_fsf.c	2004-08-03 15:21:49.398246400 -0700
@@ -29,7 +29,7 @@
  */
 
 /* this drivers version (do not edit !!! generated and updated by cvs) */
-#define ZFCP_FSF_C_REVISION "$Revision: 1.49 $"
+#define ZFCP_FSF_C_REVISION "$Revision: 1.53 $"
 
 #include "zfcp_ext.h"
 
@@ -4717,14 +4717,14 @@
 		      unsigned long *lock_flags)
 {
         int condition;
-        unsigned long timeout = ZFCP_SBAL_TIMEOUT;
         struct zfcp_qdio_queue *req_queue = &adapter->request_queue;
 
         if (unlikely(req_flags & ZFCP_WAIT_FOR_SBAL)) {
-                ZFCP_WAIT_EVENT_TIMEOUT(adapter->request_wq, timeout,
-                                        (condition =
-                                         (zfcp_fsf_req_create_sbal_check)
-                                         (lock_flags, req_queue, 1)));
+                wait_event_interruptible_timeout(adapter->request_wq,
+						 (condition =
+						  zfcp_fsf_req_create_sbal_check
+						  (lock_flags, req_queue, 1)),
+						 ZFCP_SBAL_TIMEOUT);
                 if (!condition) {
                         return -EIO;
 		}
@@ -4788,6 +4788,7 @@
 
 	if (!atomic_test_mask(ZFCP_STATUS_ADAPTER_QDIOUP, &adapter->status)) {
 		write_unlock_irqrestore(&req_queue->queue_lock, *lock_flags);
+		ret = -EIO;
 		goto failed_sbals;
 	}
 
diff -urN linux-2.6.8-rc2/drivers/sbus/char/bbc_envctrl.c linux-2.6.8-rc3/drivers/sbus/char/bbc_envctrl.c
--- linux-2.6.8-rc2/drivers/sbus/char/bbc_envctrl.c	2004-06-15 22:19:17.000000000 -0700
+++ linux-2.6.8-rc3/drivers/sbus/char/bbc_envctrl.c	2004-08-03 15:21:49.441248164 -0700
@@ -7,6 +7,7 @@
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
+#include <linux/delay.h>
 #include <asm/oplib.h>
 #include <asm/ebus.h>
 #define __KERNEL_SYSCALLS__
@@ -622,9 +623,7 @@
 			read_unlock(&tasklist_lock);
 			if (!found)
 				break;
-			current->state = TASK_INTERRUPTIBLE;
-			schedule_timeout(HZ);
-			current->state = TASK_RUNNING;
+			msleep(1000);
 		}
 		kenvctrld_task = NULL;
 	}
diff -urN linux-2.6.8-rc2/drivers/sbus/char/envctrl.c linux-2.6.8-rc3/drivers/sbus/char/envctrl.c
--- linux-2.6.8-rc2/drivers/sbus/char/envctrl.c	2004-08-03 15:21:08.711577385 -0700
+++ linux-2.6.8-rc3/drivers/sbus/char/envctrl.c	2004-08-03 15:21:49.460248944 -0700
@@ -1181,8 +1181,7 @@
 			if (!found)
 				break;
 
-			current->state = TASK_INTERRUPTIBLE;
-			schedule_timeout(HZ);
+			msleep(1000);
 		}
 		kenvctrld_task = NULL;
 	}
diff -urN linux-2.6.8-rc2/drivers/scsi/53c700.c linux-2.6.8-rc3/drivers/scsi/53c700.c
--- linux-2.6.8-rc2/drivers/scsi/53c700.c	2004-08-03 15:21:08.728578082 -0700
+++ linux-2.6.8-rc3/drivers/scsi/53c700.c	2004-08-03 15:21:49.599254646 -0700
@@ -1527,7 +1527,7 @@
 
 			/* clear all the negotiated parameters */
 			__shost_for_each_device(SDp, host)
-				SDp->hostdata = 0;
+				SDp->hostdata = NULL;
 			
 			/* clear all the slots and their pending commands */
 			for(i = 0; i < NCR_700_COMMAND_SLOTS_PER_HOST; i++) {
diff -urN linux-2.6.8-rc2/drivers/scsi/Kconfig linux-2.6.8-rc3/drivers/scsi/Kconfig
--- linux-2.6.8-rc2/drivers/scsi/Kconfig	2004-08-03 15:21:08.739578533 -0700
+++ linux-2.6.8-rc3/drivers/scsi/Kconfig	2004-08-03 15:21:49.772261743 -0700
@@ -491,7 +491,7 @@
 
 config SCSI_BUSLOGIC
 	tristate "BusLogic SCSI support"
-	depends on (PCI || ISA || MCA) && SCSI
+	depends on (PCI || ISA || MCA) && SCSI && (BROKEN || !SPARC64)
 	---help---
 	  This is support for BusLogic MultiMaster and FlashPoint SCSI Host
 	  Adapters. Consult the SCSI-HOWTO, available from
diff -urN linux-2.6.8-rc2/drivers/scsi/NCR5380.c linux-2.6.8-rc3/drivers/scsi/NCR5380.c
--- linux-2.6.8-rc2/drivers/scsi/NCR5380.c	2004-06-15 22:19:02.000000000 -0700
+++ linux-2.6.8-rc3/drivers/scsi/NCR5380.c	2004-08-03 15:21:49.825263918 -0700
@@ -1248,7 +1248,7 @@
 					 * and see if we can do an information transfer,
 					 * with failures we will restart.
 					 */
-					hostdata->selecting = 0;	
+					hostdata->selecting = NULL;
 					/* RvC: have to preset this to indicate a new command is being performed */
 
 					if (!NCR5380_select(instance, tmp,
@@ -1634,7 +1634,7 @@
 				   to go to sleep */
 	}
 
-	hostdata->selecting = 0;	/* clear this pointer, because we passed the
+	hostdata->selecting = NULL;/* clear this pointer, because we passed the
 					   waiting period */
 	if ((NCR5380_read(STATUS_REG) & (SR_SEL | SR_IO)) == (SR_SEL | SR_IO)) {
 		NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
diff -urN linux-2.6.8-rc2/drivers/scsi/aacraid/aacraid.h linux-2.6.8-rc3/drivers/scsi/aacraid/aacraid.h
--- linux-2.6.8-rc2/drivers/scsi/aacraid/aacraid.h	2004-08-03 15:21:08.840582670 -0700
+++ linux-2.6.8-rc3/drivers/scsi/aacraid/aacraid.h	2004-08-03 15:21:50.015271712 -0700
@@ -1313,7 +1313,7 @@
  *	only used for debugging.
  */
  
-#if DBG
+#ifdef DBG
 #define	FIB_COUNTER_INCREMENT(counter)		(counter)++
 #else
 #define	FIB_COUNTER_INCREMENT(counter)		
diff -urN linux-2.6.8-rc2/drivers/scsi/aha152x.c linux-2.6.8-rc3/drivers/scsi/aha152x.c
--- linux-2.6.8-rc2/drivers/scsi/aha152x.c	2004-08-03 15:21:08.905585333 -0700
+++ linux-2.6.8-rc3/drivers/scsi/aha152x.c	2004-08-03 15:21:50.384286850 -0700
@@ -422,7 +422,7 @@
 #endif /* !PCMCIA */
 
 static int registered_count=0;
-static struct Scsi_Host *aha152x_host[2] = {0, 0};
+static struct Scsi_Host *aha152x_host[2];
 static Scsi_Host_Template aha152x_driver_template;
 
 /*
@@ -647,20 +647,20 @@
 	void		(*end)(struct Scsi_Host *);
 	int		spio;
 } states[] = {
-	{ "idle",	0,		0,		0,		0},
-	{ "unknown",	0,		0,		0,		0},
-	{ "seldo",	0,		seldo_run,	0,		0},
-	{ "seldi",	0,		seldi_run,	0,		0},
-	{ "selto",	0,		selto_run,	0,		0},
-	{ "busfree",	0,		busfree_run,	0,		0},
+	{ "idle",	NULL,		NULL,		NULL,		0},
+	{ "unknown",	NULL,		NULL,		NULL,		0},
+	{ "seldo",	NULL,		seldo_run,	NULL,		0},
+	{ "seldi",	NULL,		seldi_run,	NULL,		0},
+	{ "selto",	NULL,		selto_run,	NULL,		0},
+	{ "busfree",	NULL,		busfree_run,	NULL,		0},
 	{ "msgo",	msgo_init,	msgo_run,	msgo_end,	1},
 	{ "cmd",	cmd_init,	cmd_run,	cmd_end,	1},
-	{ "msgi",	0,		msgi_run,	msgi_end,	1},
-	{ "status",	0,		status_run,	0,		1},
+	{ "msgi",	NULL,		msgi_run,	msgi_end,	1},
+	{ "status",	NULL,		status_run,	NULL,		1},
 	{ "datai",	datai_init,	datai_run,	datai_end,	0},
 	{ "datao",	datao_init,	datao_run,	datao_end,	0},
-	{ "parerr",	0,		parerr_run,	0,		0},
-	{ "rsti",	0,		rsti_run,	0,		0},
+	{ "parerr",	NULL,		parerr_run,	NULL,		0},
+	{ "rsti",	NULL,		rsti_run,	NULL,		0},
 };
 
 /* setup & interrupt */
@@ -756,7 +756,7 @@
 		if(aha152x_host[i] && aha152x_host[i]->irq==irqno)
 			return aha152x_host[i];
 
-	return 0;
+	return NULL;
 }
 
 static irqreturn_t swintr(int irqno, void *dev_id, struct pt_regs *regs)
@@ -892,7 +892,7 @@
 		goto out_host_put;
 	}
 
-	if( scsi_add_host(shpnt, 0) ) {
+	if( scsi_add_host(shpnt, NULL) ) {
 		free_irq(shpnt->irq, shpnt);
 		printk(KERN_ERR "aha152x%d: failed to add host.\n", shpnt->host_no);
 		goto out_host_put;
@@ -905,10 +905,10 @@
 	return shpnt;
 
 out_host_put:
-	aha152x_host[registered_count]=0;
+	aha152x_host[registered_count]=NULL;
 	scsi_host_put(shpnt);
 
-	return 0;
+	return NULL;
 }
 
 void aha152x_release(struct Scsi_Host *shpnt)
@@ -1011,7 +1011,7 @@
 		}
 	}
 
-	SCNEXT(SCpnt)		= 0;
+	SCNEXT(SCpnt)		= NULL;
 	SCSEM(SCpnt)		= sem;
 
 	/* setup scratch area
@@ -1068,7 +1068,7 @@
 	}
 #endif
 
-	return aha152x_internal_queue(SCpnt, 0, 0, done);
+	return aha152x_internal_queue(SCpnt, NULL, 0, done);
 }
 
 
@@ -1119,7 +1119,7 @@
 		DO_UNLOCK(flags);
 
 		kfree(SCpnt->host_scribble);
-		SCpnt->host_scribble=0;
+		SCpnt->host_scribble=NULL;
 
 		return SUCCESS;
 	} 
@@ -1184,7 +1184,7 @@
 
 	SCpnt->cmd_len         = 0;
 	SCpnt->use_sg          = 0;
-	SCpnt->request_buffer  = 0;
+	SCpnt->request_buffer  = NULL;
 	SCpnt->request_bufflen = 0;
 
 	init_timer(&timer);
@@ -1209,7 +1209,7 @@
 		if (!HOSTDATA(shpnt)->commands)
 			SETPORT(PORTA, 0);
 		kfree(SCpnt->host_scribble);
-		SCpnt->host_scribble=0;
+		SCpnt->host_scribble=NULL;
 
 		ret = SUCCESS;
 	} else {
@@ -1241,7 +1241,7 @@
 			next = SCNEXT(ptr);
 		} else {
 			printk(DEBUG_LEAD "queue corrupted at %p\n", CMDINFO(ptr), ptr);
-			next = 0;
+			next = NULL;
 		}
 
 		if (!ptr->device->soft_reset) {
@@ -1249,7 +1249,7 @@
 			remove_SC(SCs, ptr);
 			HOSTDATA(shpnt)->commands--;
 			kfree(ptr->host_scribble);
-			ptr->host_scribble=0;
+			ptr->host_scribble=NULL;
 		}
 
 		ptr = next;
@@ -1386,7 +1386,7 @@
 				       "aha152x: unable to verify geometry for disk with >1GB.\n"
 				       "         Using default translation. Please verify yourself.\n"
 				       "         Perhaps you need to enable extended translation in the driver.\n"
-				       "         See /usr/src/linux/Documentation/scsi/aha152x.txt for details.\n");
+				       "         See Documentation/scsi/aha152x.txt for details.\n");
 			}
 		} else {
 			info_array[0] = info[0];
@@ -1415,7 +1415,7 @@
 			printk(ERR_LEAD "there's already a completed command %p - will cause abort\n", CMDINFO(CURRENT_SC), DONE_SC);
 
 		DONE_SC = CURRENT_SC;
-		CURRENT_SC = 0;
+		CURRENT_SC = NULL;
 		DONE_SC->result = error;
 	} else
 		printk(KERN_ERR "aha152x: done() called outside of command\n");
@@ -1538,7 +1538,7 @@
 #endif
 			append_SC(&DISCONNECTED_SC, CURRENT_SC);
 			CURRENT_SC->SCp.phase |= 1 << 16;
-			CURRENT_SC = 0;
+			CURRENT_SC = NULL;
 
 		} else {
 			done(shpnt, DID_ERROR << 16);
@@ -1586,7 +1586,7 @@
 
 			if(!(DONE_SC->SCp.Status & not_issued)) {
 				Scsi_Cmnd *ptr = DONE_SC;
-				DONE_SC=0;
+				DONE_SC=NULL;
 #if 0
 				DPRINTK(debug_eh, ERR_LEAD "requesting sense\n", CMDINFO(ptr));
 #endif
@@ -1603,7 +1603,7 @@
 				ptr->request_bufflen = sizeof(ptr->sense_buffer);
 			
 				DO_UNLOCK(flags);
-				aha152x_internal_queue(ptr, 0, check_condition, ptr->scsi_done);
+				aha152x_internal_queue(ptr, NULL, check_condition, ptr->scsi_done);
 				DO_LOCK(flags);
 #if 0
 			} else {
@@ -1619,7 +1619,7 @@
 			int lun=DONE_SC->device->lun & 0x7;
 #endif
 			Scsi_Cmnd *ptr = DONE_SC;
-			DONE_SC=0;
+			DONE_SC=NULL;
 
 			/* turn led off, when no commands are in the driver */
 			HOSTDATA(shpnt)->commands--;
@@ -1628,7 +1628,7 @@
 
 			if(ptr->scsi_done != reset_done) {
 				kfree(ptr->host_scribble);
-				ptr->host_scribble=0;
+				ptr->host_scribble=NULL;
 			}
 
 			DO_UNLOCK(flags);
@@ -1638,7 +1638,7 @@
 			DO_LOCK(flags);
 		}
 
-		DONE_SC=0;
+		DONE_SC=NULL;
 #if defined(AHA152X_STAT)
 	} else {
 		HOSTDATA(shpnt)->busfree_without_done_command++;
@@ -1780,7 +1780,7 @@
 		append_SC(&ISSUE_SC, CURRENT_SC);
 		DO_UNLOCK(flags);
 
-		CURRENT_SC = 0;
+		CURRENT_SC = NULL;
 	}
 
 	if(!DISCONNECTED_SC) {
@@ -2503,7 +2503,7 @@
 			remove_SC(&DISCONNECTED_SC, ptr);
 
 			kfree(ptr->host_scribble);
-			ptr->host_scribble=0;
+			ptr->host_scribble=NULL;
 
 			ptr->result =  DID_RESET << 16;
 			ptr->scsi_done(ptr);
@@ -2976,7 +2976,7 @@
 		printk(KERN_DEBUG "none\n");
 
 	printk(KERN_DEBUG "disconnected_SC:\n");
-	for (ptr = DISCONNECTED_SC; ptr; ptr = SCDATA(ptr) ? SCNEXT(ptr) : 0)
+	for (ptr = DISCONNECTED_SC; ptr; ptr = SCDATA(ptr) ? SCNEXT(ptr) : NULL)
 		show_command(ptr);
 
 	disp_ports(shpnt);
@@ -3454,7 +3454,7 @@
 
 	if(thislength<0) {
 		DPRINTK(debug_procinfo, KERN_DEBUG "aha152x_proc_info: output too short\n");
-		*start = 0;
+		*start = NULL;
 		return 0;
 	}
 
@@ -3638,7 +3638,7 @@
 	aha152x_config conf;
 #endif
 #ifdef __ISAPNP__
-	struct pnp_dev *dev=0, *pnpdev[2] = {0, 0};
+	struct pnp_dev *dev=NULL, *pnpdev[2] = {NULL, NULL};
 #endif
 
 	if ( setup_count ) {
@@ -3901,7 +3901,7 @@
 #if defined(__ISAPNP__)
 			} else if( pnpdev[i] ) {
 				HOSTDATA(shpnt)->pnpdev=pnpdev[i];
-				pnpdev[i]=0;
+				pnpdev[i]=NULL;
 #endif
 			}
 		} else {
@@ -3923,7 +3923,7 @@
 
 	for(i=0; i<ARRAY_SIZE(setup); i++) {
 		aha152x_release(aha152x_host[i]);
-		aha152x_host[i]=0;
+		aha152x_host[i]=NULL;
 	}
 }
 
diff -urN linux-2.6.8-rc2/drivers/scsi/aha1542.c linux-2.6.8-rc3/drivers/scsi/aha1542.c
--- linux-2.6.8-rc2/drivers/scsi/aha1542.c	2004-08-03 15:21:08.906585374 -0700
+++ linux-2.6.8-rc3/drivers/scsi/aha1542.c	2004-08-03 15:21:50.435288942 -0700
@@ -545,7 +545,7 @@
 		my_done = SCtmp->scsi_done;
 		if (SCtmp->host_scribble) {
 			kfree(SCtmp->host_scribble);
-			SCtmp->host_scribble = 0;
+			SCtmp->host_scribble = NULL;
 		}
 		/* Fetch the sense data, and tuck it away, in the required slot.  The
 		   Adaptec automatically fetches it, and there is no guarantee that
diff -urN linux-2.6.8-rc2/drivers/scsi/aic7xxx/aic79xx_core.c linux-2.6.8-rc3/drivers/scsi/aic7xxx/aic79xx_core.c
--- linux-2.6.8-rc2/drivers/scsi/aic7xxx/aic79xx_core.c	2004-06-15 22:18:37.000000000 -0700
+++ linux-2.6.8-rc3/drivers/scsi/aic7xxx/aic79xx_core.c	2004-08-03 15:21:50.506291855 -0700
@@ -173,7 +173,7 @@
 					    struct ahd_devinfo *devinfo,
 					    u_int lun, cam_status status,
 					    char *message, int verbose_level);
-#if AHD_TARGET_MODE
+#ifdef AHD_TARGET_MODE
 static void		ahd_setup_target_msgin(struct ahd_softc *ahd,
 					       struct ahd_devinfo *devinfo,
 					       struct scb *scb);
@@ -1190,7 +1190,7 @@
 					ahd->msgin_index = 0;
 				}
 			}
-#if AHD_TARGET_MODE
+#ifdef AHD_TARGET_MODE
 			else {
 				if (bus_phase == P_MESGOUT) {
 					ahd->msg_type =
@@ -5303,7 +5303,7 @@
 
 		tstate = ahd->enabled_targets[i];
 		if (tstate != NULL) {
-#if AHD_TARGET_MODE
+#ifdef AHD_TARGET_MODE
 			int j;
 
 			for (j = 0; j < AHD_NUM_LUNS; j++) {
@@ -5319,7 +5319,7 @@
 			free(tstate, M_DEVBUF);
 		}
 	}
-#if AHD_TARGET_MODE
+#ifdef AHD_TARGET_MODE
 	if (ahd->black_hole != NULL) {
 		xpt_free_path(ahd->black_hole->path);
 		free(ahd->black_hole, M_DEVBUF);
@@ -6575,7 +6575,7 @@
 	ahd_outb(ahd, CLRSINT3, NTRAMPERR|OSRAMPERR);
 	ahd_outb(ahd, CLRINT, CLRSCSIINT);
 
-#if NEEDS_MORE_TESTING
+#ifdef NEEDS_MORE_TESTING
 	/*
 	 * Always enable abort on incoming L_Qs if this feature is
 	 * supported.  We use this to catch invalid SCB references.
@@ -7157,7 +7157,7 @@
 	if (match != 0)
 		match = ((lun == slun) || (lun == CAM_LUN_WILDCARD));
 	if (match != 0) {
-#if AHD_TARGET_MODE
+#ifdef AHD_TARGET_MODE
 		int group;
 
 		group = XPT_FC_GROUP(scb->io_ctx->ccb_h.func_code);
@@ -7768,7 +7768,7 @@
 	/* Make sure the sequencer is in a safe location. */
 	ahd_clear_critical_section(ahd);
 
-#if AHD_TARGET_MODE
+#ifdef AHD_TARGET_MODE
 	if ((ahd->flags & AHD_TARGETROLE) != 0) {
 		ahd_run_tqinfifo(ahd, /*paused*/TRUE);
 	}
diff -urN linux-2.6.8-rc2/drivers/scsi/aic7xxx_old.c linux-2.6.8-rc3/drivers/scsi/aic7xxx_old.c
--- linux-2.6.8-rc2/drivers/scsi/aic7xxx_old.c	2004-08-03 15:21:08.941586808 -0700
+++ linux-2.6.8-rc3/drivers/scsi/aic7xxx_old.c	2004-08-03 15:21:50.712300306 -0700
@@ -4881,7 +4881,7 @@
     }
     break;
 
-#if AIC7XXX_NOT_YET 
+#ifdef AIC7XXX_NOT_YET 
     case TRACEPOINT2:
       {
         printk(INFO_LEAD "Tracepoint #2 reached.\n", p->host_no,
@@ -9335,7 +9335,7 @@
                 printk(KERN_INFO "aic7xxx: MMAPed I/O failed, reverting to "
                                  "Programmed I/O.\n");
                 iounmap((void *) (((unsigned long) temp_p->maddr) & PAGE_MASK));
-                temp_p->maddr = 0;
+                temp_p->maddr = NULL;
                 if(temp_p->base == 0)
                 {
                   printk("aic7xxx: <%s> at PCI %d/%d/%d\n", 
@@ -9743,7 +9743,7 @@
     temp_p->pause = hcntrl | PAUSE | INTEN;
     temp_p->base = base;
     temp_p->mbase = 0;
-    temp_p->maddr = 0;
+    temp_p->maddr = NULL;
     temp_p->pci_bus = 0;
     temp_p->pci_device_fn = slot;
     aic_outb(temp_p, hcntrl | PAUSE, HCNTRL);
diff -urN linux-2.6.8-rc2/drivers/scsi/dpt_i2o.c linux-2.6.8-rc3/drivers/scsi/dpt_i2o.c
--- linux-2.6.8-rc2/drivers/scsi/dpt_i2o.c	2004-08-03 15:21:08.975588201 -0700
+++ linux-2.6.8-rc3/drivers/scsi/dpt_i2o.c	2004-08-03 15:21:51.140317864 -0700
@@ -1643,13 +1643,13 @@
 	u32 reply_size = 0;
 	u32 __user *user_msg = arg;
 	u32 __user * user_reply = NULL;
-	ulong sg_list[pHba->sg_tablesize];
+	void *sg_list[pHba->sg_tablesize];
 	u32 sg_offset = 0;
 	u32 sg_count = 0;
 	int sg_index = 0;
 	u32 i = 0;
 	u32 rcode = 0;
-	ulong p = 0;
+	void *p = NULL;
 	ulong flags = 0;
 
 	memset(&msg, 0, MAX_MESSAGE_SIZE*4);
@@ -1705,8 +1705,8 @@
 			}
 			sg_size = sg[i].flag_count & 0xffffff;      
 			/* Allocate memory for the transfer */
-			p = (ulong)kmalloc(sg_size, GFP_KERNEL|ADDR32);
-			if(p == 0) {
+			p = kmalloc(sg_size, GFP_KERNEL|ADDR32);
+			if(!p) {
 				printk(KERN_DEBUG"%s: Could not allocate SG buffer - size = %d buffer number %d of %d\n",
 						pHba->name,sg_size,i,sg_count);
 				rcode = -ENOMEM;
@@ -1716,14 +1716,14 @@
 			/* Copy in the user's SG buffer if necessary */
 			if(sg[i].flag_count & 0x04000000 /*I2O_SGL_FLAGS_DIR*/) {
 				// TODO 64bit fix
-				if (copy_from_user((void*)p,(void*)sg[i].addr_bus, sg_size)) {
+				if (copy_from_user(p,(void __user *)sg[i].addr_bus, sg_size)) {
 					printk(KERN_DEBUG"%s: Could not copy SG buf %d FROM user\n",pHba->name,i);
 					rcode = -EFAULT;
 					goto cleanup;
 				}
 			}
 			//TODO 64bit fix
-			sg[i].addr_bus = (u32)virt_to_bus((void*)p);
+			sg[i].addr_bus = (u32)virt_to_bus(p);
 		}
 	}
 
@@ -1778,8 +1778,8 @@
 			if(! (sg[j].flag_count & 0x4000000 /*I2O_SGL_FLAGS_DIR*/)) {
 				sg_size = sg[j].flag_count & 0xffffff; 
 				// TODO 64bit fix
-				if (copy_to_user((void*)sg[j].addr_bus,(void*)sg_list[j], sg_size)) {
-					printk(KERN_WARNING"%s: Could not copy %lx TO user %x\n",pHba->name, sg_list[j], sg[j].addr_bus);
+				if (copy_to_user((void __user *)sg[j].addr_bus,sg_list[j], sg_size)) {
+					printk(KERN_WARNING"%s: Could not copy %p TO user %x\n",pHba->name, sg_list[j], sg[j].addr_bus);
 					rcode = -EFAULT;
 					goto cleanup;
 				}
@@ -1807,7 +1807,7 @@
 	while(sg_index) {
 		if(sg_list[--sg_index]) {
 			if (rcode != -ETIME && rcode != -EINTR)
-				kfree((void*)(sg_list[sg_index]));
+				kfree(sg_list[sg_index]);
 		}
 	}
 	return rcode;
diff -urN linux-2.6.8-rc2/drivers/scsi/eata_pio.c linux-2.6.8-rc3/drivers/scsi/eata_pio.c
--- linux-2.6.8-rc2/drivers/scsi/eata_pio.c	2004-08-03 15:21:08.982588488 -0700
+++ linux-2.6.8-rc3/drivers/scsi/eata_pio.c	2004-08-03 15:21:51.188319834 -0700
@@ -840,7 +840,7 @@
 	u32 base;
 	int i;
 
-#if CHECKPAL
+#ifdef CHECKPAL
 	u8 pal1, pal2, pal3;
 #endif
 
@@ -848,7 +848,7 @@
 		if (EISAbases[i]) {	/* Still a possibility ?          */
 
 			base = 0x1c88 + (i * 0x1000);
-#if CHECKPAL
+#ifdef CHECKPAL
 			pal1 = inb((u16) base - 8);
 			pal2 = inb((u16) base - 7);
 			pal3 = inb((u16) base - 6);
@@ -868,7 +868,7 @@
 				}
 				/* Nothing found here so we take it from the list */
 				EISAbases[i] = 0;
-#if CHECKPAL
+#ifdef CHECKPAL
 			}
 #endif
 		}
@@ -929,7 +929,7 @@
 					EISAbases[x] = 0;
 				}
 			}
-#if CHECK_BLINK
+#ifdef CHECK_BLINK
 			else if (check_blink_state(base)) {
 				printk("eata_pio: HBA is in BLINK state.\n" "Consult your HBAs manual to correct this.\n");
 			}
diff -urN linux-2.6.8-rc2/drivers/scsi/fastlane.c linux-2.6.8-rc3/drivers/scsi/fastlane.c
--- linux-2.6.8-rc2/drivers/scsi/fastlane.c	2004-08-03 15:21:08.982588488 -0700
+++ linux-2.6.8-rc3/drivers/scsi/fastlane.c	2004-08-03 15:21:51.221321187 -0700
@@ -85,7 +85,6 @@
 
 static int  dma_bytes_sent(struct NCR_ESP *esp, int fifo_count);
 static int  dma_can_transfer(struct NCR_ESP *esp, Scsi_Cmnd *sp);
-static inline void dma_clear(struct NCR_ESP *esp);
 static void dma_dump_state(struct NCR_ESP *esp);
 static void dma_init_read(struct NCR_ESP *esp, __u32 addr, int length);
 static void dma_init_write(struct NCR_ESP *esp, __u32 vaddr, int length);
@@ -110,6 +109,21 @@
 				 * via PIO.
 				 */
 
+static inline void dma_clear(struct NCR_ESP *esp)
+{
+	struct fastlane_dma_registers *dregs =
+		(struct fastlane_dma_registers *) (esp->dregs);
+	unsigned long *t;
+
+	ctrl_data = (ctrl_data & FASTLANE_DMA_MASK);
+	dregs->ctrl_reg = ctrl_data;
+
+	t = (unsigned long *)(esp->edev);
+
+	dregs->clear_strobe = 0;
+	*t = 0 ;
+}
+
 /***************************************************************** Detection */
 int __init fastlane_esp_detect(Scsi_Host_Template *tpnt)
 {
@@ -297,21 +311,6 @@
 	dregs->ctrl_reg = ctrl_data;
 }
 
-static inline void dma_clear(struct NCR_ESP *esp)
-{
-	struct fastlane_dma_registers *dregs = 
-		(struct fastlane_dma_registers *) (esp->dregs);
-	unsigned long *t;
-
-	ctrl_data = (ctrl_data & FASTLANE_DMA_MASK);
-	dregs->ctrl_reg = ctrl_data;
-
-	t = (unsigned long *)(esp->edev);
-
-	dregs->clear_strobe = 0;
-	*t = 0 ;
-}
-
 
 static void dma_ints_off(struct NCR_ESP *esp)
 {
diff -urN linux-2.6.8-rc2/drivers/scsi/fdomain.c linux-2.6.8-rc3/drivers/scsi/fdomain.c
--- linux-2.6.8-rc2/drivers/scsi/fdomain.c	2004-08-03 15:21:08.986588652 -0700
+++ linux-2.6.8-rc3/drivers/scsi/fdomain.c	2004-08-03 15:21:51.264322951 -0700
@@ -681,6 +681,7 @@
 
 static int fdomain_isa_detect( int *irq, int *iobase )
 {
+#ifndef PCMCIA
    int i, j;
    int base = 0xdeadbeef;
    int flag = 0;
@@ -786,6 +787,9 @@
    *iobase = base;
 
    return 1;			/* success */
+#else
+   return 0;
+#endif
 }
 
 /* PCI detection function: int fdomain_pci_bios_detect(int* irq, int*
diff -urN linux-2.6.8-rc2/drivers/scsi/g_NCR5380.c linux-2.6.8-rc3/drivers/scsi/g_NCR5380.c
--- linux-2.6.8-rc2/drivers/scsi/g_NCR5380.c	2004-08-03 15:21:08.987588693 -0700
+++ linux-2.6.8-rc3/drivers/scsi/g_NCR5380.c	2004-08-03 15:21:51.269323157 -0700
@@ -355,7 +355,7 @@
 		if (!(overrides[current_override].NCR5380_map_name))
 			continue;
 
-		ports = 0;
+		ports = NULL;
 		switch (overrides[current_override].board) {
 		case BOARD_NCR5380:
 			flags = FLAG_NO_PSEUDO_DMA;
diff -urN linux-2.6.8-rc2/drivers/scsi/in2000.c linux-2.6.8-rc3/drivers/scsi/in2000.c
--- linux-2.6.8-rc2/drivers/scsi/in2000.c	2004-08-03 15:21:09.029590414 -0700
+++ linux-2.6.8-rc3/drivers/scsi/in2000.c	2004-08-03 15:21:51.422329433 -0700
@@ -184,7 +184,7 @@
 static char *setup_args[] = { "", "", "", "", "", "", "", "", "" };
 
 /* filled in by 'insmod' */
-static char *setup_strings = 0;
+static char *setup_strings;
 
 MODULE_PARM(setup_strings, "s");
 
@@ -468,7 +468,7 @@
 	 */
 
 	cmd = (Scsi_Cmnd *) hostdata->input_Q;
-	prev = 0;
+	prev = NULL;
 	while (cmd) {
 		if (!(hostdata->busy[cmd->device->id] & (1 << cmd->device->lun)))
 			break;
@@ -1702,7 +1702,7 @@
  */
 
 	tmp = (Scsi_Cmnd *) hostdata->input_Q;
-	prev = 0;
+	prev = NULL;
 	while (tmp) {
 		if (tmp == cmd) {
 			if (prev)
@@ -1923,7 +1923,7 @@
  */
 
 	if (!done_setup && setup_strings)
-		in2000_setup(setup_strings, 0);
+		in2000_setup(setup_strings, NULL);
 
 	detect_count = 0;
 	for (bios = 0; bios_tab[bios]; bios++) {
diff -urN linux-2.6.8-rc2/drivers/scsi/libata-core.c linux-2.6.8-rc3/drivers/scsi/libata-core.c
--- linux-2.6.8-rc2/drivers/scsi/libata-core.c	2004-08-03 15:21:09.046591110 -0700
+++ linux-2.6.8-rc3/drivers/scsi/libata-core.c	2004-08-03 15:21:51.692340510 -0700
@@ -2578,6 +2578,7 @@
 
 	case ATA_PROT_DMA:
 	case ATA_PROT_ATAPI_DMA:
+	case ATA_PROT_ATAPI:
 		/* check status of DMA engine */
 		host_stat = ata_bmdma_status(ap);
 		VPRINTK("BUS_DMA (host_stat 0x%X)\n", host_stat);
diff -urN linux-2.6.8-rc2/drivers/scsi/ncr53c8xx.c linux-2.6.8-rc3/drivers/scsi/ncr53c8xx.c
--- linux-2.6.8-rc2/drivers/scsi/ncr53c8xx.c	2004-08-03 15:21:09.066591930 -0700
+++ linux-2.6.8-rc3/drivers/scsi/ncr53c8xx.c	2004-08-03 15:21:51.838346499 -0700
@@ -4520,7 +4520,7 @@
 	*/
 
 	if (cp == tp->nego_cp)
-		tp->nego_cp = 0;
+		tp->nego_cp = NULL;
 
 	/*
 	**	If auto-sense performed, change scsi status.
@@ -4538,7 +4538,7 @@
 		if (cp == lp->held_ccb) {
 			xpt_que_splice(&lp->skip_ccbq, &lp->wait_ccbq);
 			xpt_que_init(&lp->skip_ccbq);
-			lp->held_ccb = 0;
+			lp->held_ccb = NULL;
 		}
 	}
 
@@ -5646,7 +5646,7 @@
 	} else {
 		script_ofs	= dsp;
 		script_size	= 0;
-		script_base	= 0;
+		script_base	= NULL;
 		script_name	= "mem";
 	}
 
@@ -6125,7 +6125,7 @@
 	if (!(cmd & 6)) {
 		cp = np->header.cp;
 		if (CCB_PHYS(cp, phys) != dsa)
-			cp = 0;
+			cp = NULL;
 	} else {
 		cp  = np->ccb;
 		while (cp && (CCB_PHYS (cp, phys) != dsa))
@@ -6136,7 +6136,7 @@
 	**	try to find the interrupted script command,
 	**	and the address at which to continue.
 	*/
-	vdsp	= 0;
+	vdsp	= NULL;
 	nxtdsp	= 0;
 	if	(dsp >  np->p_script &&
 		 dsp <= np->p_script + sizeof(struct script)) {
@@ -6533,7 +6533,7 @@
 	u_char scntl3;
 	u_char chg, ofs, per, fak, wide;
 	u_char num = INB (nc_dsps);
-	struct ccb *cp=0;
+	struct ccb *cp=NULL;
 	u_long	dsa    = INL (nc_dsa);
 	u_char	target = INB (nc_sdid) & 0x0f;
 	struct tcb *tp     = &np->target[target];
@@ -7046,7 +7046,7 @@
 			if (cp->magic) {
 				PRINT_LUN(np, tn, ln);
 				printk ("ccb free list corrupted (@%p)\n", cp);
-				cp = 0;
+				cp = NULL;
 			}
 			else {
 				xpt_insque_tail(qp, &lp->wait_ccbq);
@@ -7232,7 +7232,7 @@
 {
 	struct tcb *tp = &np->target[tn];
 	struct lcb *lp = tp->lp[ln];
-	struct ccb *cp = 0;
+	struct ccb *cp = NULL;
 
 	/*
 	**	Allocate memory for this CCB.
@@ -8095,7 +8095,7 @@
      NCR_LOCK_NCB(np, flags);
      ncr_exception(np);
      done_list     = np->done_list;
-     np->done_list = 0;
+     np->done_list = NULL;
      NCR_UNLOCK_NCB(np, flags);
 
      if (DEBUG_FLAGS & DEBUG_TINY) printk ("]\n");
@@ -8121,7 +8121,7 @@
      NCR_LOCK_NCB(np, flags);
      ncr_timeout(np);
      done_list     = np->done_list;
-     np->done_list = 0;
+     np->done_list = NULL;
      NCR_UNLOCK_NCB(np, flags);
 
      if (done_list) {
@@ -8154,7 +8154,7 @@
 	sts = ncr_reset_bus(np, cmd, 1);
 
 	done_list     = np->done_list;
-	np->done_list = 0;
+	np->done_list = NULL;
 	NCR_UNLOCK_NCB(np, flags);
 
 	ncr_flush_done_cmds(done_list);
@@ -8195,7 +8195,7 @@
 	sts = ncr_abort_command(np, cmd);
 out:
 	done_list     = np->done_list;
-	np->done_list = 0;
+	np->done_list = NULL;
 	NCR_UNLOCK_NCB(np, flags);
 
 	ncr_flush_done_cmds(done_list);
@@ -8226,7 +8226,7 @@
 #ifdef DEBUG_WAITING_LIST
 	printk("%s: cmd %lx inserted into waiting list\n", ncr_name(np), (u_long) cmd);
 #endif
-	cmd->next_wcmd = 0;
+	cmd->next_wcmd = NULL;
 	if (!(wcmd = np->waiting_list)) np->waiting_list = cmd;
 	else {
 		while ((wcmd->next_wcmd) != 0)
@@ -8243,7 +8243,7 @@
 		if (cmd == *pcmd) {
 			if (to_remove) {
 				*pcmd = (struct scsi_cmnd *) cmd->next_wcmd;
-				cmd->next_wcmd = 0;
+				cmd->next_wcmd = NULL;
 			}
 #ifdef DEBUG_WAITING_LIST
 	printk("%s: cmd %lx retrieved from waiting list\n", ncr_name(np), (u_long) cmd);
@@ -8252,7 +8252,7 @@
 		}
 		pcmd = (struct scsi_cmnd **) &(*pcmd)->next_wcmd;
 	}
-	return 0;
+	return NULL;
 }
 
 static void process_waiting_list(struct ncb *np, int sts)
@@ -8260,14 +8260,14 @@
 	struct scsi_cmnd *waiting_list, *wcmd;
 
 	waiting_list = np->waiting_list;
-	np->waiting_list = 0;
+	np->waiting_list = NULL;
 
 #ifdef DEBUG_WAITING_LIST
 	if (waiting_list) printk("%s: waiting_list=%lx processing sts=%d\n", ncr_name(np), (u_long) waiting_list, sts);
 #endif
 	while ((wcmd = waiting_list) != 0) {
 		waiting_list = (struct scsi_cmnd *) wcmd->next_wcmd;
-		wcmd->next_wcmd = 0;
+		wcmd->next_wcmd = NULL;
 		if (sts == DID_OK) {
 #ifdef DEBUG_WAITING_LIST
 	printk("%s: cmd %lx trying to requeue\n", ncr_name(np), (u_long) wcmd);
@@ -8535,7 +8535,7 @@
 			int length, int func)
 {
 	struct host_data *host_data;
-	struct ncb *ncb = 0;
+	struct ncb *ncb = NULL;
 	int retv;
 
 #ifdef DEBUG_PROC_INFO
@@ -8579,7 +8579,7 @@
 **==========================================================
 */
 #ifdef	MODULE
-char *ncr53c8xx = 0;	/* command line passed by insmod */
+char *ncr53c8xx;	/* command line passed by insmod */
 MODULE_PARM(ncr53c8xx, "s");
 #endif
 
@@ -8617,8 +8617,8 @@
 					int unit, struct ncr_device *device)
 {
 	struct host_data *host_data;
-	struct ncb *np = 0;
-	struct Scsi_Host *instance = 0;
+	struct ncb *np = NULL;
+	struct Scsi_Host *instance = NULL;
 	u_long flags = 0;
 	int i;
 
diff -urN linux-2.6.8-rc2/drivers/scsi/nsp32.c linux-2.6.8-rc3/drivers/scsi/nsp32.c
--- linux-2.6.8-rc2/drivers/scsi/nsp32.c	2004-08-03 15:21:09.069592052 -0700
+++ linux-2.6.8-rc3/drivers/scsi/nsp32.c	2004-08-03 15:21:51.881348263 -0700
@@ -1604,7 +1604,7 @@
 	thislength = pos - (buffer + offset);
 
 	if(thislength < 0) {
-		*start = 0;
+		*start = NULL;
                 return 0;
         }
 
diff -urN linux-2.6.8-rc2/drivers/scsi/qla1280.c linux-2.6.8-rc3/drivers/scsi/qla1280.c
--- linux-2.6.8-rc2/drivers/scsi/qla1280.c	2004-08-03 15:21:09.142595043 -0700
+++ linux-2.6.8-rc3/drivers/scsi/qla1280.c	2004-08-03 15:21:52.511374109 -0700
@@ -3667,7 +3667,7 @@
 qla1280_req_pkt(struct scsi_qla_host *ha)
 {
 	struct device_reg *reg = ha->iobase;
-	request_t *pkt = 0;
+	request_t *pkt = NULL;
 	int cnt;
 	uint32_t timer;
 
@@ -3774,7 +3774,7 @@
 {
 	struct device_reg *reg = ha->iobase;
 	struct response *pkt;
-	struct srb *sp = 0;
+	struct srb *sp = NULL;
 	uint16_t mailbox[MAILBOX_REGISTER_COUNT];
 	uint16_t *wptr;
 	uint32_t index;
@@ -3832,11 +3832,11 @@
 				if (index < MAX_OUTSTANDING_COMMANDS)
 					sp = ha->outstanding_cmds[index];
 				else
-					sp = 0;
+					sp = NULL;
 
 				if (sp) {
 					/* Free outstanding command slot. */
-					ha->outstanding_cmds[index] = 0;
+					ha->outstanding_cmds[index] = NULL;
 
 					/* Save ISP completion status */
 					CMD_RESULT(sp->cmd) = 0;
@@ -4095,7 +4095,7 @@
 	}
 
 	/* Free outstanding command slot. */
-	ha->outstanding_cmds[handle] = 0;
+	ha->outstanding_cmds[handle] = NULL;
 
 	cmd = sp->cmd;
 
@@ -4188,11 +4188,11 @@
 	if (handle < MAX_OUTSTANDING_COMMANDS)
 		sp = ha->outstanding_cmds[handle];
 	else
-		sp = 0;
+		sp = NULL;
 
 	if (sp) {
 		/* Free outstanding command slot. */
-		ha->outstanding_cmds[handle] = 0;
+		ha->outstanding_cmds[handle] = NULL;
 
 		/* Bad payload or header */
 		if (pkt->entry_status & (BIT_3 + BIT_2)) {
diff -urN linux-2.6.8-rc2/drivers/scsi/qla2xxx/qla_isr.c linux-2.6.8-rc3/drivers/scsi/qla2xxx/qla_isr.c
--- linux-2.6.8-rc2/drivers/scsi/qla2xxx/qla_isr.c	2004-08-03 15:21:09.424606597 -0700
+++ linux-2.6.8-rc3/drivers/scsi/qla2xxx/qla_isr.c	2004-08-03 15:21:53.651420876 -0700
@@ -686,7 +686,7 @@
 	sp = ha->outstanding_cmds[index];
 	if (sp) {
 		/* Free outstanding command slot. */
-		ha->outstanding_cmds[index] = 0;
+		ha->outstanding_cmds[index] = NULL;
 
 		if (ha->actthreads)
 			ha->actthreads--;
@@ -836,7 +836,7 @@
 	/* Validate handle. */
 	if (pkt->handle < MAX_OUTSTANDING_COMMANDS) {
 		sp = ha->outstanding_cmds[pkt->handle];
-		ha->outstanding_cmds[pkt->handle] = 0;
+		ha->outstanding_cmds[pkt->handle] = NULL;
 	} else
 		sp = NULL;
 
@@ -1320,7 +1320,7 @@
 
 	if (sp) {
 		/* Free outstanding command slot. */
-		ha->outstanding_cmds[pkt->handle] = 0;
+		ha->outstanding_cmds[pkt->handle] = NULL;
 		if (ha->actthreads)
 			ha->actthreads--;
 		sp->lun_queue->out_cnt--;
@@ -1383,7 +1383,7 @@
 	CMD_ENTRY_STATUS(sp->cmd) = pkt->entry_status;
 
 	/* Free outstanding command slot. */
-	ha->outstanding_cmds[pkt->handle1] = 0;
+	ha->outstanding_cmds[pkt->handle1] = NULL;
 
 	add_to_done_queue(ha, sp);
 }
diff -urN linux-2.6.8-rc2/drivers/scsi/st.c linux-2.6.8-rc3/drivers/scsi/st.c
--- linux-2.6.8-rc2/drivers/scsi/st.c	2004-08-03 15:21:09.480608891 -0700
+++ linux-2.6.8-rc3/drivers/scsi/st.c	2004-08-03 15:21:54.139440896 -0700
@@ -3974,7 +3974,7 @@
 	for (i = 0; i < st_dev_max; i++) {
 		tpnt = scsi_tapes[i];
 		if (tpnt != NULL && tpnt->device == SDp) {
-			scsi_tapes[i] = 0;
+			scsi_tapes[i] = NULL;
 			st_nr_dev--;
 			write_unlock(&st_dev_arr_lock);
 			devfs_unregister_tape(tpnt->disk->number);
diff -urN linux-2.6.8-rc2/drivers/scsi/sym53c8xx_2/sym_fw.c linux-2.6.8-rc3/drivers/scsi/sym53c8xx_2/sym_fw.c
--- linux-2.6.8-rc2/drivers/scsi/sym53c8xx_2/sym_fw.c	2004-06-15 22:20:21.000000000 -0700
+++ linux-2.6.8-rc3/drivers/scsi/sym53c8xx_2/sym_fw.c	2004-08-03 15:21:54.150441347 -0700
@@ -383,7 +383,7 @@
 		return &sym_fw1;
 #endif
 	else
-		return 0;
+		return NULL;
 }
 
 /*
diff -urN linux-2.6.8-rc2/drivers/scsi/sym53c8xx_2/sym_glue.c linux-2.6.8-rc3/drivers/scsi/sym53c8xx_2/sym_glue.c
--- linux-2.6.8-rc2/drivers/scsi/sym53c8xx_2/sym_glue.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/drivers/scsi/sym53c8xx_2/sym_glue.c	2004-08-03 15:21:54.152441429 -0700
@@ -868,7 +868,7 @@
 	}
 
 	/* Revert everything */
-	SYM_UCMD_PTR(cmd)->eh_wait = 0;
+	SYM_UCMD_PTR(cmd)->eh_wait = NULL;
 	cmd->scsi_done = ep->old_done;
 
 	/* Wake up the eh thread if it wants to sleep */
@@ -965,7 +965,7 @@
 
 	/* On error, restore everything and cross fingers :) */
 	if (sts) {
-		SYM_UCMD_PTR(cmd)->eh_wait = 0;
+		SYM_UCMD_PTR(cmd)->eh_wait = NULL;
 		cmd->scsi_done = ep->old_done;
 		to_do = SYM_EH_DO_IGNORE;
 	}
@@ -1568,7 +1568,7 @@
 			char **start, off_t offset, int length, int func)
 {
 	struct host_data *host_data;
-	struct sym_hcb *np = 0;
+	struct sym_hcb *np = NULL;
 	int retv;
 
 	host_data = (struct host_data *) host->hostdata;
@@ -1915,7 +1915,7 @@
 static struct sym_driver_setup
 	sym_driver_safe_setup __initdata = SYM_LINUX_DRIVER_SAFE_SETUP;
 #ifdef	MODULE
-char *sym53c8xx = 0;	/* command line passed by insmod */
+char *sym53c8xx;	/* command line passed by insmod */
 MODULE_PARM(sym53c8xx, "s");
 #endif
 
diff -urN linux-2.6.8-rc2/drivers/scsi/sym53c8xx_2/sym_glue.h linux-2.6.8-rc3/drivers/scsi/sym53c8xx_2/sym_glue.h
--- linux-2.6.8-rc2/drivers/scsi/sym53c8xx_2/sym_glue.h	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/drivers/scsi/sym53c8xx_2/sym_glue.h	2004-08-03 15:21:54.153441470 -0700
@@ -481,7 +481,7 @@
 
 static __inline m_addr_t sym_m_get_dma_mem_cluster(m_pool_p mp, m_vtob_p vbp)
 {
-	void *vaddr = 0;
+	void *vaddr = NULL;
 	dma_addr_t baddr = 0;
 
 	vaddr = pci_alloc_consistent(mp->dev_dmat,SYM_MEM_CLUSTER_SIZE, &baddr);
diff -urN linux-2.6.8-rc2/drivers/scsi/sym53c8xx_2/sym_hipd.c linux-2.6.8-rc3/drivers/scsi/sym53c8xx_2/sym_hipd.c
--- linux-2.6.8-rc2/drivers/scsi/sym53c8xx_2/sym_hipd.c	2004-06-15 22:18:37.000000000 -0700
+++ linux-2.6.8-rc3/drivers/scsi/sym53c8xx_2/sym_hipd.c	2004-08-03 15:21:54.207443686 -0700
@@ -1302,7 +1302,7 @@
 	} else {
 		script_ofs	= dsp;
 		script_size	= 0;
-		script_base	= 0;
+		script_base	= NULL;
 		script_name	= "mem";
 	}
 
@@ -1440,7 +1440,7 @@
 		return chip;
 	}
 
-	return 0;
+	return NULL;
 }
 
 #if SYM_CONF_DMA_ADDRESSING_MODE == 2
@@ -2490,7 +2490,7 @@
 	 *  try to find the interrupted script command,
 	 *  and the address at which to continue.
 	 */
-	vdsp	= 0;
+	vdsp	= NULL;
 	nxtdsp	= 0;
 	if	(dsp >  np->scripta_ba &&
 		 dsp <= np->scripta_ba + np->scripta_sz) {
@@ -3400,7 +3400,7 @@
 		 *  we are not in race.
 		 */
 		i = 0;
-		cp = 0;
+		cp = NULL;
 		FOR_EACH_QUEUED_ELEMENT(&np->busy_ccbq, qp) {
 			cp = sym_que_entry(qp, struct sym_ccb, link_ccbq);
 			if (cp->host_status != HS_BUSY &&
@@ -3516,7 +3516,7 @@
 		 *  abort for this target.
 		 */
 		i = 0;
-		cp = 0;
+		cp = NULL;
 		FOR_EACH_QUEUED_ELEMENT(&np->busy_ccbq, qp) {
 			cp = sym_que_entry(qp, struct sym_ccb, link_ccbq);
 			if (cp->host_status != HS_DISCONNECT)
@@ -3698,7 +3698,7 @@
 	else if (dp_scr == SCRIPTA_BA (np, pm1_data))
 		pm = &cp->phys.pm1;
 	else
-		pm = 0;
+		pm = NULL;
 
 	if (pm) {
 		dp_scr  = scr_to_cpu(pm->ret);
@@ -4946,7 +4946,7 @@
 	 *  used for negotiation, clear this info in the tcb.
 	 */
 	if (cp == tp->nego_cp)
-		tp->nego_cp = 0;
+		tp->nego_cp = NULL;
 
 #ifdef SYM_CONF_IARB_SUPPORT
 	/*
@@ -4965,7 +4965,7 @@
 	/*
 	 *  Make this CCB available.
 	 */
-	cp->cam_ccb = 0;
+	cp->cam_ccb = NULL;
 	cp->host_status = HS_IDLE;
 	sym_remque(&cp->link_ccbq);
 	sym_insque_head(&cp->link_ccbq, &np->free_ccbq);
@@ -4997,7 +4997,7 @@
  */
 static ccb_p sym_alloc_ccb(hcb_p np)
 {
-	ccb_p cp = 0;
+	ccb_p cp = NULL;
 	int hcode;
 
 	/*
@@ -5005,7 +5005,7 @@
 	 *  queue to the controller.
 	 */
 	if (np->actccbs >= SYM_CONF_MAX_START)
-		return 0;
+		return NULL;
 
 	/*
 	 *  Allocate memory for this CCB.
@@ -5076,7 +5076,7 @@
 			sym_mfree_dma(cp->sns_bbuf,SYM_SNS_BBUF_LEN,"SNS_BBUF");
 		sym_mfree_dma(cp, sizeof(*cp), "CCB");
 	}
-	return 0;
+	return NULL;
 }
 
 /*
@@ -5134,7 +5134,7 @@
 	 *  allocation for not probed LUNs.
 	 */
 	if (!sym_is_bit(tp->lun_map, ln))
-		return 0;
+		return NULL;
 
 	/*
 	 *  Initialize the target control block if not yet.
@@ -5242,7 +5242,7 @@
 	lp->cb_tags = sym_calloc(SYM_CONF_MAX_TASK, "CB_TAGS");
 	if (!lp->cb_tags) {
 		sym_mfree_dma(lp->itlq_tbl, SYM_CONF_MAX_TASK*4, "ITLQ_TBL");
-		lp->itlq_tbl = 0;
+		lp->itlq_tbl = NULL;
 		goto fail;
 	}
 
@@ -5471,7 +5471,7 @@
 	/*
 	 *  Look up our CCB control block.
 	 */
-	cp = 0;
+	cp = NULL;
 	FOR_EACH_QUEUED_ELEMENT(&np->busy_ccbq, qp) {
 		ccb_p cp2 = sym_que_entry(qp, struct sym_ccb, link_ccbq);
 		if (cp2->cam_ccb == ccb) {
diff -urN linux-2.6.8-rc2/drivers/scsi/sym53c8xx_2/sym_hipd.h linux-2.6.8-rc3/drivers/scsi/sym53c8xx_2/sym_hipd.h
--- linux-2.6.8-rc2/drivers/scsi/sym53c8xx_2/sym_hipd.h	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/drivers/scsi/sym53c8xx_2/sym_hipd.h	2004-08-03 15:21:54.238444957 -0700
@@ -613,10 +613,10 @@
  *  LUN(s) > 0.
  */
 #if SYM_CONF_MAX_LUN <= 1
-#define sym_lp(np, tp, lun) (!lun) ? (tp)->lun0p : 0
+#define sym_lp(np, tp, lun) (!lun) ? (tp)->lun0p : NULL
 #else
 #define sym_lp(np, tp, lun) \
-	(!lun) ? (tp)->lun0p : (tp)->lunmp ? (tp)->lunmp[(lun)] : 0
+	(!lun) ? (tp)->lun0p : (tp)->lunmp ? (tp)->lunmp[(lun)] : NULL
 #endif
 
 /*
diff -urN linux-2.6.8-rc2/drivers/scsi/sym53c8xx_2/sym_malloc.c linux-2.6.8-rc3/drivers/scsi/sym53c8xx_2/sym_malloc.c
--- linux-2.6.8-rc2/drivers/scsi/sym53c8xx_2/sym_malloc.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/drivers/scsi/sym53c8xx_2/sym_malloc.c	2004-08-03 15:21:54.239444998 -0700
@@ -83,7 +83,7 @@
 	m_link_p h = mp->h;
 
 	if (size > SYM_MEM_CLUSTER_SIZE)
-		return 0;
+		return NULL;
 
 	while (size > s) {
 		s <<= 1;
@@ -95,7 +95,7 @@
 		if (s == SYM_MEM_CLUSTER_SIZE) {
 			h[j].next = (m_link_p) M_GET_MEM_CLUSTER();
 			if (h[j].next)
-				h[j].next->next = 0;
+				h[j].next->next = NULL;
 			break;
 		}
 		++j;
@@ -108,7 +108,7 @@
 			j -= 1;
 			s >>= 1;
 			h[j].next = (m_link_p) (a+s);
-			h[j].next->next = 0;
+			h[j].next->next = NULL;
 		}
 	}
 #ifdef DEBUG
@@ -225,10 +225,10 @@
 
 #ifdef	SYM_MEM_FREE_UNUSED
 static struct sym_m_pool mp0 =
-	{0, ___mp0_get_mem_cluster, ___mp0_free_mem_cluster};
+	{NULL, ___mp0_get_mem_cluster, ___mp0_free_mem_cluster};
 #else
 static struct sym_m_pool mp0 =
-	{0, ___mp0_get_mem_cluster};
+	{NULL, ___mp0_get_mem_cluster};
 #endif
 
 /*
@@ -310,7 +310,7 @@
 /* Create a new memory DMAable pool (when fetch failed) */
 static m_pool_p ___cre_dma_pool(m_pool_ident_t dev_dmat)
 {
-	m_pool_p mp = 0;
+	m_pool_p mp = NULL;
 
 	mp = __sym_calloc(&mp0, sizeof(*mp), "MPOOL");
 	if (mp) {
@@ -327,7 +327,7 @@
 	}
 	if (mp)
 		__sym_mfree(&mp0, mp, sizeof(*mp), "MPOOL");
-	return 0;
+	return NULL;
 }
 
 #ifdef	SYM_MEM_FREE_UNUSED
@@ -352,7 +352,7 @@
 void *__sym_calloc_dma_unlocked(m_pool_ident_t dev_dmat, int size, char *name)
 {
 	m_pool_p mp;
-	void *m = 0;
+	void *m = NULL;
 
 	mp = ___get_dma_pool(dev_dmat);
 	if (!mp)
@@ -392,7 +392,7 @@
 {
 	m_pool_p mp;
 	int hc = VTOB_HASH_CODE(m);
-	m_vtob_p vp = 0;
+	m_vtob_p vp = NULL;
 	m_addr_t a = ((m_addr_t) m) & ~SYM_MEM_CLUSTER_MASK;
 
 	mp = ___get_dma_pool(dev_dmat);
diff -urN linux-2.6.8-rc2/drivers/scsi/sym53c8xx_2/sym_misc.h linux-2.6.8-rc3/drivers/scsi/sym53c8xx_2/sym_misc.h
--- linux-2.6.8-rc2/drivers/scsi/sym53c8xx_2/sym_misc.h	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/drivers/scsi/sym53c8xx_2/sym_misc.h	2004-08-03 15:21:54.240445039 -0700
@@ -151,7 +151,7 @@
 	if (elem != head)
 		__sym_que_del(head, elem->flink);
 	else
-		elem = 0;
+		elem = NULL;
 	return elem;
 }
 
diff -urN linux-2.6.8-rc2/drivers/scsi/sym53c8xx_2/sym_nvram.c linux-2.6.8-rc3/drivers/scsi/sym53c8xx_2/sym_nvram.c
--- linux-2.6.8-rc2/drivers/scsi/sym53c8xx_2/sym_nvram.c	2004-06-15 22:19:36.000000000 -0700
+++ linux-2.6.8-rc3/drivers/scsi/sym53c8xx_2/sym_nvram.c	2004-08-03 15:21:54.242445121 -0700
@@ -330,7 +330,7 @@
 			    u_char *gpcntl)
 {
 	OUTB (nc_gpcntl, *gpcntl & 0xfe);
-	S24C16_do_bit(np, 0, write_bit, gpreg);
+	S24C16_do_bit(np, NULL, write_bit, gpreg);
 	OUTB (nc_gpcntl, *gpcntl);
 }
 
@@ -356,7 +356,7 @@
 	int x;
 	
 	for (x = 0; x < 8; x++)
-		S24C16_do_bit(np, 0, (write_data >> (7 - x)) & 0x01, gpreg);
+		S24C16_do_bit(np, NULL, (write_data >> (7 - x)) & 0x01, gpreg);
 		
 	S24C16_read_ack(np, ack_data, gpreg, gpcntl);
 }
diff -urN linux-2.6.8-rc2/drivers/scsi/sym53c8xx_comm.h linux-2.6.8-rc3/drivers/scsi/sym53c8xx_comm.h
--- linux-2.6.8-rc2/drivers/scsi/sym53c8xx_comm.h	2004-08-03 15:21:09.485609096 -0700
+++ linux-2.6.8-rc3/drivers/scsi/sym53c8xx_comm.h	2004-08-03 15:21:54.245445245 -0700
@@ -210,7 +210,7 @@
 	if (elem != head)
 		__xpt_que_del(head, elem->flink);
 	else
-		elem = 0;
+		elem = NULL;
 	return elem;
 }
 
@@ -375,7 +375,7 @@
 	m_link_s *h = mp->h;
 
 	if (size > (PAGE_SIZE << MEMO_PAGE_ORDER))
-		return 0;
+		return NULL;
 
 	while (size > s) {
 		s <<= 1;
@@ -387,7 +387,7 @@
 		if (s == (PAGE_SIZE << MEMO_PAGE_ORDER)) {
 			h[j].next = (m_link_s *) M_GETP();
 			if (h[j].next)
-				h[j].next->next = 0;
+				h[j].next->next = NULL;
 			break;
 		}
 		++j;
@@ -400,7 +400,7 @@
 			j -= 1;
 			s >>= 1;
 			h[j].next = (m_link_s *) (a+s);
-			h[j].next->next = 0;
+			h[j].next->next = NULL;
 		}
 	}
 #ifdef DEBUG
@@ -503,7 +503,7 @@
 	--mp->nump;
 }
 
-static m_pool_s mp0 = {0, ___mp0_getp, ___mp0_freep};
+static m_pool_s mp0 = {NULL, ___mp0_getp, ___mp0_freep};
 
 /*
  * DMAable pools.
@@ -595,7 +595,7 @@
 {
 	u_long flags;
 	struct m_pool *mp;
-	void *m = 0;
+	void *m = NULL;
 
 	NCR_LOCK_DRIVER(flags);
 	mp = ___get_dma_pool(bush);
@@ -629,7 +629,7 @@
 	u_long flags;
 	m_pool_s *mp;
 	int hc = VTOB_HASH_CODE(m);
-	m_vtob_s *vp = 0;
+	m_vtob_s *vp = NULL;
 	m_addr_t a = ((m_addr_t) m) & ~MEMO_CLUSTER_MASK;
 
 	NCR_LOCK_DRIVER(flags);
diff -urN linux-2.6.8-rc2/drivers/scsi/tmscsim.c linux-2.6.8-rc3/drivers/scsi/tmscsim.c
--- linux-2.6.8-rc2/drivers/scsi/tmscsim.c	2004-08-03 15:21:09.494609465 -0700
+++ linux-2.6.8-rc3/drivers/scsi/tmscsim.c	2004-08-03 15:21:54.270446270 -0700
@@ -1215,7 +1215,7 @@
     pdev = pACB->pdev;
     pci_read_config_word(pdev, PCI_STATUS, &pstat);
     printk ("DC390: Register dump: PCI Status: %04x\n", pstat);
-    printk ("DC390: In case of driver trouble read linux/Documentation/scsi/tmscsim.txt\n");
+    printk ("DC390: In case of driver trouble read Documentation/scsi/tmscsim.txt\n");
 }
 
 
diff -urN linux-2.6.8-rc2/drivers/scsi/ultrastor.c linux-2.6.8-rc3/drivers/scsi/ultrastor.c
--- linux-2.6.8-rc2/drivers/scsi/ultrastor.c	2004-08-03 15:21:09.498609628 -0700
+++ linux-2.6.8-rc3/drivers/scsi/ultrastor.c	2004-08-03 15:21:54.390451193 -0700
@@ -948,9 +948,9 @@
 	return SCSI_ABORT_NOT_RUNNING;
 
     if (config.mscp[mscp_index].SCint != SCpnt) panic("Bad abort");
-    config.mscp[mscp_index].SCint = 0;
+    config.mscp[mscp_index].SCint = NULL;
     done = config.mscp[mscp_index].done;
-    config.mscp[mscp_index].done = 0;
+    config.mscp[mscp_index].done = NULL;
     SCpnt->result = DID_ABORT << 16;
     
     /* Take the host lock to guard against scsi layer re-entry */
@@ -1000,9 +1000,9 @@
 	  {
 	    config.mscp[i].SCint->result = DID_RESET << 16;
 	    config.mscp[i].done(config.mscp[i].SCint);
-	    config.mscp[i].done = 0;
+	    config.mscp[i].done = NULL;
 	  }
-	config.mscp[i].SCint = 0;
+	config.mscp[i].SCint = NULL;
       }
 #endif
 
@@ -1083,7 +1083,7 @@
 	if (icm_status == 3) {
 	    void (*done)(Scsi_Cmnd *) = mscp->done;
 	    if (done) {
-		mscp->done = 0;
+		mscp->done = NULL;
 		mscp->SCint->result = DID_ABORT << 16;
 		done(mscp->SCint);
 	    }
@@ -1114,7 +1114,7 @@
        once we call done, we may get another command queued before this
        interrupt service routine can return. */
     done = mscp->done;
-    mscp->done = 0;
+    mscp->done = NULL;
 
     /* Let the higher levels know that we're done */
     switch (mscp->adapter_status)
@@ -1138,7 +1138,7 @@
 
     SCtmp->result = status | mscp->target_status;
 
-    SCtmp->host_scribble = 0;
+    SCtmp->host_scribble = NULL;
 
     /* Free up mscp block for next command */
 #if ULTRASTOR_MAX_CMDS == 1
diff -urN linux-2.6.8-rc2/drivers/serial/Kconfig linux-2.6.8-rc3/drivers/serial/Kconfig
--- linux-2.6.8-rc2/drivers/serial/Kconfig	2004-08-03 15:21:09.513610243 -0700
+++ linux-2.6.8-rc3/drivers/serial/Kconfig	2004-08-03 15:21:54.621460670 -0700
@@ -10,6 +10,7 @@
 # The new 8250/16550 serial drivers
 config SERIAL_8250
 	tristate "8250/16550 and compatible serial support"
+	depends on (BROKEN || !SPARC64)
 	select SERIAL_CORE
 	---help---
 	  This selects whether you want to include the driver for the standard
@@ -686,4 +687,31 @@
 		controller serial port as your console (you want this!),
 		say Y.  Otherwise, say N.
 
+config SERIAL_MPC52xx
+	tristate "Freescale MPC52xx family PSC serial support"
+	depends on PPC_MPC52xx
+	select SERIAL_CORE
+	help
+	  This drivers support the MPC52xx PSC serial ports. If you would
+	  like to use them, you must answer Y or M to this option. Not that
+	  for use as console, it must be included in kernel and not as a
+	  module.
+
+config SERIAL_MPC52xx_CONSOLE
+	bool "Console on a Freescale MPC52xx family PSC serial port"
+	depends on SERIAL_MPC52xx=y
+	select SERIAL_CORE_CONSOLE
+	help
+	  Select this options if you'd like to use one of the PSC serial port
+	  of the Freescale MPC52xx family as a console.
+
+config SERIAL_MPC52xx_CONSOLE_BAUD
+	int "Freescale MPC52xx family PSC serial port baud"
+	depends on SERIAL_MPC52xx_CONSOLE=y
+	default "9600"
+	help
+	  Select the MPC52xx console baud rate.
+	  This value is only used if the bootloader doesn't pass in the
+	  console baudrate
+
 endmenu
diff -urN linux-2.6.8-rc2/drivers/serial/Makefile linux-2.6.8-rc3/drivers/serial/Makefile
--- linux-2.6.8-rc2/drivers/serial/Makefile	2004-08-03 15:21:09.514610284 -0700
+++ linux-2.6.8-rc3/drivers/serial/Makefile	2004-08-03 15:21:54.622460711 -0700
@@ -40,3 +40,4 @@
 obj-$(CONFIG_SERIAL_BAST_SIO) += bast_sio.o
 obj-$(CONFIG_SERIAL_SGI_L1_CONSOLE) += sn_console.o
 obj-$(CONFIG_SERIAL_CPM) += cpm_uart/
+obj-$(CONFIG_SERIAL_MPC52xx) += mpc52xx_uart.o
diff -urN linux-2.6.8-rc2/drivers/serial/cpm_uart/cpm_uart_core.c linux-2.6.8-rc3/drivers/serial/cpm_uart/cpm_uart_core.c
--- linux-2.6.8-rc2/drivers/serial/cpm_uart/cpm_uart_core.c	2004-08-03 15:21:09.520610530 -0700
+++ linux-2.6.8-rc3/drivers/serial/cpm_uart/cpm_uart_core.c	2004-08-03 15:21:54.664462434 -0700
@@ -64,8 +64,9 @@
 /**************************************************************/
 
 static int  cpm_uart_tx_pump(struct uart_port *port);
-static void cpm_uart_init_smc(struct uart_cpm_port *pinfo, int bits, u16 cval);
-static void cpm_uart_init_scc(struct uart_cpm_port *pinfo, int sbits, u16 sval);
+static void cpm_uart_init_smc(struct uart_cpm_port *pinfo);
+static void cpm_uart_init_scc(struct uart_cpm_port *pinfo);
+static void cpm_uart_initbd(struct uart_cpm_port *pinfo);
 
 /**************************************************************/
 
@@ -133,10 +134,6 @@
 
 	pr_debug("CPM uart[%d]:start tx\n", port->line);
 
-	/* if in the middle of discarding return */
-	if (IS_DISCARDING(pinfo))
-		return;
-
 	if (IS_SMC(pinfo)) {
 		if (smcp->smc_smcm & SMCM_TX)
 			return;
@@ -362,6 +359,7 @@
 static int cpm_uart_startup(struct uart_port *port)
 {
 	int retval;
+	struct uart_cpm_port *pinfo = (struct uart_cpm_port *)port;
 
 	pr_debug("CPM uart[%d]:startup\n", port->line);
 
@@ -370,6 +368,14 @@
 	if (retval)
 		return retval;
 
+	/* Startup rx-int */
+	if (IS_SMC(pinfo)) {
+		pinfo->smcp->smc_smcm |= SMCM_RX;
+		pinfo->smcp->smc_smcmr |= SMCMR_REN;
+	} else {
+		pinfo->sccp->scc_sccm |= UART_SCCM_RX;
+	}
+
 	return 0;
 }
 
@@ -400,7 +406,8 @@
 		}
 
 		/* Shut them really down and reinit buffer descriptors */
-		cpm_line_cr_cmd(line, CPM_CR_INIT_TRX);
+		cpm_line_cr_cmd(line, CPM_CR_STOP_TX);
+		cpm_uart_initbd(pinfo);
 	}
 }
 
@@ -409,57 +416,14 @@
 {
 	int baud;
 	unsigned long flags;
-	u16 cval, scval;
+	u16 cval, scval, prev_mode;
 	int bits, sbits;
 	struct uart_cpm_port *pinfo = (struct uart_cpm_port *)port;
-	int line = pinfo - cpm_uart_ports;
-	volatile cbd_t *bdp;
+	volatile smc_t *smcp = pinfo->smcp;
+	volatile scc_t *sccp = pinfo->sccp;
 
 	pr_debug("CPM uart[%d]:set_termios\n", port->line);
 
-	spin_lock_irqsave(&port->lock, flags);
-	/* disable uart interrupts */
-	if (IS_SMC(pinfo))
-		pinfo->smcp->smc_smcm &= ~(SMCM_RX | SMCM_TX);
-	else
-		pinfo->sccp->scc_sccm &= ~(UART_SCCM_TX | UART_SCCM_RX);
-	pinfo->flags |= FLAG_DISCARDING;
-	spin_unlock_irqrestore(&port->lock, flags);
-
-	/* if previous configuration exists wait for tx to finish */
-	if (pinfo->baud != 0 && pinfo->bits != 0) {
-
-		/* point to the last txed bd */
-		bdp = pinfo->tx_cur;
-		if (bdp == pinfo->tx_bd_base)
-			bdp = pinfo->tx_bd_base + (pinfo->tx_nrfifos - 1);
-		else
-			bdp--;
-
-		/* wait for it to be transmitted */
-		while ((bdp->cbd_sc & BD_SC_READY) != 0)
-			schedule();
-
-		/* and delay for the hw fifo to drain */
-		udelay((3 * 1000000 * pinfo->bits) / pinfo->baud);
-	}
-
-	spin_lock_irqsave(&port->lock, flags);
-
-	/* Send the CPM an initialize command. */
-	cpm_line_cr_cmd(line, CPM_CR_STOP_TX);
-
-	/* Stop uart */
-	if (IS_SMC(pinfo))
-		pinfo->smcp->smc_smcmr &= ~(SMCMR_REN | SMCMR_TEN);
-	else
-		pinfo->sccp->scc_gsmrl &= ~(SCC_GSMRL_ENR | SCC_GSMRL_ENT);
-
-	/* Send the CPM an initialize command. */
-	cpm_line_cr_cmd(line, CPM_CR_INIT_TRX);
-
-	spin_unlock_irqrestore(&port->lock, flags);
-
 	baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk / 16);
 
 	/* Character length programmed into the mode register is the
@@ -541,24 +505,24 @@
 	
 	spin_lock_irqsave(&port->lock, flags);
 
-	cpm_set_brg(pinfo->brg - 1, baud);
-
 	/* Start bit has not been added (so don't, because we would just
 	 * subtract it later), and we need to add one for the number of
 	 * stops bits (there is always at least one).
 	 */
 	bits++;
+	if (IS_SMC(pinfo)) {
+		/* Set the mode register.  We want to keep a copy of the
+		 * enables, because we want to put them back if they were
+		 * present.
+		 */
+		prev_mode = smcp->smc_smcmr;
+		smcp->smc_smcmr = smcr_mk_clen(bits) | cval | SMCMR_SM_UART;
+		smcp->smc_smcmr |= (prev_mode & (SMCMR_REN | SMCMR_TEN));
+	} else {
+		sccp->scc_psmr = (sbits << 12) | scval;
+	}
 
-	/* re-init */
-	if (IS_SMC(pinfo))
-		cpm_uart_init_smc(pinfo, bits, cval);
-	else
-		cpm_uart_init_scc(pinfo, sbits, scval);
-
-	pinfo->baud = baud;
-	pinfo->bits = bits;
-
-	pinfo->flags &= ~FLAG_DISCARDING;
+	cpm_set_brg(pinfo->brg - 1, baud);
 	spin_unlock_irqrestore(&port->lock, flags);
 
 }
@@ -661,44 +625,58 @@
 	return 1;
 }
 
-static void cpm_uart_init_scc(struct uart_cpm_port *pinfo, int bits, u16 scval)
+/*
+ * init buffer descriptors
+ */
+static void cpm_uart_initbd(struct uart_cpm_port *pinfo)
 {
-	int line = pinfo - cpm_uart_ports;
-	volatile scc_t *scp;
-	volatile scc_uart_t *sup;
+	int i;
 	u8 *mem_addr;
 	volatile cbd_t *bdp;
-	int i;
 
-	pr_debug("CPM uart[%d]:init_scc\n", pinfo->port.line);
-
-	scp = pinfo->sccp;
-	sup = pinfo->sccup;
+	pr_debug("CPM uart[%d]:initbd\n", pinfo->port.line);
 
 	/* Set the physical address of the host memory
 	 * buffers in the buffer descriptors, and the
 	 * virtual address for us to work with.
 	 */
-	pinfo->rx_cur = pinfo->rx_bd_base;
 	mem_addr = pinfo->mem_addr;
-	for (bdp = pinfo->rx_bd_base, i = 0; i < pinfo->rx_nrfifos; i++, bdp++) {
+	bdp = pinfo->rx_cur = pinfo->rx_bd_base;
+	for (i = 0; i < (pinfo->rx_nrfifos - 1); i++, bdp++) {
 		bdp->cbd_bufaddr = virt_to_bus(mem_addr);
-		bdp->cbd_sc = BD_SC_EMPTY | BD_SC_INTRPT | (i < (pinfo->rx_nrfifos - 1) ? 0 : BD_SC_WRAP);
+		bdp->cbd_sc = BD_SC_EMPTY | BD_SC_INTRPT;
 		mem_addr += pinfo->rx_fifosize;
 	}
+	
+	bdp->cbd_bufaddr = virt_to_bus(mem_addr);
+	bdp->cbd_sc = BD_SC_WRAP | BD_SC_EMPTY | BD_SC_INTRPT;
 
 	/* Set the physical address of the host memory
 	 * buffers in the buffer descriptors, and the
 	 * virtual address for us to work with.
 	 */
 	mem_addr = pinfo->mem_addr + L1_CACHE_ALIGN(pinfo->rx_nrfifos * pinfo->rx_fifosize);
-	pinfo->tx_cur = pinfo->tx_bd_base;
-	for (bdp = pinfo->tx_bd_base, i = 0; i < pinfo->tx_nrfifos; i++, bdp++) {
+	bdp = pinfo->tx_cur = pinfo->tx_bd_base;
+	for (i = 0; i < (pinfo->tx_nrfifos - 1); i++, bdp++) {
 		bdp->cbd_bufaddr = virt_to_bus(mem_addr);
-		bdp->cbd_sc = BD_SC_INTRPT | (i < (pinfo->tx_nrfifos - 1) ? 0 : BD_SC_WRAP);
+		bdp->cbd_sc = BD_SC_INTRPT;
 		mem_addr += pinfo->tx_fifosize;
-		bdp++;
 	}
+	
+	bdp->cbd_bufaddr = virt_to_bus(mem_addr);
+	bdp->cbd_sc = BD_SC_WRAP | BD_SC_INTRPT;
+}
+
+static void cpm_uart_init_scc(struct uart_cpm_port *pinfo)
+{
+	int line = pinfo - cpm_uart_ports;
+	volatile scc_t *scp;
+	volatile scc_uart_t *sup;
+
+	pr_debug("CPM uart[%d]:init_scc\n", pinfo->port.line);
+
+	scp = pinfo->sccp;
+	sup = pinfo->sccup;
 
 	/* Store address */
 	pinfo->sccup->scc_genscc.scc_rbase = (unsigned char *)pinfo->rx_bd_base - DPRAM_BASE;
@@ -742,52 +720,25 @@
 	    (SCC_GSMRL_MODE_UART | SCC_GSMRL_TDCR_16 | SCC_GSMRL_RDCR_16);
 
 	/* Enable rx interrupts  and clear all pending events.  */
-	scp->scc_sccm = UART_SCCM_RX;
+	scp->scc_sccm = 0;
 	scp->scc_scce = 0xffff;
 	scp->scc_dsr = 0x7e7e;
-	scp->scc_psmr = (bits << 12) | scval;
+	scp->scc_psmr = 0x3000;
 
 	scp->scc_gsmrl |= (SCC_GSMRL_ENR | SCC_GSMRL_ENT);
 }
 
-static void cpm_uart_init_smc(struct uart_cpm_port *pinfo, int bits, u16 cval)
+static void cpm_uart_init_smc(struct uart_cpm_port *pinfo)
 {
 	int line = pinfo - cpm_uart_ports;
 	volatile smc_t *sp;
 	volatile smc_uart_t *up;
-	volatile u8 *mem_addr;
-	volatile cbd_t *bdp;
-	int i;
 
 	pr_debug("CPM uart[%d]:init_smc\n", pinfo->port.line);
 
 	sp = pinfo->smcp;
 	up = pinfo->smcup;
 
-	/* Set the physical address of the host memory
-	 * buffers in the buffer descriptors, and the
-	 * virtual address for us to work with.
-	 */
-	mem_addr = pinfo->mem_addr;
-	pinfo->rx_cur = pinfo->rx_bd_base;
-	for (bdp = pinfo->rx_bd_base, i = 0; i < pinfo->rx_nrfifos; i++, bdp++) {
-		bdp->cbd_bufaddr = virt_to_bus(mem_addr);
-		bdp->cbd_sc = BD_SC_EMPTY | BD_SC_INTRPT | (i < (pinfo->rx_nrfifos - 1) ? 0 : BD_SC_WRAP);
-		mem_addr += pinfo->rx_fifosize;
-	}
-
-	/* Set the physical address of the host memory
-	 * buffers in the buffer descriptors, and the
-	 * virtual address for us to work with.
-	 */
-	mem_addr = pinfo->mem_addr + L1_CACHE_ALIGN(pinfo->rx_nrfifos * pinfo->rx_fifosize);
-	pinfo->tx_cur = pinfo->tx_bd_base;
-	for (bdp = pinfo->tx_bd_base, i = 0; i < pinfo->tx_nrfifos; i++, bdp++) {
-		bdp->cbd_bufaddr = virt_to_bus(mem_addr);
-		bdp->cbd_sc = BD_SC_INTRPT | (i < (pinfo->tx_nrfifos - 1) ? 0 : BD_SC_WRAP);
-		mem_addr += pinfo->tx_fifosize;
-	}
-
 	/* Store address */
 	pinfo->smcup->smc_rbase = (u_char *)pinfo->rx_bd_base - DPRAM_BASE;
 	pinfo->smcup->smc_tbase = (u_char *)pinfo->tx_bd_base - DPRAM_BASE;
@@ -804,11 +755,13 @@
 
 	cpm_line_cr_cmd(line, CPM_CR_INIT_TRX);
 
-	/* Set UART mode, according to the parameters */
-	sp->smc_smcmr = smcr_mk_clen(bits) | cval | SMCMR_SM_UART;
+	/* Set UART mode, 8 bit, no parity, one stop.
+	 * Enable receive and transmit.
+	 */
+	sp->smc_smcmr = smcr_mk_clen(9) | SMCMR_SM_UART;
 
 	/* Enable only rx interrupts clear all pending events. */
-	sp->smc_smcm = SMCM_RX;
+	sp->smc_smcm = 0;
 	sp->smc_smce = 0xff;
 
 	sp->smc_smcmr |= (SMCMR_REN | SMCMR_TEN);
@@ -836,10 +789,21 @@
 	if (pinfo->set_lineif)
 		pinfo->set_lineif(pinfo);
 
+	if (IS_SMC(pinfo)) {
+		pinfo->smcp->smc_smcm &= ~(SMCM_RX | SMCM_TX);
+		pinfo->smcp->smc_smcmr &= ~(SMCMR_REN | SMCMR_TEN);
+	} else {
+		pinfo->sccp->scc_sccm &= ~(UART_SCCM_TX | UART_SCCM_RX);
+		pinfo->sccp->scc_gsmrl &= ~(SCC_GSMRL_ENR | SCC_GSMRL_ENT);
+	}
+
 	ret = cpm_uart_allocbuf(pinfo, 0);
+
 	if (ret)
 		return ret;
 
+	cpm_uart_initbd(pinfo);
+
 	return 0;
 }
 
@@ -975,9 +939,6 @@
 	volatile cbd_t *bdp, *bdbase;
 	volatile unsigned char *cp;
 
-	if (IS_DISCARDING(pinfo))
-		return;
-
 	/* Get the address of the host memory buffer.
 	 */
 	bdp = pinfo->tx_cur;
@@ -1085,10 +1046,26 @@
 	if (pinfo->set_lineif)
 		pinfo->set_lineif(pinfo);
 
+	if (IS_SMC(pinfo)) {
+		pinfo->smcp->smc_smcm &= ~(SMCM_RX | SMCM_TX);
+		pinfo->smcp->smc_smcmr &= ~(SMCMR_REN | SMCMR_TEN);
+	} else {
+		pinfo->sccp->scc_sccm &= ~(UART_SCCM_TX | UART_SCCM_RX);
+		pinfo->sccp->scc_gsmrl &= ~(SCC_GSMRL_ENR | SCC_GSMRL_ENT);
+	}
+
 	ret = cpm_uart_allocbuf(pinfo, 1);
+
 	if (ret)
 		return ret;
 
+	cpm_uart_initbd(pinfo);
+
+	if (IS_SMC(pinfo))
+		cpm_uart_init_smc(pinfo);
+	else
+		cpm_uart_init_scc(pinfo);
+
 	uart_set_options(port, co, baud, parity, bits, flow);
 
 	return 0;
diff -urN linux-2.6.8-rc2/drivers/serial/cpm_uart/cpm_uart_cpm1.c linux-2.6.8-rc3/drivers/serial/cpm_uart/cpm_uart_cpm1.c
--- linux-2.6.8-rc2/drivers/serial/cpm_uart/cpm_uart_cpm1.c	2004-08-03 15:21:09.521610571 -0700
+++ linux-2.6.8-rc3/drivers/serial/cpm_uart/cpm_uart_cpm1.c	2004-08-03 15:21:54.677462967 -0700
@@ -130,20 +130,20 @@
 {
 	int dpmemsz, memsz;
 	u8 *dp_mem;
-	uint dp_addr;
+	uint dp_offset;
 	u8 *mem_addr;
-	dma_addr_t dma_addr;
+	dma_addr_t dma_addr = 0;
 
 	pr_debug("CPM uart[%d]:allocbuf\n", pinfo->port.line);
 
 	dpmemsz = sizeof(cbd_t) * (pinfo->rx_nrfifos + pinfo->tx_nrfifos);
-	dp_mem = m8xx_cpm_dpalloc(dpmemsz);
-	if (dp_mem == NULL) {
+	dp_offset = cpm_dpalloc(dpmemsz, 8);
+	if (IS_DPERR(dp_offset)) {
 		printk(KERN_ERR
 		       "cpm_uart_cpm1.c: could not allocate buffer descriptors\n");
 		return -ENOMEM;
 	}
-	dp_addr = m8xx_cpm_dpram_offset(dp_mem);
+	dp_mem = cpm_dpram_addr(dp_offset);
 
 	memsz = L1_CACHE_ALIGN(pinfo->rx_nrfifos * pinfo->rx_fifosize) +
 	    L1_CACHE_ALIGN(pinfo->tx_nrfifos * pinfo->tx_fifosize);
@@ -155,13 +155,13 @@
 					      GFP_KERNEL);
 
 	if (mem_addr == NULL) {
-		m8xx_cpm_dpfree(dp_mem);
+		cpm_dpfree(dp_offset);
 		printk(KERN_ERR
 		       "cpm_uart_cpm1.c: could not allocate coherent memory\n");
 		return -ENOMEM;
 	}
 
-	pinfo->dp_addr = dp_addr;
+	pinfo->dp_addr = dp_offset;
 	pinfo->mem_addr = mem_addr;
 	pinfo->dma_addr = dma_addr;
 
@@ -183,7 +183,7 @@
 					 pinfo->tx_fifosize), pinfo->mem_addr,
 			  pinfo->dma_addr);
 
-	m8xx_cpm_dpfree(m8xx_cpm_dpram_addr(pinfo->dp_addr));
+	cpm_dpfree(pinfo->dp_addr);
 }
 
 /* Setup any dynamic params in the uart desc */
diff -urN linux-2.6.8-rc2/drivers/serial/cpm_uart/cpm_uart_cpm1.h linux-2.6.8-rc3/drivers/serial/cpm_uart/cpm_uart_cpm1.h
--- linux-2.6.8-rc2/drivers/serial/cpm_uart/cpm_uart_cpm1.h	2004-08-03 15:21:09.521610571 -0700
+++ linux-2.6.8-rc3/drivers/serial/cpm_uart/cpm_uart_cpm1.h	2004-08-03 15:21:54.677462967 -0700
@@ -25,7 +25,7 @@
 
 static inline void cpm_set_brg(int brg, int baud)
 {
-	m8xx_cpm_setbrg(brg, baud);
+	cpm_setbrg(brg, baud);
 }
 
 static inline void cpm_set_scc_fcr(volatile scc_uart_t * sup)
diff -urN linux-2.6.8-rc2/drivers/serial/cpm_uart/cpm_uart_cpm2.c linux-2.6.8-rc3/drivers/serial/cpm_uart/cpm_uart_cpm2.c
--- linux-2.6.8-rc2/drivers/serial/cpm_uart/cpm_uart_cpm2.c	2004-08-03 15:21:09.523610653 -0700
+++ linux-2.6.8-rc3/drivers/serial/cpm_uart/cpm_uart_cpm2.c	2004-08-03 15:21:54.679463049 -0700
@@ -182,21 +182,21 @@
 {
 	int dpmemsz, memsz;
 	u8 *dp_mem;
-	uint dp_addr;
+	uint dp_offset;
 	u8 *mem_addr;
 	dma_addr_t dma_addr = 0;
 
 	pr_debug("CPM uart[%d]:allocbuf\n", pinfo->port.line);
 
 	dpmemsz = sizeof(cbd_t) * (pinfo->rx_nrfifos + pinfo->tx_nrfifos);
-	dp_mem = cpm2_dpalloc(dpmemsz, 8);
-	if (dp_mem == NULL) {
+	dp_offset = cpm_dpalloc(dpmemsz, 8);
+	if (IS_DPERR(dp_offset)) {
 		printk(KERN_ERR
-		       "cpm_uart_cpm1.c: could not allocate buffer descriptors\n");
+		       "cpm_uart_cpm.c: could not allocate buffer descriptors\n");
 		return -ENOMEM;
 	}
 
-	dp_addr = cpm2_dpram_offset(dp_mem);
+	dp_mem = cpm_dpram_addr(dp_offset);
 
 	memsz = L1_CACHE_ALIGN(pinfo->rx_nrfifos * pinfo->rx_fifosize) +
 	    L1_CACHE_ALIGN(pinfo->tx_nrfifos * pinfo->tx_fifosize);
@@ -207,13 +207,13 @@
 					      GFP_KERNEL);
 
 	if (mem_addr == NULL) {
-		cpm2_dpfree(dp_mem);
+		cpm_dpfree(dp_offset);
 		printk(KERN_ERR
-		       "cpm_uart_cpm1.c: could not allocate coherent memory\n");
+		       "cpm_uart_cpm.c: could not allocate coherent memory\n");
 		return -ENOMEM;
 	}
 
-	pinfo->dp_addr = dp_addr;
+	pinfo->dp_addr = dp_offset;
 	pinfo->mem_addr = mem_addr;
 	pinfo->dma_addr = dma_addr;
 
@@ -235,7 +235,7 @@
 					 pinfo->tx_fifosize), pinfo->mem_addr,
 			  pinfo->dma_addr);
 
-	cpm2_dpfree(&pinfo->dp_addr);
+	cpm_dpfree(pinfo->dp_addr);
 }
 
 /* Setup any dynamic params in the uart desc */
diff -urN linux-2.6.8-rc2/drivers/serial/cpm_uart/cpm_uart_cpm2.h linux-2.6.8-rc3/drivers/serial/cpm_uart/cpm_uart_cpm2.h
--- linux-2.6.8-rc2/drivers/serial/cpm_uart/cpm_uart_cpm2.h	2004-08-03 15:21:09.523610653 -0700
+++ linux-2.6.8-rc3/drivers/serial/cpm_uart/cpm_uart_cpm2.h	2004-08-03 15:21:54.680463090 -0700
@@ -25,7 +25,7 @@
 
 static inline void cpm_set_brg(int brg, int baud)
 {
-	cpm2_setbrg(brg, baud);
+	cpm_setbrg(brg, baud);
 }
 
 static inline void cpm_set_scc_fcr(volatile scc_uart_t * sup)
diff -urN linux-2.6.8-rc2/drivers/serial/mpc52xx_uart.c linux-2.6.8-rc3/drivers/serial/mpc52xx_uart.c
--- linux-2.6.8-rc2/drivers/serial/mpc52xx_uart.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/drivers/serial/mpc52xx_uart.c	2004-08-03 15:21:54.681463131 -0700
@@ -0,0 +1,869 @@
+/*
+ * drivers/serial/mpc52xx_uart.c
+ *
+ * Driver for the PSC of the Freescale MPC52xx PSCs configured as UARTs.
+ *
+ * FIXME According to the usermanual the status bits in the status register
+ * are only updated when the peripherals access the FIFO and not when the
+ * CPU access them. So since we use this bits to know when we stop writing
+ * and reading, they may not be updated in-time and a race condition may
+ * exists. But I haven't be able to prove this and I don't care. But if
+ * any problem arises, it might worth checking. The TX/RX FIFO Stats
+ * registers should be used in addition.
+ * Update: Actually, they seem updated ... At least the bits we use.
+ *
+ *
+ * Maintainer : Sylvain Munaut <tnt@246tNt.com>
+ * 
+ * Some of the code has been inspired/copied from the 2.4 code written
+ * by Dale Farnsworth <dfarnsworth@mvista.com>.
+ * 
+ * Copyright (C) 2004 Sylvain Munaut <tnt@246tNt.com>
+ * Copyright (C) 2003 MontaVista, Software, Inc.
+ * 
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2. This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+ 
+/* OCP Usage :
+ *
+ * This drivers uses the OCP model. To load the serial driver for one of the
+ * PSCs, just add this to the core_ocp table :
+ *
+ * {
+ * 	.vendor         = OCP_VENDOR_FREESCALE,
+ * 	.function       = OCP_FUNC_PSC_UART,
+ * 	.index          = 0,
+ * 	.paddr          = MPC52xx_PSC1,
+ * 	.irq            = MPC52xx_PSC1_IRQ,
+ * 	.pm             = OCP_CPM_NA,
+ * },
+ *
+ * This is for PSC1, replace the paddr and irq according to the PSC you want to
+ * use. The driver all necessary registers to place the PSC in uart mode without
+ * DCD. However, the pin multiplexing aren't changed and should be set either
+ * by the bootloader or in the platform init code.
+ * The index field must be equal to the PSC index ( e.g. 0 for PSC1, 1 for PSC2,
+ * and so on). So the PSC1 is mapped to /dev/ttyS0, PSC2 to /dev/ttyS1 and so
+ * on. But be warned, it's an ABSOLUTE REQUIREMENT ! This is needed mainly for
+ * the console code : without this 1:1 mapping, at early boot time, when we are
+ * parsing the kernel args console=ttyS?, we wouldn't know wich PSC it will be
+ * mapped to because OCP stuff is not yet initialized.
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/tty.h>
+#include <linux/serial.h>
+#include <linux/sysrq.h>
+#include <linux/console.h>
+
+#include <asm/delay.h>
+#include <asm/io.h>
+#include <asm/ocp.h>
+
+#include <asm/mpc52xx.h>
+#include <asm/mpc52xx_psc.h>
+
+#if defined(CONFIG_SERIAL_MPC52xx_CONSOLE) && defined(CONFIG_MAGIC_SYSRQ)
+#define SUPPORT_SYSRQ
+#endif
+
+#include <linux/serial_core.h>
+
+
+
+#define ISR_PASS_LIMIT 256	/* Max number of iteration in the interrupt */
+
+
+static struct uart_port mpc52xx_uart_ports[MPC52xx_PSC_MAXNUM];
+	/* Rem: - We use the read_status_mask as a shadow of
+	 *        psc->mpc52xx_psc_imr
+	 *      - It's important that is array is all zero on start as we
+	 *        use it to know if it's initialized or not ! If it's not sure
+	 *        it's cleared, then a memset(...,0,...) should be added to
+	 *        the console_init
+	 */
+
+#define PSC(port) ((struct mpc52xx_psc *)((port)->membase))
+
+
+/* Forward declaration of the interruption handling routine */
+static irqreturn_t mpc52xx_uart_int(int irq,void *dev_id,struct pt_regs *regs);
+
+
+/* Simple macro to test if a port is console or not. This one is taken
+ * for serial_core.c and maybe should be moved to serial_core.h ? */
+#ifdef CONFIG_SERIAL_CORE_CONSOLE
+#define uart_console(port)	((port)->cons && (port)->cons->index == (port)->line)
+#else
+#define uart_console(port)	(0)
+#endif
+
+
+/* ======================================================================== */
+/* UART operations                                                          */
+/* ======================================================================== */
+
+static unsigned int 
+mpc52xx_uart_tx_empty(struct uart_port *port)
+{
+	int status = in_be16(&PSC(port)->mpc52xx_psc_status);
+	return (status & MPC52xx_PSC_SR_TXEMP) ? TIOCSER_TEMT : 0;
+}
+
+static void 
+mpc52xx_uart_set_mctrl(struct uart_port *port, unsigned int mctrl)
+{
+	/* Not implemented */
+}
+
+static unsigned int 
+mpc52xx_uart_get_mctrl(struct uart_port *port)
+{
+	/* Not implemented */
+	return TIOCM_CTS | TIOCM_DSR | TIOCM_CAR;
+}
+
+static void 
+mpc52xx_uart_stop_tx(struct uart_port *port, unsigned int tty_stop)
+{
+	/* port->lock taken by caller */
+	port->read_status_mask &= ~MPC52xx_PSC_IMR_TXRDY;
+	out_be16(&PSC(port)->mpc52xx_psc_imr,port->read_status_mask);
+}
+
+static void 
+mpc52xx_uart_start_tx(struct uart_port *port, unsigned int tty_start)
+{
+	/* port->lock taken by caller */
+	port->read_status_mask |= MPC52xx_PSC_IMR_TXRDY;
+	out_be16(&PSC(port)->mpc52xx_psc_imr,port->read_status_mask);
+}
+
+static void 
+mpc52xx_uart_send_xchar(struct uart_port *port, char ch)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&port->lock, flags);
+	
+	port->x_char = ch;
+	if (ch) {
+		/* Make sure tx interrupts are on */
+		/* Truly necessary ??? They should be anyway */
+		port->read_status_mask |= MPC52xx_PSC_IMR_TXRDY;
+		out_be16(&PSC(port)->mpc52xx_psc_imr,port->read_status_mask);
+	}
+	
+	spin_unlock_irqrestore(&port->lock, flags);
+}
+
+static void
+mpc52xx_uart_stop_rx(struct uart_port *port)
+{
+	/* port->lock taken by caller */
+	port->read_status_mask &= ~MPC52xx_PSC_IMR_RXRDY;
+	out_be16(&PSC(port)->mpc52xx_psc_imr,port->read_status_mask);
+}
+
+static void
+mpc52xx_uart_enable_ms(struct uart_port *port)
+{
+	/* Not implemented */
+}
+
+static void
+mpc52xx_uart_break_ctl(struct uart_port *port, int ctl)
+{
+	unsigned long flags;
+	spin_lock_irqsave(&port->lock, flags);
+
+	if ( ctl == -1 )
+		out_8(&PSC(port)->command,MPC52xx_PSC_START_BRK);
+	else
+		out_8(&PSC(port)->command,MPC52xx_PSC_STOP_BRK);
+	
+	spin_unlock_irqrestore(&port->lock, flags);
+}
+
+static int
+mpc52xx_uart_startup(struct uart_port *port)
+{
+	struct mpc52xx_psc *psc = PSC(port);
+
+	/* Reset/activate the port, clear and enable interrupts */
+	out_8(&psc->command,MPC52xx_PSC_RST_RX);
+	out_8(&psc->command,MPC52xx_PSC_RST_TX);
+	
+	out_be32(&psc->sicr,0);	/* UART mode DCD ignored */
+
+	out_be16(&psc->mpc52xx_psc_clock_select, 0xdd00); /* /16 prescaler on */
+	
+	out_8(&psc->rfcntl, 0x00);
+	out_be16(&psc->rfalarm, 0x1ff);
+	out_8(&psc->tfcntl, 0x07);
+	out_be16(&psc->tfalarm, 0x80);
+
+	port->read_status_mask |= MPC52xx_PSC_IMR_RXRDY | MPC52xx_PSC_IMR_TXRDY;
+	out_be16(&psc->mpc52xx_psc_imr,port->read_status_mask);
+	
+	out_8(&psc->command,MPC52xx_PSC_TX_ENABLE);
+	out_8(&psc->command,MPC52xx_PSC_RX_ENABLE);
+		
+	return 0;
+}
+
+static void
+mpc52xx_uart_shutdown(struct uart_port *port)
+{
+	struct mpc52xx_psc *psc = PSC(port);
+	
+	/* Shut down the port, interrupt and all */
+	out_8(&psc->command,MPC52xx_PSC_RST_RX);
+	out_8(&psc->command,MPC52xx_PSC_RST_TX);
+	
+	port->read_status_mask = 0; 
+	out_be16(&psc->mpc52xx_psc_imr,port->read_status_mask);
+}
+
+static void 
+mpc52xx_uart_set_termios(struct uart_port *port, struct termios *new,
+                         struct termios *old)
+{
+	struct mpc52xx_psc *psc = PSC(port);
+	unsigned long flags;
+	unsigned char mr1, mr2;
+	unsigned short ctr;
+	unsigned int j, baud, quot;
+	
+	/* Prepare what we're gonna write */
+	mr1 = 0;
+	
+	switch (new->c_cflag & CSIZE) {
+		case CS5:	mr1 |= MPC52xx_PSC_MODE_5_BITS;
+				break;
+		case CS6:	mr1 |= MPC52xx_PSC_MODE_6_BITS;
+				break;
+		case CS7:	mr1 |= MPC52xx_PSC_MODE_7_BITS;
+				break;
+		case CS8:
+		default:	mr1 |= MPC52xx_PSC_MODE_8_BITS;
+	}
+
+	if (new->c_cflag & PARENB) {
+		mr1 |= (new->c_cflag & PARODD) ?
+			MPC52xx_PSC_MODE_PARODD : MPC52xx_PSC_MODE_PAREVEN;
+	} else
+		mr1 |= MPC52xx_PSC_MODE_PARNONE;
+	
+	
+	mr2 = 0;
+
+	if (new->c_cflag & CSTOPB)
+		mr2 |= MPC52xx_PSC_MODE_TWO_STOP;
+	else
+		mr2 |= ((new->c_cflag & CSIZE) == CS5) ?
+			MPC52xx_PSC_MODE_ONE_STOP_5_BITS :
+			MPC52xx_PSC_MODE_ONE_STOP;
+
+
+	baud = uart_get_baud_rate(port, new, old, 0, port->uartclk/16);
+	quot = uart_get_divisor(port, baud);
+	ctr = quot & 0xffff;
+	
+	/* Get the lock */
+	spin_lock_irqsave(&port->lock, flags);
+
+	/* Update the per-port timeout */
+	uart_update_timeout(port, new->c_cflag, baud);
+
+	/* Do our best to flush TX & RX, so we don't loose anything */
+	/* But we don't wait indefinitly ! */
+	j = 5000000;	/* Maximum wait */
+	/* FIXME Can't receive chars since set_termios might be called at early
+	 * boot for the console, all stuff is not yet ready to receive at that
+	 * time and that just makes the kernel oops */
+	/* while (j-- && mpc52xx_uart_int_rx_chars(port)); */
+	while (!(in_be16(&psc->mpc52xx_psc_status) & MPC52xx_PSC_SR_TXEMP) && 
+	       --j)
+		udelay(1);
+
+	if (!j)
+		printk(	KERN_ERR "mpc52xx_uart.c: "
+			"Unable to flush RX & TX fifos in-time in set_termios."
+			"Some chars may have been lost.\n" ); 
+
+	/* Reset the TX & RX */
+	out_8(&psc->command,MPC52xx_PSC_RST_RX);
+	out_8(&psc->command,MPC52xx_PSC_RST_TX);
+
+	/* Send new mode settings */
+	out_8(&psc->command,MPC52xx_PSC_SEL_MODE_REG_1);
+	out_8(&psc->mode,mr1);
+	out_8(&psc->mode,mr2);
+	out_8(&psc->ctur,ctr >> 8);
+	out_8(&psc->ctlr,ctr & 0xff);
+	
+	/* Reenable TX & RX */
+	out_8(&psc->command,MPC52xx_PSC_TX_ENABLE);
+	out_8(&psc->command,MPC52xx_PSC_RX_ENABLE);
+
+	/* We're all set, release the lock */
+	spin_unlock_irqrestore(&port->lock, flags);
+}
+
+static const char *
+mpc52xx_uart_type(struct uart_port *port)
+{
+	return port->type == PORT_MPC52xx ? "MPC52xx PSC" : NULL;
+}
+
+static void
+mpc52xx_uart_release_port(struct uart_port *port)
+{
+	if (port->flags & UPF_IOREMAP) { /* remapped by us ? */
+		iounmap(port->membase);
+		port->membase = NULL;
+	}
+}
+
+static int
+mpc52xx_uart_request_port(struct uart_port *port)
+{
+	if (port->flags & UPF_IOREMAP) /* Need to remap ? */
+		port->membase = ioremap(port->mapbase, sizeof(struct mpc52xx_psc));
+	
+	return port->membase != NULL ? 0 : -EBUSY;
+}
+
+static void
+mpc52xx_uart_config_port(struct uart_port *port, int flags)
+{
+	if ( (flags & UART_CONFIG_TYPE) &&
+	     (mpc52xx_uart_request_port(port) == 0) )
+	     	port->type = PORT_MPC52xx;
+}
+
+static int
+mpc52xx_uart_verify_port(struct uart_port *port, struct serial_struct *ser)
+{
+	if ( ser->type != PORT_UNKNOWN && ser->type != PORT_MPC52xx )
+		return -EINVAL;
+
+	if ( (ser->irq != port->irq) ||
+	     (ser->io_type != SERIAL_IO_MEM) ||
+	     (ser->baud_base != port->uartclk)  || 
+	     // FIXME Should check addresses/irq as well ?
+	     (ser->hub6 != 0 ) )
+		return -EINVAL;
+
+	return 0;
+}
+
+
+static struct uart_ops mpc52xx_uart_ops = {
+	.tx_empty	= mpc52xx_uart_tx_empty,
+	.set_mctrl	= mpc52xx_uart_set_mctrl,
+	.get_mctrl	= mpc52xx_uart_get_mctrl,
+	.stop_tx	= mpc52xx_uart_stop_tx,
+	.start_tx	= mpc52xx_uart_start_tx,
+	.send_xchar	= mpc52xx_uart_send_xchar,
+	.stop_rx	= mpc52xx_uart_stop_rx,
+	.enable_ms	= mpc52xx_uart_enable_ms,
+	.break_ctl	= mpc52xx_uart_break_ctl,
+	.startup	= mpc52xx_uart_startup,
+	.shutdown	= mpc52xx_uart_shutdown,
+	.set_termios	= mpc52xx_uart_set_termios,
+/*	.pm		= mpc52xx_uart_pm,		Not supported yet */
+/*	.set_wake	= mpc52xx_uart_set_wake,	Not supported yet */
+	.type		= mpc52xx_uart_type,
+	.release_port	= mpc52xx_uart_release_port,
+	.request_port	= mpc52xx_uart_request_port,
+	.config_port	= mpc52xx_uart_config_port,
+	.verify_port	= mpc52xx_uart_verify_port
+};
+
+	
+/* ======================================================================== */
+/* Interrupt handling                                                       */
+/* ======================================================================== */
+	
+static inline int
+mpc52xx_uart_int_rx_chars(struct uart_port *port, struct pt_regs *regs)
+{
+	struct tty_struct *tty = port->info->tty;
+	unsigned char ch;
+	unsigned short status;
+
+	/* While we can read, do so ! */
+	while ( (status = in_be16(&PSC(port)->mpc52xx_psc_status)) &
+	        MPC52xx_PSC_SR_RXRDY) {
+
+		/* If we are full, just stop reading */
+		if (tty->flip.count >= TTY_FLIPBUF_SIZE)
+			break;
+		
+		/* Get the char */
+		ch = in_8(&PSC(port)->mpc52xx_psc_buffer_8);
+
+		/* Handle sysreq char */
+#ifdef SUPPORT_SYSRQ
+		if (uart_handle_sysrq_char(port, ch, regs)) {
+			port->sysrq = 0;
+			continue;
+		}
+#endif
+
+		/* Store it */
+		*tty->flip.char_buf_ptr = ch;
+		*tty->flip.flag_buf_ptr = 0;
+		port->icount.rx++;
+	
+		if ( status & (MPC52xx_PSC_SR_PE |
+		               MPC52xx_PSC_SR_FE |
+		               MPC52xx_PSC_SR_RB |
+		               MPC52xx_PSC_SR_OE) ) {
+			
+			if (status & MPC52xx_PSC_SR_RB) {
+				*tty->flip.flag_buf_ptr = TTY_BREAK;
+				uart_handle_break(port);
+			} else if (status & MPC52xx_PSC_SR_PE)
+				*tty->flip.flag_buf_ptr = TTY_PARITY;
+			else if (status & MPC52xx_PSC_SR_FE)
+				*tty->flip.flag_buf_ptr = TTY_FRAME;
+			if (status & MPC52xx_PSC_SR_OE) {
+				/*
+				 * Overrun is special, since it's
+				 * reported immediately, and doesn't
+				 * affect the current character
+				 */
+				if (tty->flip.count < (TTY_FLIPBUF_SIZE-1)) {
+					tty->flip.flag_buf_ptr++;
+					tty->flip.char_buf_ptr++;
+					tty->flip.count++;
+				}
+				*tty->flip.flag_buf_ptr = TTY_OVERRUN;
+			}
+
+			/* Clear error condition */
+			out_8(&PSC(port)->command,MPC52xx_PSC_RST_ERR_STAT);
+
+		}
+
+		tty->flip.char_buf_ptr++;
+		tty->flip.flag_buf_ptr++;
+		tty->flip.count++;
+
+	}
+
+	tty_flip_buffer_push(tty);
+	
+	return in_be16(&PSC(port)->mpc52xx_psc_status) & MPC52xx_PSC_SR_RXRDY;
+}
+
+static inline int
+mpc52xx_uart_int_tx_chars(struct uart_port *port)
+{
+	struct circ_buf *xmit = &port->info->xmit;
+
+	/* Process out of band chars */
+	if (port->x_char) {
+		out_8(&PSC(port)->mpc52xx_psc_buffer_8, port->x_char);
+		port->icount.tx++;
+		port->x_char = 0;
+		return 1;
+	}
+
+	/* Nothing to do ? */
+	if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
+		mpc52xx_uart_stop_tx(port,0);
+		return 0;
+	}
+
+	/* Send chars */
+	while (in_be16(&PSC(port)->mpc52xx_psc_status) & MPC52xx_PSC_SR_TXRDY) {
+		out_8(&PSC(port)->mpc52xx_psc_buffer_8, xmit->buf[xmit->tail]);
+		xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
+		port->icount.tx++;
+		if (uart_circ_empty(xmit))
+			break;
+	}
+
+	/* Wake up */
+	if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+		uart_write_wakeup(port);
+
+	/* Maybe we're done after all */
+	if (uart_circ_empty(xmit)) {
+		mpc52xx_uart_stop_tx(port,0);
+		return 0;
+	}
+
+	return 1;
+}
+
+static irqreturn_t 
+mpc52xx_uart_int(int irq, void *dev_id, struct pt_regs *regs)
+{
+	struct uart_port *port = (struct uart_port *) dev_id;
+	unsigned long pass = ISR_PASS_LIMIT;
+	unsigned int keepgoing;
+	unsigned short status;
+	
+	if ( irq != port->irq ) {
+		printk( KERN_WARNING
+		        "mpc52xx_uart_int : " \
+		        "Received wrong int %d. Waiting for %d\n",
+		       irq, port->irq);
+		return IRQ_NONE;
+	}
+	
+	spin_lock(&port->lock);
+	
+	/* While we have stuff to do, we continue */
+	do {
+		/* If we don't find anything to do, we stop */
+		keepgoing = 0; 
+		
+		/* Read status */
+		status = in_be16(&PSC(port)->mpc52xx_psc_isr);
+		status &= port->read_status_mask;
+			
+		/* Do we need to receive chars ? */
+		/* For this RX interrupts must be on and some chars waiting */
+		if ( status & MPC52xx_PSC_IMR_RXRDY )
+			keepgoing |= mpc52xx_uart_int_rx_chars(port, regs);
+
+		/* Do we need to send chars ? */
+		/* For this, TX must be ready and TX interrupt enabled */
+		if ( status & MPC52xx_PSC_IMR_TXRDY )
+			keepgoing |= mpc52xx_uart_int_tx_chars(port);
+		
+		/* Limit number of iteration */
+		if ( !(--pass) )
+			keepgoing = 0;
+
+	} while (keepgoing);
+	
+	spin_unlock(&port->lock);
+	
+	return IRQ_HANDLED;
+}
+
+
+/* ======================================================================== */
+/* Console ( if applicable )                                                */
+/* ======================================================================== */
+
+#ifdef CONFIG_SERIAL_MPC52xx_CONSOLE
+
+static void __init
+mpc52xx_console_get_options(struct uart_port *port,
+                            int *baud, int *parity, int *bits, int *flow)
+{
+	struct mpc52xx_psc *psc = PSC(port);
+	unsigned char mr1;
+
+	/* Read the mode registers */
+	out_8(&psc->command,MPC52xx_PSC_SEL_MODE_REG_1);
+	mr1 = in_8(&psc->mode);
+	
+	/* CT{U,L}R are write-only ! */
+	*baud = __res.bi_baudrate ?
+		__res.bi_baudrate : CONFIG_SERIAL_MPC52xx_CONSOLE_BAUD;
+
+	/* Parse them */
+	switch (mr1 & MPC52xx_PSC_MODE_BITS_MASK) {
+		case MPC52xx_PSC_MODE_5_BITS:	*bits = 5; break;
+		case MPC52xx_PSC_MODE_6_BITS:	*bits = 6; break;
+		case MPC52xx_PSC_MODE_7_BITS:	*bits = 7; break;
+		case MPC52xx_PSC_MODE_8_BITS:
+		default:			*bits = 8;
+	}
+	
+	if (mr1 & MPC52xx_PSC_MODE_PARNONE)
+		*parity = 'n';
+	else
+		*parity = mr1 & MPC52xx_PSC_MODE_PARODD ? 'o' : 'e';
+}
+
+static void  
+mpc52xx_console_write(struct console *co, const char *s, unsigned int count)
+{
+	struct uart_port *port = &mpc52xx_uart_ports[co->index];
+	struct mpc52xx_psc *psc = PSC(port);
+	unsigned int i, j;
+	
+	/* Disable interrupts */
+	out_be16(&psc->mpc52xx_psc_imr, 0);
+
+	/* Wait the TX buffer to be empty */
+	j = 5000000;	/* Maximum wait */	
+	while (!(in_be16(&psc->mpc52xx_psc_status) & MPC52xx_PSC_SR_TXEMP) && 
+	       --j)
+		udelay(1);
+
+	/* Write all the chars */
+	for ( i=0 ; i<count ; i++ ) {
+	
+		/* Send the char */
+		out_8(&psc->mpc52xx_psc_buffer_8, *s);
+
+		/* Line return handling */
+		if ( *s++ == '\n' )
+			out_8(&psc->mpc52xx_psc_buffer_8, '\r');
+		
+		/* Wait the TX buffer to be empty */
+		j = 20000;	/* Maximum wait */	
+		while (!(in_be16(&psc->mpc52xx_psc_status) & 
+		         MPC52xx_PSC_SR_TXEMP) && --j)
+			udelay(1);
+	}
+
+	/* Restore interrupt state */
+	out_be16(&psc->mpc52xx_psc_imr, port->read_status_mask);
+}
+
+static int __init
+mpc52xx_console_setup(struct console *co, char *options)
+{
+	struct uart_port *port = &mpc52xx_uart_ports[co->index];
+
+	int baud = 9600;
+	int bits = 8;
+	int parity = 'n';
+	int flow = 'n';
+
+	if (co->index < 0 || co->index >= MPC52xx_PSC_MAXNUM)
+		return -EINVAL;
+	
+	/* Basic port init. Needed since we use some uart_??? func before
+	 * real init for early access */
+	port->lock	= SPIN_LOCK_UNLOCKED;
+	port->uartclk	= __res.bi_ipbfreq / 2; /* Look at CTLR doc */
+	port->ops	= &mpc52xx_uart_ops;
+	port->mapbase	= MPC52xx_PSCx(co->index);
+
+		/* We ioremap ourself */
+	port->membase = ioremap(port->mapbase, sizeof(struct mpc52xx_psc));
+	if (port->membase == NULL) {
+		release_mem_region(port->mapbase, sizeof(struct mpc52xx_psc));
+		return -EBUSY;
+	}
+
+	/* Setup the port parameters accoding to options */
+	if (options)
+		uart_parse_options(options, &baud, &parity, &bits, &flow);
+	else
+		mpc52xx_console_get_options(port, &baud, &parity, &bits, &flow);
+
+	return uart_set_options(port, co, baud, parity, bits, flow);
+}
+
+
+extern struct uart_driver mpc52xx_uart_driver;
+
+static struct console mpc52xx_console = {
+	.name	= "ttyS",
+	.write	= mpc52xx_console_write,
+	.device	= uart_console_device,
+	.setup	= mpc52xx_console_setup,
+	.flags	= CON_PRINTBUFFER,
+	.index	= -1,	/* Specified on the cmdline (e.g. console=ttyS0 ) */
+	.data	= &mpc52xx_uart_driver,
+};
+
+	
+static int __init 
+mpc52xx_console_init(void)
+{
+	register_console(&mpc52xx_console);
+	return 0;
+}
+
+console_initcall(mpc52xx_console_init);
+
+#define MPC52xx_PSC_CONSOLE &mpc52xx_console
+#else
+#define MPC52xx_PSC_CONSOLE NULL
+#endif
+
+
+/* ======================================================================== */
+/* UART Driver                                                              */
+/* ======================================================================== */
+
+static struct uart_driver mpc52xx_uart_driver = {
+	.owner		= THIS_MODULE,
+	.driver_name	= "mpc52xx_psc_uart",
+	.dev_name	= "ttyS",
+	.devfs_name	= "ttyS",
+	.major		= TTY_MAJOR,
+	.minor		= 64,
+	.nr		= MPC52xx_PSC_MAXNUM,
+	.cons		= MPC52xx_PSC_CONSOLE,
+};
+
+
+/* ======================================================================== */
+/* OCP Driver                                                               */
+/* ======================================================================== */
+
+static int __devinit
+mpc52xx_uart_probe(struct ocp_device *ocp)
+{
+	struct uart_port *port = NULL;
+	int idx, ret;
+
+	/* Get the corresponding port struct */
+	idx = ocp->def->index;
+	if (idx < 0 || idx >= MPC52xx_PSC_MAXNUM)
+		return -EINVAL;
+	
+	port = &mpc52xx_uart_ports[idx];
+
+	/* Init the port structure */
+	port->lock	= SPIN_LOCK_UNLOCKED;
+	port->mapbase	= ocp->def->paddr;
+	port->irq	= ocp->def->irq;
+	port->uartclk	= __res.bi_ipbfreq / 2; /* Look at CTLR doc */
+	port->fifosize	= 255; /* Should be 512 ! But it can't be */
+	                       /* stored in a unsigned char       */
+	port->iotype	= UPIO_MEM;
+	port->flags	= UPF_BOOT_AUTOCONF |
+			  ( uart_console(port) ? 0 : UPF_IOREMAP );
+	port->line	= idx;
+	port->ops	= &mpc52xx_uart_ops;
+	port->read_status_mask = 0;
+	
+	/* Requests the mem & irqs */
+	/* Unlike other serial drivers, we reserve the resources here, so we
+	 * can detect early if multiple drivers uses the same PSC. Special
+	 * care must be taken with the console PSC
+	 */
+	ret = request_irq(
+		port->irq, mpc52xx_uart_int,
+		SA_INTERRUPT | SA_SAMPLE_RANDOM, "mpc52xx_psc_uart", port);
+	if (ret)
+		goto error;
+
+	ret = request_mem_region(port->mapbase, sizeof(struct mpc52xx_psc),
+	                         "mpc52xx_psc_uart") != NULL ? 0 : -EBUSY;
+	if (ret)
+		goto free_irq;
+
+	/* Add the port to the uart sub-system */
+	ret = uart_add_one_port(&mpc52xx_uart_driver, port);
+	if (ret)
+		goto release_mem;
+
+	ocp_set_drvdata(ocp, (void*)port);
+
+	return 0;
+
+
+free_irq:
+	free_irq(port->irq, mpc52xx_uart_int);
+
+release_mem:
+	release_mem_region(port->mapbase, sizeof(struct mpc52xx_psc));
+
+error:
+	if (uart_console(port))
+		printk(	"mpc52xx_uart.c: Error during resource alloction for "
+			"the console port !!! Check that the console PSC is "
+			"not used by another OCP driver !!!\n" );
+
+	return ret;
+}
+
+static void
+mpc52xx_uart_remove(struct ocp_device *ocp)
+{
+	struct uart_port *port = (struct uart_port *) ocp_get_drvdata(ocp);
+
+	ocp_set_drvdata(ocp, NULL);
+
+	if (port) {
+		uart_remove_one_port(&mpc52xx_uart_driver, port);
+		release_mem_region(port->mapbase, sizeof(struct mpc52xx_psc));
+		free_irq(port->irq, mpc52xx_uart_int);
+	}
+}
+
+#ifdef CONFIG_PM
+static int
+mpc52xx_uart_suspend(struct ocp_device *ocp, u32 state)
+{
+	struct uart_port *port = (struct uart_port *) ocp_get_drvdata(ocp);
+
+	uart_suspend_port(&mpc52xx_uart_driver, port);
+
+	return 0;
+}
+
+static int
+mpc52xx_uart_resume(struct ocp_device *ocp)
+{
+	struct uart_port *port = (struct uart_port *) ocp_get_drvdata(ocp);
+
+	uart_resume_port(&mpc52xx_uart_driver, port);
+
+	return 0;
+}
+#endif
+
+static struct ocp_device_id mpc52xx_uart_ids[] __devinitdata = {
+	{ .vendor = OCP_VENDOR_FREESCALE, .function = OCP_FUNC_PSC_UART },
+	{ .vendor = OCP_VENDOR_INVALID /* Terminating entry */ }
+};
+
+MODULE_DEVICE_TABLE(ocp, mpc52xx_uart_ids);
+
+static struct ocp_driver mpc52xx_uart_ocp_driver = {
+	.name		= "mpc52xx_psc_uart",
+	.id_table	= mpc52xx_uart_ids,
+	.probe		= mpc52xx_uart_probe,
+	.remove		= mpc52xx_uart_remove,
+#ifdef CONFIG_PM
+	.suspend	= mpc52xx_uart_suspend,
+	.resume		= mpc52xx_uart_resume,
+#endif
+};
+
+
+/* ======================================================================== */
+/* Module                                                                   */
+/* ======================================================================== */
+
+static int __init
+mpc52xx_uart_init(void)
+{
+	int ret;
+
+	printk(KERN_INFO "Serial: MPC52xx PSC driver\n");
+
+	ret = uart_register_driver(&mpc52xx_uart_driver);
+	if (ret)
+		return ret;
+
+	ret = ocp_register_driver(&mpc52xx_uart_ocp_driver);
+
+	return ret;
+}
+
+static void __exit
+mpc52xx_uart_exit(void)
+{
+	ocp_unregister_driver(&mpc52xx_uart_ocp_driver);
+	uart_unregister_driver(&mpc52xx_uart_driver);
+}
+
+
+module_init(mpc52xx_uart_init);
+module_exit(mpc52xx_uart_exit);
+
+MODULE_AUTHOR("Sylvain Munaut <tnt@246tNt.com>");
+MODULE_DESCRIPTION("Freescale MPC52xx PSC UART");
+MODULE_LICENSE("GPL");
diff -urN linux-2.6.8-rc2/drivers/serial/pmac_zilog.c linux-2.6.8-rc3/drivers/serial/pmac_zilog.c
--- linux-2.6.8-rc2/drivers/serial/pmac_zilog.c	2004-08-03 15:21:09.524610694 -0700
+++ linux-2.6.8-rc3/drivers/serial/pmac_zilog.c	2004-08-03 15:21:54.735465346 -0700
@@ -245,7 +245,7 @@
 			if (tty->flip.count >= TTY_FLIPBUF_SIZE)
 				drop = 1;
 			if (ZS_IS_ASLEEP(uap))
-				return 0;
+				return NULL;
 			if (!ZS_IS_OPEN(uap))
 				goto retry;
 		}
@@ -1433,6 +1433,7 @@
 			ioremap(np->addrs[np->n_addrs - 1].address, 0x1000);
 		if (uap->rx_dma_regs == NULL) {	
 			iounmap((void *)uap->tx_dma_regs);
+			uap->tx_dma_regs = NULL;
 			uap->flags &= ~PMACZILOG_FLAG_HAS_DMA;
 			goto no_dma;
 		}
@@ -1490,7 +1491,6 @@
 	uap->port.ops = &pmz_pops;
 	uap->port.type = PORT_PMAC_ZILOG;
 	uap->port.flags = 0;
-	spin_lock_init(&uap->port.lock);
 
 	/* Setup some valid baud rate information in the register
 	 * shadows so we don't write crap there before baud rate is
@@ -1508,10 +1508,13 @@
 {
 	struct device_node *np;
 
-	iounmap((void *)uap->control_reg);
 	np = uap->node;
+	iounmap((void *)uap->rx_dma_regs);
+	iounmap((void *)uap->tx_dma_regs);
+	iounmap((void *)uap->control_reg);
 	uap->node = NULL;
 	of_node_put(np);
+	memset(uap, 0, sizeof(struct uart_pmac_port));
 }
 
 /*
@@ -1798,7 +1801,7 @@
 	 * Register this driver with the serial core
 	 */
 	rc = uart_register_driver(&pmz_uart_reg);
-	if (rc != 0)
+	if (rc)
 		return rc;
 
 	/*
@@ -1808,10 +1811,19 @@
 		struct uart_pmac_port *uport = &pmz_ports[i];
 		/* NULL node may happen on wallstreet */
 		if (uport->node != NULL)
-			uart_add_one_port(&pmz_uart_reg, &uport->port);
+			rc = uart_add_one_port(&pmz_uart_reg, &uport->port);
+		if (rc)
+			goto err_out;
 	}
 
 	return 0;
+err_out:
+	while (i-- > 0) {
+		struct uart_pmac_port *uport = &pmz_ports[i];
+		uart_remove_one_port(&pmz_uart_reg, &uport->port);
+	}
+	uart_unregister_driver(&pmz_uart_reg);
+	return rc;
 }
 
 static struct of_match pmz_match[] = 
@@ -1841,6 +1853,7 @@
 
 static int __init init_pmz(void)
 {
+	int rc, i;
 	printk(KERN_INFO "%s\n", version);
 
 	/* 
@@ -1862,7 +1875,16 @@
 	/*
 	 * Now we register with the serial layer
 	 */
-	pmz_register();
+	rc = pmz_register();
+	if (rc) {
+		printk(KERN_ERR 
+			"pmac_zilog: Error registering serial device, disabling pmac_zilog.\n"
+		 	"pmac_zilog: Did another serial driver already claim the minors?\n"); 
+		/* effectively "pmz_unprobe()" */
+		for (i=0; i < pmz_ports_count; i++)
+			pmz_dispose_port(&pmz_ports[i]);
+		return rc;
+	}
 	
 	/*
 	 * Then we register the macio driver itself
diff -urN linux-2.6.8-rc2/drivers/serial/sn_console.c linux-2.6.8-rc3/drivers/serial/sn_console.c
--- linux-2.6.8-rc2/drivers/serial/sn_console.c	2004-08-03 15:21:09.537611226 -0700
+++ linux-2.6.8-rc3/drivers/serial/sn_console.c	2004-08-03 15:21:54.769466741 -0700
@@ -105,10 +105,9 @@
 extern u64 master_node_bedrock_address;
 extern void early_sn_setup(void);
 
-static int sn_debug_printf(const char *fmt, ...);
-
 #undef DEBUG
 #ifdef DEBUG
+static int sn_debug_printf(const char *fmt, ...);
 #define DPRINTF(x...) sn_debug_printf(x)
 #else
 #define DPRINTF(x...) do { } while (0)
@@ -489,6 +488,8 @@
 
 /* End of uart struct functions and defines */
 
+#ifdef DEBUG
+
 /**
  * sn_debug_printf - close to hardware debugging printf
  * @fmt: printf format
@@ -520,6 +521,7 @@
 	va_end(args);
 	return printed_len;
 }
+#endif	/* DEBUG */
 
 /*
  * Interrupt handling routines.
@@ -654,7 +656,7 @@
 				    port->sc_ops->sal_puts(start, xmit_count);
 #ifdef DEBUG
 			if (!result)
-				sn_debug_printf("`");
+				DPRINTF("`");
 #endif
 			if (result > 0) {
 				xmit_count -= result;
@@ -971,6 +973,7 @@
 
 /**
  * puts_raw_fixed - sn_sal_console_write helper for adding \r's as required
+ * @puts_raw : puts function to do the writing
  * @s: input string
  * @count: length
  *
@@ -978,19 +981,19 @@
  * ia64_sn_console_putb (what sal_puts_raw below actually does).
  *
  */
-static void puts_raw_fixed(const char *s, int count)
+
+static void puts_raw_fixed(int (*puts_raw) (const char *s, int len), const char *s, int count)
 {
 	const char *s1;
-	struct sn_cons_port *port = &sal_console_port;
 
 	/* Output '\r' before each '\n' */
 	while ((s1 = memchr(s, '\n', count)) != NULL) {
-		port->sc_ops->sal_puts_raw(s, s1 - s);
-		port->sc_ops->sal_puts_raw("\r\n", 2);
+		puts_raw(s, s1 - s);
+		puts_raw("\r\n", 2);
 		count -= s1 + 1 - s;
 		s = s1 + 1;
 	}
-	port->sc_ops->sal_puts_raw(s, count);
+	puts_raw(s, count);
 }
 
 /**
@@ -1072,7 +1075,7 @@
 				/* fell thru */
 				stole_lock = 1;
 			}
-			puts_raw_fixed(s, count);
+			puts_raw_fixed(port->sc_ops->sal_puts_raw, s, count);
 		}
 		else {
 			stole_lock = 0;
@@ -1081,12 +1084,12 @@
 			sn_transmit_chars(port, 1);
 			spin_unlock_irqrestore(&port->sc_port.lock, flags);
 
-			puts_raw_fixed(s, count);
+			puts_raw_fixed(port->sc_ops->sal_puts_raw, s, count);
 		}
 	}
 	else {
 		/* Not yet registered with serial core - simple case */
-		puts_raw_fixed(s, count);
+		puts_raw_fixed(port->sc_ops->sal_puts_raw, s, count);
 	}
 }
 
@@ -1123,7 +1126,7 @@
 static void __init
 sn_sal_console_write_early(struct console *co, const char *s, unsigned count)
 {
-	sal_console_port.sc_ops->sal_puts(s, count);
+	puts_raw_fixed(sal_console_port.sc_ops->sal_puts_raw, s, count);
 }
 
 /* Used for very early console printing - again, before
diff -urN linux-2.6.8-rc2/drivers/serial/suncore.c linux-2.6.8-rc3/drivers/serial/suncore.c
--- linux-2.6.8-rc2/drivers/serial/suncore.c	2004-06-15 22:19:29.000000000 -0700
+++ linux-2.6.8-rc3/drivers/serial/suncore.c	2004-08-03 15:21:54.770466782 -0700
@@ -90,13 +90,13 @@
 	cflag = CREAD | HUPCL | CLOCAL;
 
 	s = mode;
-	baud = simple_strtoul(s, 0, 0);
+	baud = simple_strtoul(s, NULL, 0);
 	s = strchr(s, ',');
-	bits = simple_strtoul(++s, 0, 0);
+	bits = simple_strtoul(++s, NULL, 0);
 	s = strchr(s, ',');
 	parity = *(++s);
 	s = strchr(s, ',');
-	stop = simple_strtoul(++s, 0, 0);
+	stop = simple_strtoul(++s, NULL, 0);
 	s = strchr(s, ',');
 	/* XXX handshake is not handled here. */
 
diff -urN linux-2.6.8-rc2/drivers/serial/sunsu.c linux-2.6.8-rc3/drivers/serial/sunsu.c
--- linux-2.6.8-rc2/drivers/serial/sunsu.c	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/drivers/serial/sunsu.c	2004-08-03 15:21:54.772466864 -0700
@@ -1045,7 +1045,7 @@
 {
 	unsigned char status1, status2, scratch, scratch2, scratch3;
 	unsigned char save_lcr, save_mcr;
-	struct linux_ebus_device *dev = 0;
+	struct linux_ebus_device *dev = NULL;
 	struct linux_ebus *ebus;
 #ifdef CONFIG_SPARC64
 	struct sparc_isa_bridge *isa_br;
diff -urN linux-2.6.8-rc2/drivers/usb/core/hub.c linux-2.6.8-rc3/drivers/usb/core/hub.c
--- linux-2.6.8-rc2/drivers/usb/core/hub.c	2004-08-03 15:21:09.628614954 -0700
+++ linux-2.6.8-rc3/drivers/usb/core/hub.c	2004-08-03 15:21:55.192484094 -0700
@@ -1253,8 +1253,8 @@
 	return 0;
 }
 
-#define	hub_suspend		0
-#define	hub_resume		0
+#define	hub_suspend		NULL
+#define	hub_resume		NULL
 #define	remote_wakeup(x)	0
 
 #endif	/* CONFIG_USB_SUSPEND */
diff -urN linux-2.6.8-rc2/drivers/usb/gadget/rndis.c linux-2.6.8-rc3/drivers/usb/gadget/rndis.c
--- linux-2.6.8-rc2/drivers/usb/gadget/rndis.c	2004-08-03 15:21:09.655616061 -0700
+++ linux-2.6.8-rc3/drivers/usb/gadget/rndis.c	2004-08-03 15:21:55.307488812 -0700
@@ -1323,11 +1323,15 @@
 int rndis_proc_write (struct file *file, const char __user *buffer, 
 		      unsigned long count, void *data)
 {
+	rndis_params *p = data;
 	u32 speed = 0;
 	int i, fl_speed = 0;
 	
 	for (i = 0; i < count; i++) {
-		switch (*buffer) {
+		char c;
+		if (get_user(c, buffer))
+			return -EFAULT;
+		switch (c) {
 		case '0':
 		case '1':
 		case '2':
@@ -1339,21 +1343,19 @@
 		case '8':
 		case '9':
 			fl_speed = 1;
-			speed = speed*10 + *buffer - '0';
+			speed = speed*10 + c - '0';
 			break;
 		case 'C':
 		case 'c':
-			rndis_signal_connect (((rndis_params *) data)
-				->confignr);
+			rndis_signal_connect (p->confignr);
 			break;
 		case 'D':
 		case 'd':
-			rndis_signal_disconnect (((rndis_params *) data)
-				->confignr);
+			rndis_signal_disconnect(p->confignr);
 			break;
 		default: 
-			if (fl_speed) ((rndis_params *) data)->speed = speed;
-			else DEBUG ("%c is not valid\n", *buffer);
+			if (fl_speed) p->speed = speed;
+			else DEBUG ("%c is not valid\n", c);
 			break;
 		}
 		
diff -urN linux-2.6.8-rc2/drivers/usb/media/ov511.c linux-2.6.8-rc3/drivers/usb/media/ov511.c
--- linux-2.6.8-rc2/drivers/usb/media/ov511.c	2004-08-03 15:21:09.697617781 -0700
+++ linux-2.6.8-rc3/drivers/usb/media/ov511.c	2004-08-03 15:21:55.816509693 -0700
@@ -16,7 +16,7 @@
  * Based on the Linux CPiA driver written by Peter Pregler,
  * Scott J. Bertin and Johannes Erdfelt.
  * 
- * Please see the file: linux/Documentation/usb/ov511.txt 
+ * Please see the file: Documentation/usb/ov511.txt
  * and the website at:  http://alpha.dyndns.org/ov511
  * for more info.
  *
diff -urN linux-2.6.8-rc2/drivers/usb/media/pwc-if.c linux-2.6.8-rc3/drivers/usb/media/pwc-if.c
--- linux-2.6.8-rc2/drivers/usb/media/pwc-if.c	2004-08-03 15:21:09.704618068 -0700
+++ linux-2.6.8-rc3/drivers/usb/media/pwc-if.c	2004-08-03 15:21:55.835510473 -0700
@@ -1150,7 +1150,7 @@
 	DECLARE_WAITQUEUE(wait, current);
         int bytes_to_read;
 
-	Trace(TRACE_READ, "video_read(0x%p, %p, %d) called.\n", vdev, buf, count);
+	Trace(TRACE_READ, "video_read(0x%p, %p, %zd) called.\n", vdev, buf, count);
 	if (vdev == NULL)
 		return -EFAULT;
 	pdev = vdev->priv;
diff -urN linux-2.6.8-rc2/drivers/usb/misc/tiglusb.c linux-2.6.8-rc3/drivers/usb/misc/tiglusb.c
--- linux-2.6.8-rc2/drivers/usb/misc/tiglusb.c	2004-06-15 22:18:47.000000000 -0700
+++ linux-2.6.8-rc3/drivers/usb/misc/tiglusb.c	2004-08-03 15:21:56.352531682 -0700
@@ -10,7 +10,7 @@
  *
  * Based on dabusb.c, printer.c & scanner.c
  *
- * Please see the file: linux/Documentation/usb/SilverLink.txt
+ * Please see the file: Documentation/usb/silverlink.txt
  * and the website at:  http://lpg.ticalc.org/prj_usb/
  * for more info.
  *
diff -urN linux-2.6.8-rc2/drivers/video/Kconfig linux-2.6.8-rc3/drivers/video/Kconfig
--- linux-2.6.8-rc2/drivers/video/Kconfig	2004-08-03 15:21:09.837623517 -0700
+++ linux-2.6.8-rc3/drivers/video/Kconfig	2004-08-03 15:21:56.875553138 -0700
@@ -40,7 +40,7 @@
 
 config FB_CIRRUS
 	tristate "Cirrus Logic support"
-	depends on FB && (AMIGA || PCI)
+	depends on FB && (ZORRO || PCI)
 	---help---
 	  This enables support for Cirrus Logic GD542x/543x based boards on
 	  Amiga: SD64, Piccolo, Picasso II/II+, Picasso IV, or EGS Spectrum.
@@ -93,7 +93,7 @@
 
 config FB_CYBER2000
 	tristate "CyberPro 2000/2010/5000 support"
-	depends on FB && PCI
+	depends on FB && PCI && (BROKEN || !SPARC64)
 	help
 	  This enables support for the Integraphics CyberPro 20x0 and 5000
 	  VGA chips used in the Rebel.com Netwinder and other machines.
@@ -238,7 +238,7 @@
 
 config FB_S3TRIO
 	bool "S3 Trio display support"
-	depends on FB && PPC
+	depends on FB && PPC && BROKEN
 	help
 	  If you have a S3 Trio say Y. Say N for S3 Virge.
 
@@ -446,6 +446,15 @@
 	  independently validate video mode parameters, you should say Y
 	  here.
 
+config FB_RIVA_DEBUG
+	bool "Lots of debug output from Riva(nVidia) driver"
+	depends on FB_RIVA
+	default n
+	help
+	  Say Y here if you want the Riva driver to output all sorts
+	  of debugging informations to provide to the maintainer when
+	  something goes wrong.
+
 config FB_I810
 	tristate "Intel 810/815 support (EXPERIMENTAL)"
 	depends on FB && AGP && AGP_INTEL && EXPERIMENTAL && PCI	
diff -urN linux-2.6.8-rc2/drivers/video/amifb.c linux-2.6.8-rc3/drivers/video/amifb.c
--- linux-2.6.8-rc2/drivers/video/amifb.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/drivers/video/amifb.c	2004-08-03 15:21:56.986557691 -0700
@@ -1309,7 +1309,7 @@
 		info->fix.ypanstep = 0;
 	} else {
 		info->fix.ywrapstep = 0;
-		if (par->vmode &= FB_VMODE_SMOOTH_XPAN)
+		if (par->vmode & FB_VMODE_SMOOTH_XPAN)
 			info->fix.xpanstep = 1;
 		else
 			info->fix.xpanstep = 16<<maxfmode;
@@ -2351,7 +2351,7 @@
 	 */
 
 	{
-	u_long tmp = DIVUL(200E9, amiga_eclock);
+	u_long tmp = DIVUL(200000000000ULL, amiga_eclock);
 
 	pixclock[TAG_SHRES] = (tmp + 4) / 8;	/* SHRES:  35 ns / 28 MHz */
 	pixclock[TAG_HIRES] = (tmp + 2) / 4;	/* HIRES:  70 ns / 14 MHz */
diff -urN linux-2.6.8-rc2/drivers/video/aty/aty128fb.c linux-2.6.8-rc3/drivers/video/aty/aty128fb.c
--- linux-2.6.8-rc2/drivers/video/aty/aty128fb.c	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/drivers/video/aty/aty128fb.c	2004-08-03 15:21:57.090561958 -0700
@@ -924,7 +924,7 @@
 
 }           
 
-#ifdef __i386__
+#ifdef CONFIG_X86
 static void *  __devinit aty128_find_mem_vbios(struct aty128fb_par *par)
 {
 	/* I simplified this code as we used to miss the signatures in
@@ -946,7 +946,7 @@
         }
 	return rom_base;
 }
-#endif /* __i386__ */
+#endif
 #endif /* ndef(__sparc__) */
 
 /* fill in known card constants if pll_block is not available */
@@ -1950,7 +1950,7 @@
 
 #ifndef __sparc__
 	bios = aty128_map_ROM(par, pdev);
-#ifdef __i386__
+#ifdef CONFIG_X86
 	if (bios == NULL)
 		bios = aty128_find_mem_vbios(par);
 #endif
@@ -2149,7 +2149,7 @@
 	case FBIO_ATY128_SET_MIRROR:
 		if (par->chip_gen != rage_M3)
 			return -EINVAL;
-		rc = get_user(value, (__u32*)arg);
+		rc = get_user(value, (__u32 __user *)arg);
 		if (rc)
 			return rc;
 		par->lcd_on = (value & 0x01) != 0;
@@ -2163,7 +2163,7 @@
 		if (par->chip_gen != rage_M3)
 			return -EINVAL;
 		value = (par->crt_on << 1) | par->lcd_on;
-		return put_user(value, (__u32*)arg);
+		return put_user(value, (__u32 __user *)arg);
 	}
 #endif
 	return -EINVAL;
@@ -2419,7 +2419,7 @@
 	wait_for_idle(par);
 	aty128fb_set_par(info);
 	fb_pan_display(info, &info->var);
-	fb_set_cmap(&info->cmap, 1, info);
+	fb_set_cmap(&info->cmap, info);
 
 	/* Refresh */
 	fb_set_suspend(info, 0);
diff -urN linux-2.6.8-rc2/drivers/video/aty/atyfb_base.c linux-2.6.8-rc3/drivers/video/aty/atyfb_base.c
--- linux-2.6.8-rc2/drivers/video/aty/atyfb_base.c	2004-06-15 22:19:42.000000000 -0700
+++ linux-2.6.8-rc3/drivers/video/aty/atyfb_base.c	2004-08-03 15:21:57.093562081 -0700
@@ -1037,7 +1037,7 @@
 		fbtyp.fb_cmsize = info->cmap.len;
 		fbtyp.fb_size = info->fix.smem_len;
 		if (copy_to_user
-		    ((struct fbtype *) arg, &fbtyp, sizeof(fbtyp)))
+		    ((struct fbtype __user *) arg, &fbtyp, sizeof(fbtyp)))
 			return -EFAULT;
 		break;
 #endif				/* __sparc__ */
@@ -1405,7 +1405,7 @@
 		case PBOOK_SLEEP_REJECT:
 			if (par->save_framebuffer) {
 				vfree(par->save_framebuffer);
-				par->save_framebuffer = 0;
+				par->save_framebuffer = NULL;
 			}
 			break;
 		case PBOOK_SLEEP_NOW:
@@ -1435,7 +1435,7 @@
 				memcpy_toio((void *) info->screen_base,
 					    par->save_framebuffer, nb);
 				vfree(par->save_framebuffer);
-				par->save_framebuffer = 0;
+				par->save_framebuffer = NULL;
 			}
 			/* Restore display */
 			atyfb_set_par(info);
diff -urN linux-2.6.8-rc2/drivers/video/aty/mach64_gx.c linux-2.6.8-rc3/drivers/video/aty/mach64_gx.c
--- linux-2.6.8-rc2/drivers/video/aty/mach64_gx.c	2004-06-15 22:18:59.000000000 -0700
+++ linux-2.6.8-rc3/drivers/video/aty/mach64_gx.c	2004-08-03 15:21:57.112562860 -0700
@@ -653,7 +653,7 @@
 
 		for (m = MIN_M; m <= MAX_M; m++) {
 			for (n = MIN_N; n <= MAX_N; n++) {
-				tempA = (14.31818 * 65536);
+				tempA = 938356;		/* 14.31818 * 65536 */
 				tempA *= (n + 8);	/* 43..256 */
 				tempB = twoToKth * 256;
 				tempB *= (m + 2);	/* 4..32 */
diff -urN linux-2.6.8-rc2/drivers/video/aty/radeon_base.c linux-2.6.8-rc3/drivers/video/aty/radeon_base.c
--- linux-2.6.8-rc2/drivers/video/aty/radeon_base.c	2004-08-03 15:21:09.843623763 -0700
+++ linux-2.6.8-rc3/drivers/video/aty/radeon_base.c	2004-08-03 15:21:57.143564132 -0700
@@ -386,7 +386,7 @@
 	return -ENXIO;
 }
 
-#ifdef __i386__
+#ifdef CONFIG_X86
 static int  __devinit radeon_find_mem_vbios(struct radeonfb_info *rinfo)
 {
 	/* I simplified this code as we used to miss the signatures in
@@ -415,7 +415,7 @@
 
 	return 0;
 }
-#endif /* __i386__ */
+#endif
 
 #ifdef CONFIG_PPC_OF
 /*
@@ -432,7 +432,7 @@
 		printk(KERN_WARNING "radeonfb: Cannot match card to OF node !\n");
 		return -ENODEV;
 	}
-	val = (u32 *) get_property(dp, "ATY,RefCLK", 0);
+	val = (u32 *) get_property(dp, "ATY,RefCLK", NULL);
 	if (!val || !*val) {
 		printk(KERN_WARNING "radeonfb: No ATY,RefCLK property !\n");
 		return -EINVAL;
@@ -440,11 +440,11 @@
 
 	rinfo->pll.ref_clk = (*val) / 10;
 
-	val = (u32 *) get_property(dp, "ATY,SCLK", 0);
+	val = (u32 *) get_property(dp, "ATY,SCLK", NULL);
 	if (val && *val)
 		rinfo->pll.sclk = (*val) / 10;
 
-	val = (u32 *) get_property(dp, "ATY,MCLK", 0);
+	val = (u32 *) get_property(dp, "ATY,MCLK", NULL);
 	if (val && *val)
 		rinfo->pll.mclk = (*val) / 10;
 
@@ -2277,13 +2277,13 @@
 	/*
 	 * On x86, the primary display on laptop may have it's BIOS
 	 * ROM elsewhere, try to locate it at the legacy memory hole.
-	 * We probably need to make sure this is the primary dispay,
+	 * We probably need to make sure this is the primary display,
 	 * but that is difficult without some arch support.
 	 */
-#ifdef __i386__
+#ifdef CONFIG_X86
 	if (rinfo->bios_seg == NULL)
 		radeon_find_mem_vbios(rinfo);
-#endif /* __i386__ */
+#endif
 
 	/* If both above failed, try the BIOS ROM again for mobility
 	 * chips
diff -urN linux-2.6.8-rc2/drivers/video/aty/radeon_pm.c linux-2.6.8-rc3/drivers/video/aty/radeon_pm.c
--- linux-2.6.8-rc2/drivers/video/aty/radeon_pm.c	2004-08-03 15:21:09.845623845 -0700
+++ linux-2.6.8-rc3/drivers/video/aty/radeon_pm.c	2004-08-03 15:21:57.144564173 -0700
@@ -922,7 +922,7 @@
 	/* Restore display & engine */
 	radeonfb_set_par(info);
 	fb_pan_display(info, &info->var);
-	fb_set_cmap(&info->cmap, 1, info);
+	fb_set_cmap(&info->cmap, info);
 
 	/* Refresh */
 	fb_set_suspend(info, 0);
diff -urN linux-2.6.8-rc2/drivers/video/cg14.c linux-2.6.8-rc3/drivers/video/cg14.c
--- linux-2.6.8-rc2/drivers/video/cg14.c	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/drivers/video/cg14.c	2004-08-03 15:21:57.146564255 -0700
@@ -278,7 +278,7 @@
 {
 	struct cg14_par *par = (struct cg14_par *) info->par;
 	struct cg14_regs *regs = par->regs;
-	struct mdi_cfginfo kmdi, *mdii;
+	struct mdi_cfginfo kmdi, __user *mdii;
 	unsigned long flags;
 	int cur_mode, mode, ret = 0;
 
@@ -301,13 +301,13 @@
 		kmdi.mdi_size = par->ramsize;
 		spin_unlock_irqrestore(&par->lock, flags);
 
-		mdii = (struct mdi_cfginfo *) arg;
+		mdii = (struct mdi_cfginfo __user *) arg;
 		if (copy_to_user(mdii, &kmdi, sizeof(kmdi)))
 			ret = -EFAULT;
 		break;
 
 	case MDI_SET_PIXELMODE:
-		if (get_user(mode, (int *) arg)) {
+		if (get_user(mode, (int __user *) arg)) {
 			ret = -EFAULT;
 			break;
 		}
diff -urN linux-2.6.8-rc2/drivers/video/chipsfb.c linux-2.6.8-rc3/drivers/video/chipsfb.c
--- linux-2.6.8-rc2/drivers/video/chipsfb.c	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/drivers/video/chipsfb.c	2004-08-03 15:21:57.164564994 -0700
@@ -493,7 +493,7 @@
 	case PBOOK_SLEEP_REJECT:
 		if (save_framebuffer) {
 			vfree(save_framebuffer);
-			save_framebuffer = 0;
+			save_framebuffer = NULL;
 		}
 		break;
 	case PBOOK_SLEEP_NOW:
@@ -505,7 +505,7 @@
 		if (save_framebuffer) {
 			memcpy(p->screen_base, save_framebuffer, nb);
 			vfree(save_framebuffer);
-			save_framebuffer = 0;
+			save_framebuffer = NULL;
 		}
 		chipsfb_blank(0, p);
 		break;
diff -urN linux-2.6.8-rc2/drivers/video/cirrusfb.c linux-2.6.8-rc3/drivers/video/cirrusfb.c
--- linux-2.6.8-rc2/drivers/video/cirrusfb.c	2004-08-03 15:21:09.855624255 -0700
+++ linux-2.6.8-rc3/drivers/video/cirrusfb.c	2004-08-03 15:21:57.176565486 -0700
@@ -5,8 +5,8 @@
  *
  * Contributors (thanks, all!)
  *
- * 	David Eger:
- * 	Overhaul for Linux 2.6
+ *	David Eger:
+ *	Overhaul for Linux 2.6
  *
  *      Jeff Rugen:
  *      Major contributions;  Motorola PowerStack (PPC and PCI) support,
@@ -145,9 +145,6 @@
  * a run-time table?
  */
 static const struct cirrusfb_board_info_rec {
-	cirrusfb_board_t btype;	/* chipset enum, not strictly necessary, as
-				 * cirrusfb_board_info[] is directly indexed
-				 * by this value */
 	char *name;		/* ASCII name of chipset */
 	long maxclock[5];		/* maximum video clock */
 	/* for  1/4bpp, 8bpp 15/16bpp, 24bpp, 32bpp - numbers from xorg code */
@@ -164,104 +161,115 @@
 
 	unsigned char sr1f;	/* SR1F VGA initial register value */
 } cirrusfb_board_info[] = {
-	{ BT_NONE, }, /* dummy record */
-	{ BT_SD64,
-		"CL SD64",
-		{ 140000, 140000, 140000, 140000, 140000, },	/* guess */
-		/* the SD64/P4 have a higher max. videoclock */
-		TRUE,
-		TRUE,
-		TRUE,
-		0xF0,
-		0xF0,
-		0,		/* unused, does not multiplex */
-		0xF1,
-		0,		/* unused, does not multiplex */
-		0x20 },
-	{ BT_PICCOLO,
-		"CL Piccolo",
-		{ 90000, 90000, 90000, 90000, 90000 },	/* guess */
-		TRUE,
-		TRUE,
-		FALSE,
-		0x80,
-		0x80,
-		0,		/* unused, does not multiplex */
-		0x81,
-		0,		/* unused, does not multiplex */
-		0x22 },
-	{ BT_PICASSO,
-		"CL Picasso",
-		{ 90000, 90000, 90000, 90000, 90000, },	/* guess */
-		TRUE,
-		TRUE,
-		FALSE,
-		0x20,
-		0x20,
-		0,		/* unused, does not multiplex */
-		0x21,
-		0,		/* unused, does not multiplex */
-		0x22 },
-	{ BT_SPECTRUM,
-		"CL Spectrum",
-		{ 90000, 90000, 90000, 90000, 90000, },	/* guess */
-		TRUE,
-		TRUE,
-		FALSE,
-		0x80,
-		0x80,
-		0,		/* unused, does not multiplex */
-		0x81,
-		0,		/* unused, does not multiplex */
-		0x22 },
-	{ BT_PICASSO4,
-		"CL Picasso4",
-		{ 135100, 135100, 85500, 85500, 0 },
-		TRUE,
-		FALSE,
-		TRUE,
-		0x20,
-		0x20,
-		0,		/* unused, does not multiplex */
-		0x21,
-		0,		/* unused, does not multiplex */
-		0 },
-	{ BT_ALPINE,
-		"CL Alpine",
-		{ 85500, 85500, 50000, 28500, 0}, /* for the GD5430.  GD5446 can do more... */
-		TRUE,
-		TRUE,
-		TRUE,
-		0xA0,
-		0xA1,
-		0xA7,
-		0xA1,
-		0xA7,
-		0x1C },
-	{ BT_GD5480,
-		"CL GD5480",
-		{ 135100, 200000, 200000, 135100, 135100 },
-		TRUE,
-		TRUE,
-		TRUE,
-		0x10,
-		0x11,
-		0,		/* unused, does not multiplex */
-		0x11,
-		0,		/* unused, does not multiplex */
-		0x1C },
-	{ BT_LAGUNA,
-		"CL Laguna",
-		{ 135100, 135100, 135100, 135100, 135100, }, /* guess */
-		FALSE,
-		FALSE,
-		TRUE,
-		0,		/* unused */
-		0,		/* unused */
-		0,		/* unused */
-		0,		/* unused */
-		0,		/* unused */
-		0 },		/* unused */
+	[BT_SD64] = {
+		.name			= "CL SD64",
+		.maxclock		= {
+			/* guess */
+			/* the SD64/P4 have a higher max. videoclock */
+			140000, 140000, 140000, 140000, 140000,
+		},
+		.init_sr07		= TRUE,
+		.init_sr1f		= TRUE,
+		.scrn_start_bit19	= TRUE,
+		.sr07			= 0xF0,
+		.sr07_1bpp		= 0xF0,
+		.sr07_8bpp		= 0xF1,
+		.sr1f			= 0x20
+	},
+	[BT_PICCOLO] = {
+		.name			= "CL Piccolo",
+		.maxclock		= {
+			/* guess */
+			90000, 90000, 90000, 90000, 90000
+		},
+		.init_sr07		= TRUE,
+		.init_sr1f		= TRUE,
+		.scrn_start_bit19	= FALSE,
+		.sr07			= 0x80,
+		.sr07_1bpp		= 0x80,
+		.sr07_8bpp		= 0x81,
+		.sr1f			= 0x22
+	},
+	[BT_PICASSO] = {
+		.name			= "CL Picasso",
+		.maxclock		= {
+			/* guess */
+			90000, 90000, 90000, 90000, 90000
+		},
+		.init_sr07		= TRUE,
+		.init_sr1f		= TRUE,
+		.scrn_start_bit19	= FALSE,
+		.sr07			= 0x20,
+		.sr07_1bpp		= 0x20,
+		.sr07_8bpp		= 0x21,
+		.sr1f			= 0x22
+	},
+	[BT_SPECTRUM] = {
+		.name			= "CL Spectrum",
+		.maxclock		= {
+			/* guess */
+			90000, 90000, 90000, 90000, 90000
+		},
+		.init_sr07		= TRUE,
+		.init_sr1f		= TRUE,
+		.scrn_start_bit19	= FALSE,
+		.sr07			= 0x80,
+		.sr07_1bpp		= 0x80,
+		.sr07_8bpp		= 0x81,
+		.sr1f			= 0x22
+	},
+	[BT_PICASSO4] = {
+		.name			= "CL Picasso4",
+		.maxclock		= {
+			135100, 135100, 85500, 85500, 0
+		},
+		.init_sr07		= TRUE,
+		.init_sr1f		= FALSE,
+		.scrn_start_bit19	= TRUE,
+		.sr07			= 0x20,
+		.sr07_1bpp		= 0x20,
+		.sr07_8bpp		= 0x21,
+		.sr1f			= 0
+	},
+	[BT_ALPINE] = {
+		.name			= "CL Alpine",
+		.maxclock		= {
+			/* for the GD5430.  GD5446 can do more... */
+			85500, 85500, 50000, 28500, 0
+		},
+		.init_sr07		= TRUE,
+		.init_sr1f		= TRUE,
+		.scrn_start_bit19	= TRUE,
+		.sr07			= 0xA0,
+		.sr07_1bpp		= 0xA1,
+		.sr07_1bpp_mux		= 0xA7,
+		.sr07_8bpp		= 0xA1,
+		.sr07_8bpp_mux		= 0xA7,
+		.sr1f			= 0x1C
+	},
+	[BT_GD5480] = {
+		.name			= "CL GD5480",
+		.maxclock		= {
+			135100, 200000, 200000, 135100, 135100
+		},
+		.init_sr07		= TRUE,
+		.init_sr1f		= TRUE,
+		.scrn_start_bit19	= TRUE,
+		.sr07			= 0x10,
+		.sr07_1bpp		= 0x11,
+		.sr07_8bpp		= 0x11,
+		.sr1f			= 0x1C
+	},
+	[BT_LAGUNA] = {
+		.name			= "CL Laguna",
+		.maxclock		= {
+			/* guess */
+			135100, 135100, 135100, 135100, 135100,
+		},
+		.init_sr07		= FALSE,
+		.init_sr1f		= FALSE,
+		.scrn_start_bit19	= TRUE,
+	}
 };
 
 
@@ -270,12 +278,12 @@
 	{ PCI_VENDOR_ID_CIRRUS, PCI_DEVICE_ID_##id, PCI_ANY_ID, PCI_ANY_ID, 0, 0, (btype) }
 
 static struct pci_device_id cirrusfb_pci_table[] = {
-	CHIP( CIRRUS_5436, 	BT_ALPINE ),
-	CHIP( CIRRUS_5434_8, 	BT_ALPINE ),
-	CHIP( CIRRUS_5434_4, 	BT_ALPINE ),
-	CHIP( CIRRUS_5430, 	BT_ALPINE ), /* GD-5440 has identical id */
-	CHIP( CIRRUS_7543, 	BT_ALPINE ),
-	CHIP( CIRRUS_7548, 	BT_ALPINE ),
+	CHIP( CIRRUS_5436,	BT_ALPINE ),
+	CHIP( CIRRUS_5434_8,	BT_ALPINE ),
+	CHIP( CIRRUS_5434_4,	BT_ALPINE ),
+	CHIP( CIRRUS_5430,	BT_ALPINE ), /* GD-5440 has identical id */
+	CHIP( CIRRUS_7543,	BT_ALPINE ),
+	CHIP( CIRRUS_7548,	BT_ALPINE ),
 	CHIP( CIRRUS_5480,	BT_GD5480 ), /* MacPicasso probably */
 	CHIP( CIRRUS_5446,	BT_PICASSO4 ), /* Picasso 4 is a GD5446 */
 	CHIP( CIRRUS_5462,	BT_LAGUNA ), /* CL Laguna */
@@ -289,31 +297,50 @@
 
 
 #ifdef CONFIG_ZORRO
+static const struct zorro_device_id cirrusfb_zorro_table[] = {
+	{
+		.id		= ZORRO_PROD_HELFRICH_SD64_RAM,
+		.driver_data	= BT_SD64,
+	}, {
+		.id		= ZORRO_PROD_HELFRICH_PICCOLO_RAM,
+		.driver_data	= BT_PICCOLO,
+	}, {
+		.id		= ZORRO_PROD_VILLAGE_TRONIC_PICASSO_II_II_PLUS_RAM,
+		.driver_data	= BT_PICASSO,
+	}, {
+		.id		= ZORRO_PROD_GVP_EGS_28_24_SPECTRUM_RAM,
+		.driver_data	= BT_SPECTRUM,
+	}, {
+		.id		= ZORRO_PROD_VILLAGE_TRONIC_PICASSO_IV_Z3,
+		.driver_data	= BT_PICASSO4,
+	},
+	{ 0 }
+};
+
 static const struct {
-	cirrusfb_board_t btype;
-	zorro_id id, id2;
+	zorro_id id2;
 	unsigned long size;
-} cirrusfb_zorro_probe_list[] __initdata = {
-	{ BT_SD64,
-		ZORRO_PROD_HELFRICH_SD64_RAM,
-		ZORRO_PROD_HELFRICH_SD64_REG,
-		0x400000 },
-	{ BT_PICCOLO,
-		ZORRO_PROD_HELFRICH_PICCOLO_RAM,
-		ZORRO_PROD_HELFRICH_PICCOLO_REG,
-		0x200000 },
-	{ BT_PICASSO,
-		ZORRO_PROD_VILLAGE_TRONIC_PICASSO_II_II_PLUS_RAM,
-		ZORRO_PROD_VILLAGE_TRONIC_PICASSO_II_II_PLUS_REG,
-		0x200000 },
-	{ BT_SPECTRUM,
-		ZORRO_PROD_GVP_EGS_28_24_SPECTRUM_RAM,
-		ZORRO_PROD_GVP_EGS_28_24_SPECTRUM_REG,
-		0x200000 },
-	{ BT_PICASSO4,
-		ZORRO_PROD_VILLAGE_TRONIC_PICASSO_IV_Z3,
-		0,
-		0x400000 },
+} cirrusfb_zorro_table2[] = {
+	[BT_SD64] = {
+		.id2	= ZORRO_PROD_HELFRICH_SD64_REG,
+		.size	= 0x400000
+	},
+	[BT_PICCOLO] = {
+		.id2	= ZORRO_PROD_HELFRICH_PICCOLO_REG,
+		.size	= 0x200000
+	},
+	[BT_PICASSO] = {
+		.id2	= ZORRO_PROD_VILLAGE_TRONIC_PICASSO_II_II_PLUS_REG,
+		.size	= 0x200000
+	},
+	[BT_SPECTRUM] = {
+		.id2	= ZORRO_PROD_GVP_EGS_28_24_SPECTRUM_REG,
+		.size	= 0x200000
+	},
+	[BT_PICASSO4] = {
+		.id2	= 0,
+		.size	= 0x400000
+	}
 };
 #endif /* CONFIG_ZORRO */
 
@@ -381,13 +408,12 @@
 	struct { u8 red, green, blue, pad; } palette[256];
 
 #ifdef CONFIG_ZORRO
-	unsigned long board_addr,
-		      board_size;
+	struct zorro_dev *zdev;
 #endif
-
 #ifdef CONFIG_PCI
 	struct pci_dev *pdev;
 #endif
+	void (*unmap)(struct cirrusfb_info *cinfo);
 };
 
 
@@ -401,50 +427,83 @@
 static const struct {
 	const char *name;
 	struct fb_var_screeninfo var;
-} cirrusfb_predefined[] =
-
-{
-	{"Autodetect",		/* autodetect mode */
-	 {0}
-	},
-
-	{"640x480",		/* 640x480, 31.25 kHz, 60 Hz, 25 MHz PixClock */
-	 {
-		 640, 480, 640, 480, 0, 0, 8, 0,
-		 {0, 8, 0},
-		 {0, 8, 0},
-		 {0, 8, 0},
-		 {0, 0, 0},
-	       0, 0, -1, -1, FB_ACCEL_NONE, 40000, 48, 16, 32, 8, 96, 4,
-     FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
-	 }
-	},
-
-	{"800x600",		/* 800x600, 48 kHz, 76 Hz, 50 MHz PixClock */
-	 {
-		 800, 600, 800, 600, 0, 0, 8, 0,
-		 {0, 8, 0},
-		 {0, 8, 0},
-		 {0, 8, 0},
-		 {0, 0, 0},
-	       0, 0, -1, -1, FB_ACCEL_NONE, 20000, 128, 16, 24, 2, 96, 6,
-     0, FB_VMODE_NONINTERLACED
-	 }
-	},
-
-	/*
-	   Modeline from XF86Config:
-	   Mode "1024x768" 80  1024 1136 1340 1432  768 770 774 805
-	 */
-	{"1024x768",		/* 1024x768, 55.8 kHz, 70 Hz, 80 MHz PixClock */
-		{
-			1024, 768, 1024, 768, 0, 0, 8, 0,
-			{0, 8, 0},
-			{0, 8, 0},
-			{0, 8, 0},
-			{0, 0, 0},
-	      0, 0, -1, -1, FB_ACCEL_NONE, 12500, 144, 32, 30, 2, 192, 6,
-     0, FB_VMODE_NONINTERLACED
+} cirrusfb_predefined[] = {
+	{
+		/* autodetect mode */
+		.name	= "Autodetect",
+	}, {
+		/* 640x480, 31.25 kHz, 60 Hz, 25 MHz PixClock */
+		.name	= "640x480",
+		.var	= {
+			.xres		= 640,
+			.yres		= 480,
+			.xres_virtual	= 640,
+			.yres_virtual	= 480,
+			.bits_per_pixel	= 8,
+			.red		= { .length = 8 },
+			.green		= { .length = 8 },
+			.blue		= { .length = 8 },
+			.width		= -1,
+			.height		= -1,
+			.pixclock	= 40000,
+			.left_margin	= 48,
+			.right_margin	= 16,
+			.upper_margin	= 32,
+			.lower_margin	= 8,
+			.hsync_len	= 96,
+			.vsync_len	= 4,
+			.sync		= FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
+			.vmode		= FB_VMODE_NONINTERLACED
+		 }
+	}, {
+		/* 800x600, 48 kHz, 76 Hz, 50 MHz PixClock */
+		.name	= "800x600",
+		.var	= {
+			.xres		= 800,
+			.yres		= 600,
+			.xres_virtual	= 800,
+			.yres_virtual	= 600,
+			.bits_per_pixel	= 8,
+			.red		= { .length = 8 },
+			.green		= { .length = 8 },
+			.blue		= { .length = 8 },
+			.width		= -1,
+			.height		= -1,
+			.pixclock	= 20000,
+			.left_margin	= 128,
+			.right_margin	= 16,
+			.upper_margin	= 24,
+			.lower_margin	= 2,
+			.hsync_len	= 96,
+			.vsync_len	= 6,
+			.vmode		= FB_VMODE_NONINTERLACED
+		 }
+	}, {
+		/*
+		 * Modeline from XF86Config:
+		 * Mode "1024x768" 80  1024 1136 1340 1432  768 770 774 805
+		 */
+		/* 1024x768, 55.8 kHz, 70 Hz, 80 MHz PixClock */
+		.name	= "1024x768",
+		.var	= {
+			.xres		= 1024,
+			.yres		= 768,
+			.xres_virtual	= 1024,
+			.yres_virtual	= 768,
+			.bits_per_pixel	= 8,
+			.red		= { .length = 8 },
+			.green		= { .length = 8 },
+			.blue		= { .length = 8 },
+			.width		= -1,
+			.height		= -1,
+			.pixclock	= 12500,
+			.left_margin	= 144,
+			.right_margin	= 32,
+			.upper_margin	= 30,
+			.lower_margin	= 2,
+			.hsync_len	= 192,
+			.vsync_len	= 6,
+			.vmode		= FB_VMODE_NONINTERLACED
 		}
 	}
 };
@@ -478,7 +537,7 @@
 static struct fb_ops cirrusfb_ops = {
 	.owner		= THIS_MODULE,
 	.fb_open	= cirrusfb_open,
-	.fb_release 	= cirrusfb_release,
+	.fb_release	= cirrusfb_release,
 	.fb_setcolreg	= cirrusfb_setcolreg,
 	.fb_check_var	= cirrusfb_check_var,
 	.fb_set_par	= cirrusfb_set_par,
@@ -1132,7 +1191,7 @@
 			DPRINTK (" (for GD54xx)\n");
 			vga_wseq (regbase, CL_SEQR7,
 				  regs.multiplexing ?
-				  	bi->sr07_1bpp_mux : bi->sr07_1bpp);
+					bi->sr07_1bpp_mux : bi->sr07_1bpp);
 			break;
 
 		case BT_LAGUNA:
@@ -1216,7 +1275,7 @@
 			DPRINTK (" (for GD54xx)\n");
 			vga_wseq (regbase, CL_SEQR7,
 				  regs.multiplexing ?
-				  	bi->sr07_8bpp_mux : bi->sr07_8bpp);
+					bi->sr07_8bpp_mux : bi->sr07_8bpp);
 			break;
 
 		case BT_LAGUNA:
@@ -2142,7 +2201,7 @@
 }
 
 
-static void __devexit cirrusfb_pci_unmap (struct cirrusfb_info *cinfo)
+static void cirrusfb_pci_unmap (struct cirrusfb_info *cinfo)
 {
 	struct pci_dev *pdev = cinfo->pdev;
 
@@ -2156,10 +2215,144 @@
 	framebuffer_release(cinfo->info);
 	pci_disable_device(pdev);
 }
+#endif /* CONFIG_PCI */
+
+
+#ifdef CONFIG_ZORRO
+static void __devexit cirrusfb_zorro_unmap (struct cirrusfb_info *cinfo)
+{
+	zorro_release_device(cinfo->zdev);
+
+	if (cinfo->btype == BT_PICASSO4) {
+		cinfo->regbase -= 0x600000;
+		iounmap ((void *)cinfo->regbase);
+		iounmap ((void *)cinfo->fbmem);
+	} else {
+		if (zorro_resource_start(cinfo->zdev) > 0x01000000)
+			iounmap ((void *)cinfo->fbmem);
+	}
+	framebuffer_release(cinfo->info);
+}
+#endif /* CONFIG_ZORRO */
+
+static int cirrusfb_set_fbinfo(struct cirrusfb_info *cinfo)
+{
+	struct fb_info *info = cinfo->info;
+	struct fb_var_screeninfo *var = &info->var;
+
+	info->currcon = -1;
+	info->par = cinfo;
+	info->pseudo_palette = cinfo->pseudo_palette;
+	info->flags = FBINFO_DEFAULT
+		    | FBINFO_HWACCEL_XPAN
+		    | FBINFO_HWACCEL_YPAN
+		    | FBINFO_HWACCEL_FILLRECT
+		    | FBINFO_HWACCEL_COPYAREA;
+	if (noaccel)
+		info->flags |= FBINFO_HWACCEL_DISABLED;
+	info->fbops = &cirrusfb_ops;
+	info->screen_base = cinfo->fbmem;
+	if (cinfo->btype == BT_GD5480) {
+		if (var->bits_per_pixel == 16)
+			info->screen_base += 1 * MB_;
+		if (var->bits_per_pixel == 24 || var->bits_per_pixel == 32)
+			info->screen_base += 2 * MB_;
+	}
+
+	/* Fill fix common fields */
+	strlcpy(info->fix.id, cirrusfb_board_info[cinfo->btype].name,
+		sizeof(info->fix.id));
+
+	/* monochrome: only 1 memory plane */
+	/* 8 bit and above: Use whole memory area */
+	info->fix.smem_start = cinfo->fbmem_phys;
+	info->fix.smem_len   = (var->bits_per_pixel == 1) ? cinfo->size / 4 : cinfo->size;
+	info->fix.type       = cinfo->currentmode.type;
+	info->fix.type_aux   = 0;
+	info->fix.visual     = cinfo->currentmode.visual;
+	info->fix.xpanstep   = 1;
+	info->fix.ypanstep   = 1;
+	info->fix.ywrapstep  = 0;
+	info->fix.line_length = cinfo->currentmode.line_length;
+
+	/* FIXME: map region at 0xB8000 if available, fill in here */
+	info->fix.mmio_start = cinfo->fbregs_phys;
+	info->fix.mmio_len   = 0;
+	info->fix.accel = FB_ACCEL_NONE;
+
+	fb_alloc_cmap(&info->cmap, 256, 0);
+
+	return 0;
+}
 
+static int cirrusfb_register(struct cirrusfb_info *cinfo)
+{
+	struct fb_info *info;
+	int err;
+	cirrusfb_board_t btype;
+
+	DPRINTK ("ENTER\n");
 
-static struct cirrusfb_info *cirrusfb_pci_setup (struct pci_dev *pdev,
-				   		 const struct pci_device_id *ent)
+	printk (KERN_INFO "cirrusfb: Driver for Cirrus Logic based graphic boards, v" CIRRUSFB_VERSION "\n");
+
+	info = cinfo->info;
+	btype = cinfo->btype;
+
+	/* sanity checks */
+	assert (btype != BT_NONE);
+
+	DPRINTK ("cirrusfb: (RAM start set to: 0x%p)\n", cinfo->fbmem);
+
+	/* Make pretend we've set the var so our structures are in a "good" */
+	/* state, even though we haven't written the mode to the hw yet...  */
+	info->var = cirrusfb_predefined[cirrusfb_def_mode].var;
+	info->var.activate = FB_ACTIVATE_NOW;
+
+	err = cirrusfb_decode_var(&info->var, &cinfo->currentmode, info);
+	if (err < 0) {
+		/* should never happen */
+		DPRINTK("choking on default var... umm, no good.\n");
+		goto err_unmap_cirrusfb;
+	}
+
+	/* set all the vital stuff */
+	cirrusfb_set_fbinfo(cinfo);
+
+	err = register_framebuffer(info);
+	if (err < 0) {
+		printk (KERN_ERR "cirrusfb: could not register fb device; err = %d!\n", err);
+		goto err_dealloc_cmap;
+	}
+
+	DPRINTK ("EXIT, returning 0\n");
+	return 0;
+
+err_dealloc_cmap:
+	fb_dealloc_cmap(&info->cmap);
+err_unmap_cirrusfb:
+	cinfo->unmap(cinfo);
+	return err;
+}
+
+static void __devexit cirrusfb_cleanup (struct fb_info *info)
+{
+	struct cirrusfb_info *cinfo = info->par;
+	DPRINTK ("ENTER\n");
+
+	switch_monitor (cinfo, 0);
+
+	unregister_framebuffer (info);
+	fb_dealloc_cmap (&info->cmap);
+	printk ("Framebuffer unregistered\n");
+	cinfo->unmap(cinfo);
+
+	DPRINTK ("EXIT\n");
+}
+
+
+#ifdef CONFIG_PCI
+static int cirrusfb_pci_register (struct pci_dev *pdev,
+				  const struct pci_device_id *ent)
 {
 	struct cirrusfb_info *cinfo;
 	struct fb_info *info;
@@ -2233,11 +2426,13 @@
 
 	cinfo->fbmem_phys = board_addr;
 	cinfo->size = board_size;
+	cinfo->unmap = cirrusfb_pci_unmap;
 
 	printk (" RAM (%lu kB) at 0xx%lx, ", cinfo->size / KB_, board_addr);
 	printk ("Cirrus Logic chipset on PCI bus\n");
+	pci_set_drvdata(pdev, info);
 
-	return cinfo;
+	return cirrusfb_register(cinfo);
 
 err_release_legacy:
 	if (release_io_ports)
@@ -2252,77 +2447,51 @@
 err_disable:
 	pci_disable_device(pdev);
 err_out:
-	return ERR_PTR(ret);
+	return ret;
 }
-#endif				/* CONFIG_PCI */
-
-
 
-
-#ifdef CONFIG_ZORRO
-static int cirrusfb_zorro_find (struct zorro_dev **z_o,
-				    struct zorro_dev **z2_o,
-				    cirrusfb_board_t *btype, unsigned long *size)
+void __devexit cirrusfb_pci_unregister (struct pci_dev *pdev)
 {
-	struct zorro_dev *z = NULL;
-	int i;
-
-	assert (z_o != NULL);
-	assert (btype != NULL);
-
-	for (i = 0; i < ARRAY_SIZE(cirrusfb_zorro_probe_list); i++)
-		if ((z = zorro_find_device(cirrusfb_zorro_probe_list[i].id, NULL)))
-			break;
-
-	if (z) {
-		*z_o = z;
-		if (cirrusfb_zorro_probe_list[i].id2)
-			*z2_o = zorro_find_device(cirrusfb_zorro_probe_list[i].id2, NULL);
-		else
-			*z2_o = NULL;
-
-		*btype = cirrusfb_zorro_probe_list[i].btype;
-		*size = cirrusfb_zorro_probe_list[i].size;
-
-		printk (KERN_INFO "cirrusfb: %s board detected; ",
-			cirrusfb_board_info[*btype].name);
+	struct fb_info *info = pci_get_drvdata(pdev);
+	DPRINTK ("ENTER\n");
 
-		return 0;
-	}
+	cirrusfb_cleanup (info);
 
-	printk (KERN_NOTICE "cirrusfb: no supported board found.\n");
-	return -ENODEV;
+	DPRINTK ("EXIT\n");
 }
 
-
-static void __devexit cirrusfb_zorro_unmap (struct cirrusfb_info *cinfo)
-{
-	release_mem_region(cinfo->board_addr, cinfo->board_size);
-
-	if (cinfo->btype == BT_PICASSO4) {
-		cinfo->regbase -= 0x600000;
-		iounmap ((void *)cinfo->regbase);
-		iounmap ((void *)cinfo->fbmem);
-	} else {
-		if (cinfo->board_addr > 0x01000000)
-			iounmap ((void *)cinfo->fbmem);
-	}
-	framebuffer_release(cinfo->info);
-}
+static struct pci_driver cirrusfb_pci_driver = {
+	.name		= "cirrusfb",
+	.id_table	= cirrusfb_pci_table,
+	.probe		= cirrusfb_pci_register,
+	.remove		= __devexit_p(cirrusfb_pci_unregister),
+#ifdef CONFIG_PM
+#if 0
+	.suspend	= cirrusfb_pci_suspend,
+	.resume		= cirrusfb_pci_resume,
+#endif
+#endif
+};
+#endif /* CONFIG_PCI */
 
 
-static struct cirrusfb_info *cirrusfb_zorro_setup(void)
+#ifdef CONFIG_ZORRO
+static int cirrusfb_zorro_register(struct zorro_dev *z,
+				   const struct zorro_device_id *ent)
 {
 	struct cirrusfb_info *cinfo;
 	struct fb_info *info;
 	cirrusfb_board_t btype;
-	struct zorro_dev *z = NULL, *z2 = NULL;
+	struct zorro_dev *z2 = NULL;
 	unsigned long board_addr, board_size, size;
 	int ret;
 
-	ret = cirrusfb_zorro_find (&z, &z2, &btype, &size);
-	if (ret < 0)
-		goto err_out;
+	btype = ent->driver_data;
+	if (cirrusfb_zorro_table2[btype].id2)
+		z2 = zorro_find_device(cirrusfb_zorro_table2[btype].id2, NULL);
+	size = cirrusfb_zorro_table2[btype].size;
+	printk(KERN_INFO "cirrusfb: %s board detected; ",
+	       cirrusfb_board_info[btype].name);
 
 	info = framebuffer_alloc(sizeof(struct cirrusfb_info), &z->dev);
 	if (!info) {
@@ -2339,11 +2508,12 @@
 	assert (z2 >= 0);
 	assert (btype != BT_NONE);
 
-	cinfo->board_addr = board_addr = z->resource.start;
-	cinfo->board_size = board_size = z->resource.end-z->resource.start+1;
+	cinfo->zdev = z;
+	board_addr = zorro_resource_start(z);
+	board_size = zorro_resource_len(z);
 	cinfo->size = size;
 
-	if (!request_mem_region(board_addr, board_size, "cirrusfb")) {
+	if (!zorro_request_device(z, "cirrusfb")) {
 		printk(KERN_ERR "cirrusfb: cannot reserve region 0x%lx, abort\n",
 		       board_addr);
 		ret = -EBUSY;
@@ -2370,7 +2540,7 @@
 		cinfo->fbregs_phys = board_addr + 0x600000;
 
 		cinfo->fbmem_phys = board_addr + 16777216;
-		cinfo->fbmem = ioremap (info->fbmem_phys, 16777216);
+		cinfo->fbmem = ioremap (cinfo->fbmem_phys, 16777216);
 		if (!cinfo->fbmem)
 			goto err_unmap_regbase;
 	} else {
@@ -2390,10 +2560,12 @@
 
 		DPRINTK ("cirrusfb: Virtual address for board set to: $%p\n", cinfo->regbase);
 	}
+	cinfo->unmap = cirrusfb_zorro_unmap;
 
 	printk (KERN_INFO "Cirrus Logic chipset on Zorro bus\n");
+	zorro_set_drvdata(z, info);
 
-	return 0;
+	return cirrusfb_register(cinfo);
 
 err_unmap_regbase:
 	/* Parental advisory: explicit hack */
@@ -2403,153 +2575,12 @@
 err_release_fb:
 	framebuffer_release(info);
 err_out:
-	return ERR_PTR(ret);
+	return ret;
 }
-#endif /* CONFIG_ZORRO */
 
-static int cirrusfb_set_fbinfo(struct cirrusfb_info *cinfo)
+void __devexit cirrusfb_zorro_unregister(struct zorro_dev *z)
 {
-	struct fb_info *info = cinfo->info;
-	struct fb_var_screeninfo *var = &info->var;
-
-	info->currcon = -1;
-	info->par = cinfo;
-	info->pseudo_palette = cinfo->pseudo_palette;
-	info->flags = FBINFO_DEFAULT
-		    | FBINFO_HWACCEL_XPAN
-		    | FBINFO_HWACCEL_YPAN
-		    | FBINFO_HWACCEL_FILLRECT
-		    | FBINFO_HWACCEL_COPYAREA;
-	if (noaccel)
-		info->flags |= FBINFO_HWACCEL_DISABLED;
-	info->fbops = &cirrusfb_ops;
-	info->screen_base = cinfo->fbmem;
-	if (cinfo->btype == BT_GD5480) {
-		if (var->bits_per_pixel == 16)
-			info->screen_base += 1 * MB_;
-		if (var->bits_per_pixel == 24 || var->bits_per_pixel == 32)
-			info->screen_base += 2 * MB_;
-	}
-
-	/* Fill fix common fields */
-	strlcpy(info->fix.id, cirrusfb_board_info[cinfo->btype].name,
-		sizeof(info->fix.id));
-
-	/* monochrome: only 1 memory plane */
-	/* 8 bit and above: Use whole memory area */
-	info->fix.smem_start = cinfo->fbmem_phys;
-	info->fix.smem_len   = (var->bits_per_pixel == 1) ? cinfo->size / 4 : cinfo->size;
-	info->fix.type       = cinfo->currentmode.type;
-	info->fix.type_aux   = 0;
-	info->fix.visual     = cinfo->currentmode.visual;
-	info->fix.xpanstep   = 1;
-	info->fix.ypanstep   = 1;
-	info->fix.ywrapstep  = 0;
-	info->fix.line_length = cinfo->currentmode.line_length;
-
-	/* FIXME: map region at 0xB8000 if available, fill in here */
-	info->fix.mmio_start = cinfo->fbregs_phys;
-	info->fix.mmio_len   = 0;
-	info->fix.accel = FB_ACCEL_NONE;
-
-	fb_alloc_cmap(&info->cmap, 256, 0);
-
-	return 0;
-}
-
-#if defined(CONFIG_PCI)
-#define cirrusfb_unmap cirrusfb_pci_unmap
-#define cirrusfb_bus_setup cirrusfb_pci_setup
-#elif defined(CONFIG_ZORRO)
-#define cirrusfb_unmap cirrusfb_zorro_unmap
-#define cirrusfb_bus_setup cirrusfb_zorro_setup
-#endif
-
-
-static int cirrusfb_pci_register (struct pci_dev *pdev,
-				  const struct pci_device_id *ent)
-{
-	struct fb_info *info;
-	struct cirrusfb_info *cinfo = NULL;
-	int err;
-	cirrusfb_board_t btype;
-
-	DPRINTK ("ENTER\n");
-
-	printk (KERN_INFO "cirrusfb: Driver for Cirrus Logic based graphic boards, v" CIRRUSFB_VERSION "\n");
-
-	cinfo = cirrusfb_bus_setup(pdev, ent);
-
-	if (IS_ERR(cinfo)) {
-		err = PTR_ERR(cinfo);
-		goto err_out;
-	}
-
-	info = cinfo->info;
-	btype = cinfo->btype;
-
-	/* sanity checks */
-	assert (btype != BT_NONE);
-	assert (btype == cirrusfb_board_info[btype].btype);
-
-	DPRINTK ("cirrusfb: (RAM start set to: 0x%p)\n", cinfo->fbmem);
-
-	/* Make pretend we've set the var so our structures are in a "good" */
-	/* state, even though we haven't written the mode to the hw yet...  */
-	info->var = cirrusfb_predefined[cirrusfb_def_mode].var;
-	info->var.activate = FB_ACTIVATE_NOW;
-
-	err = cirrusfb_decode_var(&info->var, &cinfo->currentmode, info);
-	if (err < 0) {
-		/* should never happen */
-		DPRINTK("choking on default var... umm, no good.\n");
-		goto err_unmap_cirrusfb;
-	}
-
-	/* set all the vital stuff */
-	cirrusfb_set_fbinfo(cinfo);
-
-	pci_set_drvdata(pdev, info);
-
-	err = register_framebuffer(info);
-	if (err < 0) {
-		printk (KERN_ERR "cirrusfb: could not register fb device; err = %d!\n", err);
-		goto err_dealloc_cmap;
-	}
-
-	DPRINTK ("EXIT, returning 0\n");
-	return 0;
-
-err_dealloc_cmap:
-	fb_dealloc_cmap(&info->cmap);
-err_unmap_cirrusfb:
-	cirrusfb_unmap(cinfo);
-err_out:
-	return err;
-}
-
-
-static void __devexit cirrusfb_cleanup (struct fb_info *info)
-{
-	struct cirrusfb_info *cinfo = info->par;
-	DPRINTK ("ENTER\n");
-
-#ifdef CONFIG_ZORRO
-	switch_monitor (cinfo, 0);
-#endif
-
-	unregister_framebuffer (info);
-	fb_dealloc_cmap (&info->cmap);
-	printk ("Framebuffer unregistered\n");
-	cirrusfb_unmap (cinfo);
-
-	DPRINTK ("EXIT\n");
-}
-
-
-void __devexit cirrusfb_pci_unregister (struct pci_dev *pdev)
-{
-	struct fb_info *info = pci_get_drvdata(pdev);
+	struct fb_info *info = zorro_get_drvdata(z);
 	DPRINTK ("ENTER\n");
 
 	cirrusfb_cleanup (info);
@@ -2557,26 +2588,25 @@
 	DPRINTK ("EXIT\n");
 }
 
-static struct pci_driver cirrusfb_driver = {
-	.name	= "cirrusfb",
-	.id_table	= cirrusfb_pci_table,
-	.probe		= cirrusfb_pci_register,
-	.remove		= __devexit_p(cirrusfb_pci_unregister),
-#ifdef CONFIG_PM
-#if 0
-	.suspend	= cirrusfb_pci_suspend,
-	.resume		= cirrusfb_pci_resume,
-#endif
-#endif
+static struct zorro_driver cirrusfb_zorro_driver = {
+	.name		= "cirrusfb",
+	.id_table	= cirrusfb_zorro_table,
+	.probe		= cirrusfb_zorro_register,
+	.remove		= __devexit_p(cirrusfb_zorro_unregister),
 };
+#endif /* CONFIG_ZORRO */
 
 int __init cirrusfb_init(void)
 {
+	int error = 0;
+
 #ifdef CONFIG_ZORRO
-	return cirrusfb_pci_register(NULL, NULL);
-#else
-	return pci_module_init(&cirrusfb_driver);
+	error |= zorro_module_init(&cirrusfb_zorro_driver);
 #endif
+#ifdef CONFIG_PCI
+	error |= pci_module_init(&cirrusfb_pci_driver);
+#endif
+	return error;
 }
 
 
@@ -2619,7 +2649,12 @@
 
 void __exit cirrusfb_exit (void)
 {
-	pci_unregister_driver (&cirrusfb_driver);
+#ifdef CONFIG_PCI
+	pci_unregister_driver(&cirrusfb_pci_driver);
+#endif
+#ifdef CONFIG_ZORRO
+	zorro_unregister_driver(&cirrusfb_zorro_driver);
+#endif
 }
 
 #ifdef MODULE
@@ -2830,7 +2865,7 @@
 
 static void cirrusfb_BitBLT (caddr_t regbase, int bits_per_pixel,
 			     u_short curx, u_short cury, u_short destx, u_short desty,
-		  	     u_short width, u_short height, u_short line_length)
+			     u_short width, u_short height, u_short line_length)
 {
 	u_short nwidth, nheight;
 	u_long nsrc, ndest;
diff -urN linux-2.6.8-rc2/drivers/video/console/dummycon.c linux-2.6.8-rc3/drivers/video/console/dummycon.c
--- linux-2.6.8-rc2/drivers/video/console/dummycon.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/drivers/video/console/dummycon.c	2004-08-03 15:21:57.221567332 -0700
@@ -71,7 +71,10 @@
     .con_bmove =	DUMMY,
     .con_switch =	DUMMY,
     .con_blank =	DUMMY,
-    .con_font_op =	DUMMY,
+    .con_font_set =	DUMMY,
+    .con_font_get =	DUMMY,
+    .con_font_default =	DUMMY,
+    .con_font_copy =	DUMMY,
     .con_set_palette =	DUMMY,
     .con_scrolldelta =	DUMMY,
 };
diff -urN linux-2.6.8-rc2/drivers/video/console/fbcon.c linux-2.6.8-rc3/drivers/video/console/fbcon.c
--- linux-2.6.8-rc2/drivers/video/console/fbcon.c	2004-08-03 15:21:09.860624459 -0700
+++ linux-2.6.8-rc3/drivers/video/console/fbcon.c	2004-08-03 15:21:57.233567824 -0700
@@ -165,7 +165,6 @@
 			int height, int width);
 static int fbcon_switch(struct vc_data *vc);
 static int fbcon_blank(struct vc_data *vc, int blank, int mode_switch);
-static int fbcon_font_op(struct vc_data *vc, struct console_font_op *op);
 static int fbcon_set_palette(struct vc_data *vc, unsigned char *table);
 static int fbcon_scrolldelta(struct vc_data *vc, int lines);
 void accel_clear_margins(struct vc_data *vc, struct fb_info *info,
@@ -2001,36 +2000,36 @@
 	p->userfont = 0;
 }
 
-static inline int fbcon_get_font(struct vc_data *vc, struct console_font_op *op)
+static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
 {
 	u8 *fontdata = vc->vc_font.data;
-	u8 *data = op->data;
+	u8 *data = font->data;
 	int i, j;
 
-	op->width = vc->vc_font.width;
-	op->height = vc->vc_font.height;
-	op->charcount = vc->vc_hi_font_mask ? 512 : 256;
-	if (!op->data)
+	font->width = vc->vc_font.width;
+	font->height = vc->vc_font.height;
+	font->charcount = vc->vc_hi_font_mask ? 512 : 256;
+	if (!font->data)
 		return 0;
 
-	if (op->width <= 8) {
+	if (font->width <= 8) {
 		j = vc->vc_font.height;
-		for (i = 0; i < op->charcount; i++) {
+		for (i = 0; i < font->charcount; i++) {
 			memcpy(data, fontdata, j);
 			memset(data + j, 0, 32 - j);
 			data += 32;
 			fontdata += j;
 		}
-	} else if (op->width <= 16) {
+	} else if (font->width <= 16) {
 		j = vc->vc_font.height * 2;
-		for (i = 0; i < op->charcount; i++) {
+		for (i = 0; i < font->charcount; i++) {
 			memcpy(data, fontdata, j);
 			memset(data + j, 0, 64 - j);
 			data += 64;
 			fontdata += j;
 		}
-	} else if (op->width <= 24) {
-		for (i = 0; i < op->charcount; i++) {
+	} else if (font->width <= 24) {
+		for (i = 0; i < font->charcount; i++) {
 			for (j = 0; j < vc->vc_font.height; j++) {
 				*data++ = fontdata[0];
 				*data++ = fontdata[1];
@@ -2042,7 +2041,7 @@
 		}
 	} else {
 		j = vc->vc_font.height * 4;
-		for (i = 0; i < op->charcount; i++) {
+		for (i = 0; i < font->charcount; i++) {
 			memcpy(data, fontdata, j);
 			memset(data + j, 0, 128 - j);
 			data += 128;
@@ -2052,23 +2051,15 @@
 	return 0;
 }
 
-static int fbcon_do_set_font(struct vc_data *vc, struct console_font_op *op,
+static int fbcon_do_set_font(struct vc_data *vc, int w, int h,
 			     u8 * data, int userfont)
 {
 	struct fb_info *info = registered_fb[(int) con2fb_map[vc->vc_num]];
 	struct display *p = &fb_display[vc->vc_num];
 	int resize;
-	int w = op->width;
-	int h = op->height;
 	int cnt;
 	char *old_data = NULL;
 
-	if (!w > 32) {
-		if (userfont && op->op != KD_FONT_OP_COPY)
-			kfree(data - FONT_EXTRA_WORDS * sizeof(int));
-		return -ENXIO;
-	}
-
 	if (CON_IS_VISIBLE(vc) && softback_lines)
 		fbcon_set_origin(vc);
 
@@ -2168,33 +2159,32 @@
 	return 0;
 }
 
-static inline int fbcon_copy_font(struct vc_data *vc, struct console_font_op *op)
+static int fbcon_copy_font(struct vc_data *vc, int con)
 {
-	struct display *od;
-	int h = op->height;
+	struct display *od = &fb_display[con];
+	struct console_font *f = &vc->vc_font;
 
-	if (h < 0 || !vc_cons_allocated(h))
-		return -ENOTTY;
-	if (h == vc->vc_num)
-		return 0;	/* nothing to do */
-	od = &fb_display[h];
-	if (od->fontdata == vc->vc_font.data)
+	if (od->fontdata == f->data)
 		return 0;	/* already the same font... */
-	op->width = vc->vc_font.width;
-	op->height = vc->vc_font.height;
-	return fbcon_do_set_font(vc, op, od->fontdata, od->userfont);
+	return fbcon_do_set_font(vc, f->width, f->height, od->fontdata, od->userfont);
 }
 
-static inline int fbcon_set_font(struct vc_data *vc, struct console_font_op *op)
+/*
+ *  User asked to set font; we are guaranteed that
+ *	a) width and height are in range 1..32
+ *	b) charcount does not exceed 512
+ */
+
+static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigned flags)
 {
-	int w = op->width;
-	int h = op->height;
+	unsigned charcount = font->charcount;
+	int w = font->width;
+	int h = font->height;
 	int size = h;
 	int i, k;
-	u8 *new_data, *data = op->data, *p;
+	u8 *new_data, *data = font->data, *p;
 
-	if ((w <= 0) || (w > 32)
-	    || (op->charcount != 256 && op->charcount != 512))
+	if (charcount != 256 && charcount != 512)
 		return -EINVAL;
 
 	if (w > 8) {
@@ -2203,32 +2193,33 @@
 		else
 			size *= 4;
 	}
-	size *= op->charcount;
+	size *= charcount;
+
+	new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);
 
-	if (!
-	    (new_data =
-	     kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER)))
+	if (!new_data)
 		return -ENOMEM;
+
 	new_data += FONT_EXTRA_WORDS * sizeof(int);
 	FNTSIZE(new_data) = size;
-	FNTCHARCNT(new_data) = op->charcount;
+	FNTCHARCNT(new_data) = charcount;
 	REFCOUNT(new_data) = 0;	/* usage counter */
 	p = new_data;
 	if (w <= 8) {
-		for (i = 0; i < op->charcount; i++) {
+		for (i = 0; i < charcount; i++) {
 			memcpy(p, data, h);
 			data += 32;
 			p += h;
 		}
 	} else if (w <= 16) {
 		h *= 2;
-		for (i = 0; i < op->charcount; i++) {
+		for (i = 0; i < charcount; i++) {
 			memcpy(p, data, h);
 			data += 64;
 			p += h;
 		}
 	} else if (w <= 24) {
-		for (i = 0; i < op->charcount; i++) {
+		for (i = 0; i < charcount; i++) {
 			int j;
 			for (j = 0; j < h; j++) {
 				memcpy(p, data, 3);
@@ -2240,7 +2231,7 @@
 		}
 	} else {
 		h *= 4;
-		for (i = 0; i < op->charcount; i++) {
+		for (i = 0; i < charcount; i++) {
 			memcpy(p, data, h);
 			data += 128;
 			p += h;
@@ -2270,43 +2261,22 @@
 			break;
 		}
 	}
-	return fbcon_do_set_font(vc, op, new_data, 1);
+	return fbcon_do_set_font(vc, font->width, font->height, new_data, 1);
 }
 
-static inline int fbcon_set_def_font(struct vc_data *vc, struct console_font_op *op)
+static int fbcon_set_def_font(struct vc_data *vc, struct console_font *font, char *name)
 {
 	struct fb_info *info = registered_fb[(int) con2fb_map[vc->vc_num]];
-	char name[MAX_FONT_NAME];
 	struct font_desc *f;
 
-	if (!op->data)
+	if (!name)
 		f = get_default_font(info->var.xres, info->var.yres);
-	else if (strncpy_from_user(name, op->data, MAX_FONT_NAME - 1) < 0)
-		return -EFAULT;
-	else {
-		name[MAX_FONT_NAME - 1] = 0;
-		if (!(f = find_font(name)))
-			return -ENOENT;
-	}
-	op->width = f->width;
-	op->height = f->height;
-	return fbcon_do_set_font(vc, op, f->data, 0);
-}
-
-static int fbcon_font_op(struct vc_data *vc, struct console_font_op *op)
-{
-	switch (op->op) {
-	case KD_FONT_OP_SET:
-		return fbcon_set_font(vc, op);
-	case KD_FONT_OP_GET:
-		return fbcon_get_font(vc, op);
-	case KD_FONT_OP_SET_DEFAULT:
-		return fbcon_set_def_font(vc, op);
-	case KD_FONT_OP_COPY:
-		return fbcon_copy_font(vc, op);
-	default:
-		return -ENOSYS;
-	}
+	else if (!(f = find_font(name)))
+		return -ENOENT;
+
+	font->width = f->width;
+	font->height = f->height;
+	return fbcon_do_set_font(vc, f->width, f->height, f->data, 0);
 }
 
 static u16 palette_red[16];
@@ -2340,7 +2310,7 @@
 	else
 		palette_cmap.len = 16;
 	palette_cmap.start = 0;
-	return fb_set_cmap(&palette_cmap, 1, info);
+	return fb_set_cmap(&palette_cmap, info);
 }
 
 static u16 *fbcon_screen_pos(struct vc_data *vc, int offset)
@@ -2609,7 +2579,10 @@
 	.con_bmove 		= fbcon_bmove,
 	.con_switch 		= fbcon_switch,
 	.con_blank 		= fbcon_blank,
-	.con_font_op 		= fbcon_font_op,
+	.con_font_set 		= fbcon_set_font,
+	.con_font_get 		= fbcon_get_font,
+	.con_font_default	= fbcon_set_def_font,
+	.con_font_copy 		= fbcon_copy_font,
 	.con_set_palette 	= fbcon_set_palette,
 	.con_scrolldelta 	= fbcon_scrolldelta,
 	.con_set_origin 	= fbcon_set_origin,
diff -urN linux-2.6.8-rc2/drivers/video/console/mdacon.c linux-2.6.8-rc3/drivers/video/console/mdacon.c
--- linux-2.6.8-rc2/drivers/video/console/mdacon.c	2004-06-15 22:19:35.000000000 -0700
+++ linux-2.6.8-rc3/drivers/video/console/mdacon.c	2004-08-03 15:21:57.235567906 -0700
@@ -517,11 +517,6 @@
 	}
 }
 
-static int mdacon_font_op(struct vc_data *c, struct console_font_op *op)
-{
-	return -ENOSYS;
-}
-
 static int mdacon_scrolldelta(struct vc_data *c, int lines)
 {
 	return 0;
@@ -594,7 +589,6 @@
 	.con_bmove =		mdacon_bmove,
 	.con_switch =		mdacon_switch,
 	.con_blank =		mdacon_blank,
-	.con_font_op =		mdacon_font_op,
 	.con_set_palette =	mdacon_set_palette,
 	.con_scrolldelta =	mdacon_scrolldelta,
 	.con_build_attr =	mdacon_build_attr,
diff -urN linux-2.6.8-rc2/drivers/video/console/newport_con.c linux-2.6.8-rc3/drivers/video/console/newport_con.c
--- linux-2.6.8-rc2/drivers/video/console/newport_con.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/drivers/video/console/newport_con.c	2004-08-03 15:21:57.237567988 -0700
@@ -52,7 +52,7 @@
 static int newport_xsize;
 static int newport_ysize;
 
-static int newport_set_def_font(int unit, struct console_font_op *op);
+static int newport_set_def_font(int unit, struct console_font *op);
 
 #define BMASK(c) (c << 24)
 
@@ -477,7 +477,7 @@
 	return 1;
 }
 
-static int newport_set_font(int unit, struct console_font_op *op)
+static int newport_set_font(int unit, struct console_font *op)
 {
 	int w = op->width;
 	int h = op->height;
@@ -531,7 +531,7 @@
 	return 0;
 }
 
-static int newport_set_def_font(int unit, struct console_font_op *op)
+static int newport_set_def_font(int unit, struct console_font *op)
 {
 	if (font_data[unit] != FONT_DATA) {
 		if (--REFCOUNT(font_data[unit]) == 0)
@@ -543,18 +543,14 @@
 	return 0;
 }
 
-static int newport_font_op(struct vc_data *vc, struct console_font_op *op)
+static int newport_font_default(struct vc_data *vc, struct console_font *op, char *name)
 {
-	int unit = vc->vc_num;
+	return newport_set_def_font(vc->vc_num, op);
+}
 
-	switch (op->op) {
-	case KD_FONT_OP_SET:
-		return newport_set_font(unit, op);
-	case KD_FONT_OP_SET_DEFAULT:
-		return newport_set_def_font(unit, op);
-	default:
-		return -ENOSYS;
-	}
+static int newport_font_set(struct vc_data *vc, struct console_font *font, unsigned flags)
+{
+	return newport_set_font(vc->vc_num, font);
 }
 
 static int newport_set_palette(struct vc_data *vc, unsigned char *table)
@@ -717,7 +713,8 @@
     .con_bmove =	newport_bmove,
     .con_switch =	newport_switch,
     .con_blank =	newport_blank,
-    .con_font_op =	newport_font_op,
+    .con_font_set =	newport_font_set,
+    .con_font_default =	newport_font_default,
     .con_set_palette =	newport_set_palette,
     .con_scrolldelta =	newport_scrolldelta,
     .con_set_origin =	DUMMY,
diff -urN linux-2.6.8-rc2/drivers/video/console/promcon.c linux-2.6.8-rc3/drivers/video/console/promcon.c
--- linux-2.6.8-rc2/drivers/video/console/promcon.c	2004-06-15 22:19:36.000000000 -0700
+++ linux-2.6.8-rc3/drivers/video/console/promcon.c	2004-08-03 15:21:57.237567988 -0700
@@ -457,12 +457,6 @@
 }
 
 static int
-promcon_font_op(struct vc_data *conp, struct console_font_op *op)
-{
-	return -ENOSYS;
-}
-        
-static int
 promcon_blank(struct vc_data *conp, int blank, int mode_switch)
 {
 	if (blank) {
@@ -586,7 +580,6 @@
 	.con_bmove =		promcon_bmove,
 	.con_switch =		promcon_switch,
 	.con_blank =		promcon_blank,
-	.con_font_op =		promcon_font_op,
 	.con_set_palette =	DUMMY,
 	.con_scrolldelta =	DUMMY,
 #if !(PROMCON_COLOR)
diff -urN linux-2.6.8-rc2/drivers/video/console/sticon.c linux-2.6.8-rc3/drivers/video/console/sticon.c
--- linux-2.6.8-rc2/drivers/video/console/sticon.c	2004-06-15 22:19:43.000000000 -0700
+++ linux-2.6.8-rc3/drivers/video/console/sticon.c	2004-08-03 15:21:57.238568029 -0700
@@ -85,11 +85,6 @@
     return -EINVAL;
 }
 
-static int sticon_font_op(struct vc_data *c, struct console_font_op *op)
-{
-    return -ENOSYS;
-}
-
 static void sticon_putc(struct vc_data *conp, int c, int ypos, int xpos)
 {
     int unit = conp->vc_num;
@@ -366,7 +361,6 @@
 	.con_bmove		= sticon_bmove,
 	.con_switch		= sticon_switch,
 	.con_blank		= sticon_blank,
-	.con_font_op		= sticon_font_op,
 	.con_set_palette	= sticon_set_palette,
 	.con_scrolldelta	= sticon_scrolldelta,
 	.con_set_origin		= sticon_set_origin,
diff -urN linux-2.6.8-rc2/drivers/video/console/vgacon.c linux-2.6.8-rc3/drivers/video/console/vgacon.c
--- linux-2.6.8-rc2/drivers/video/console/vgacon.c	2004-08-03 15:21:09.862624541 -0700
+++ linux-2.6.8-rc3/drivers/video/console/vgacon.c	2004-08-03 15:21:57.242568193 -0700
@@ -77,7 +77,6 @@
 static void vgacon_cursor(struct vc_data *c, int mode);
 static int vgacon_switch(struct vc_data *c);
 static int vgacon_blank(struct vc_data *c, int blank, int mode_switch);
-static int vgacon_font_op(struct vc_data *c, struct console_font_op *op);
 static int vgacon_set_palette(struct vc_data *vc, unsigned char *table);
 static int vgacon_scrolldelta(struct vc_data *c, int lines);
 static int vgacon_set_origin(struct vc_data *c);
@@ -908,39 +907,44 @@
 	return 0;
 }
 
-static int vgacon_font_op(struct vc_data *c, struct console_font_op *op)
+static int vgacon_font_set(struct vc_data *c, struct console_font *font, unsigned flags)
 {
+	unsigned charcount = font->charcount;
 	int rc;
 
 	if (vga_video_type < VIDEO_TYPE_EGAM)
 		return -EINVAL;
 
-	if (op->op == KD_FONT_OP_SET) {
-		if (op->width != 8
-		    || (op->charcount != 256 && op->charcount != 512))
-			return -EINVAL;
-		rc = vgacon_do_font_op(&state, op->data, 1, op->charcount == 512);
-		if (!rc && !(op->flags & KD_FONT_FLAG_DONT_RECALC))
-			rc = vgacon_adjust_height(c, op->height);
-	} else if (op->op == KD_FONT_OP_GET) {
-		op->width = 8;
-		op->height = c->vc_font.height;
-		op->charcount = vga_512_chars ? 512 : 256;
-		if (!op->data)
-			return 0;
-		rc = vgacon_do_font_op(&state, op->data, 0, 0);
-	} else
-		rc = -ENOSYS;
+	if (font->width != 8 || (charcount != 256 && charcount != 512))
+		return -EINVAL;
+
+	rc = vgacon_do_font_op(&state, font->data, 1, charcount == 512);
+	if (rc)
+		return rc;
+
+	if (!(flags & KD_FONT_FLAG_DONT_RECALC))
+		rc = vgacon_adjust_height(c, font->height);
 	return rc;
 }
 
-#else
-
-static int vgacon_font_op(struct vc_data *c, struct console_font_op *op)
+static int vgacon_font_get(struct vc_data *c, struct console_font *font)
 {
-	return -ENOSYS;
+	if (vga_video_type < VIDEO_TYPE_EGAM)
+		return -EINVAL;
+
+	font->width = 8;
+	font->height = c->vc_font.height;
+	font->charcount = vga_512_chars ? 512 : 256;
+	if (!font->data)
+		return 0;
+	return vgacon_do_font_op(&state, font->data, 0, 0);
 }
 
+#else
+
+#define vgacon_font_set NULL
+#define vgacon_font_get NULL
+
 #endif
 
 static int vgacon_scrolldelta(struct vc_data *c, int lines)
@@ -1079,7 +1083,8 @@
 	.con_bmove = DUMMY,
 	.con_switch = vgacon_switch,
 	.con_blank = vgacon_blank,
-	.con_font_op = vgacon_font_op,
+	.con_font_set = vgacon_font_set,
+	.con_font_get = vgacon_font_get,
 	.con_set_palette = vgacon_set_palette,
 	.con_scrolldelta = vgacon_scrolldelta,
 	.con_set_origin = vgacon_set_origin,
diff -urN linux-2.6.8-rc2/drivers/video/dnfb.c linux-2.6.8-rc3/drivers/video/dnfb.c
--- linux-2.6.8-rc2/drivers/video/dnfb.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/drivers/video/dnfb.c	2004-08-03 15:21:57.244568275 -0700
@@ -118,23 +118,23 @@
 };
 
 struct fb_var_screeninfo dnfb_var __devinitdata = {
-	.xres		1280,
-	.yres		1024,
-	.xres_virtual	2048,
-	.yres_virtual	1024,
-	.bits_per_pixel	1,
-	.height		-1,
-	.width		-1,
-	.vmode		FB_VMODE_NONINTERLACED,
+	.xres		= 1280,
+	.yres		= 1024,
+	.xres_virtual	= 2048,
+	.yres_virtual	= 1024,
+	.bits_per_pixel	= 1,
+	.height		= -1,
+	.width		= -1,
+	.vmode		= FB_VMODE_NONINTERLACED,
 };
 
 static struct fb_fix_screeninfo dnfb_fix __devinitdata = {
-	.id		"Apollo Mono",
-	.smem_start	(FRAME_BUFFER_START + IO_BASE),
-	.smem_len	FRAME_BUFFER_LEN,
-	.type		FB_TYPE_PACKED_PIXELS,
-	.visual		FB_VISUAL_MONO10,
-	.line_length	256,
+	.id		= "Apollo Mono",
+	.smem_start	= (FRAME_BUFFER_START + IO_BASE),
+	.smem_len	= FRAME_BUFFER_LEN,
+	.type		= FB_TYPE_PACKED_PIXELS,
+	.visual		= FB_VISUAL_MONO10,
+	.line_length	= 256,
 };
 
 static int dnfb_blank(int blank, struct fb_info *info)
diff -urN linux-2.6.8-rc2/drivers/video/fbcmap.c linux-2.6.8-rc3/drivers/video/fbcmap.c
--- linux-2.6.8-rc2/drivers/video/fbcmap.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/drivers/video/fbcmap.c	2004-08-03 15:21:57.245568316 -0700
@@ -111,7 +111,7 @@
     }
     cmap->start = 0;
     cmap->len = len;
-    fb_copy_cmap(fb_default_cmap(len), cmap, 0);
+    fb_copy_cmap(fb_default_cmap(len), cmap);
     return 0;
 
 fail:
@@ -143,53 +143,50 @@
  *	fb_copy_cmap - copy a colormap
  *	@from: frame buffer colormap structure
  *	@to: frame buffer colormap structure
- *	@fsfromto: determine copy method
  *
  *	Copy contents of colormap from @from to @to.
- *
- *	@fsfromto accepts the following integer parameters:
- *	0: memcpy function
- *	1: copy_from_user() function to copy from userspace
- *	2: copy_to_user() function to copy to userspace
- *
  */
 
-int fb_copy_cmap(struct fb_cmap *from, struct fb_cmap *to, int fsfromto)
+int fb_copy_cmap(struct fb_cmap *from, struct fb_cmap *to)
 {
-    int tooff = 0, fromoff = 0;
-    int size;
-    
-    if (to->start > from->start)
-	fromoff = to->start-from->start;
-    else
-	tooff = from->start-to->start;
-    size = to->len-tooff;
-    if (size > (int) (from->len - fromoff))
-	size = from->len-fromoff;
-    if (size <= 0)
-	return -EINVAL;
-    size *= sizeof(u16);
-    
-    switch (fsfromto) {
-    case 0:
+	int tooff = 0, fromoff = 0;
+	int size;
+
+	if (to->start > from->start)
+		fromoff = to->start - from->start;
+	else
+		tooff = from->start - to->start;
+	size = to->len - tooff;
+	if (size > (int) (from->len - fromoff))
+		size = from->len - fromoff;
+	if (size <= 0)
+		return -EINVAL;
+	size *= sizeof(u16);
+
 	memcpy(to->red+tooff, from->red+fromoff, size);
 	memcpy(to->green+tooff, from->green+fromoff, size);
 	memcpy(to->blue+tooff, from->blue+fromoff, size);
 	if (from->transp && to->transp)
-	    memcpy(to->transp+tooff, from->transp+fromoff, size);
-        break;
-    case 1:
-	if (copy_from_user(to->red+tooff, from->red+fromoff, size))
-		return -EFAULT;
-	if (copy_from_user(to->green+tooff, from->green+fromoff, size))
-		return -EFAULT;	
-	if (copy_from_user(to->blue+tooff, from->blue+fromoff, size))
-		return -EFAULT;
-	if (from->transp && to->transp)
-            if (copy_from_user(to->transp+tooff, from->transp+fromoff, size))
-		    return -EFAULT;	
-	break;
-    case 2:
+		memcpy(to->transp+tooff, from->transp+fromoff, size);
+	return 0;
+}
+
+int fb_cmap_to_user(struct fb_cmap *from, struct fb_cmap_user *to)
+{
+	int tooff = 0, fromoff = 0;
+	int size;
+
+	if (to->start > from->start)
+		fromoff = to->start - from->start;
+	else
+		tooff = from->start - to->start;
+	size = to->len - tooff;
+	if (size > (int) (from->len - fromoff))
+		size = from->len - fromoff;
+	if (size <= 0)
+		return -EINVAL;
+	size *= sizeof(u16);
+
 	if (copy_to_user(to->red+tooff, from->red+fromoff, size))
 		return -EFAULT;
 	if (copy_to_user(to->green+tooff, from->green+fromoff, size))
@@ -199,15 +196,12 @@
 	if (from->transp && to->transp)
 		if (copy_to_user(to->transp+tooff, from->transp+fromoff, size))
 			return -EFAULT;
-	break;
-    }
-    return 0;
+	return 0;
 }
 
 /**
  *	fb_set_cmap - set the colormap
  *	@cmap: frame buffer colormap structure
- *	@kspc: boolean, 1 copy local, 0 get_user() function
  *	@info: frame buffer info structure
  *
  *	Sets the colormap @cmap for a screen of device @info.
@@ -216,46 +210,63 @@
  *
  */
 
-int fb_set_cmap(struct fb_cmap *cmap, int kspc, struct fb_info *info)
+int fb_set_cmap(struct fb_cmap *cmap, struct fb_info *info)
 {
-    int i, start;
-    u16 *red, *green, *blue, *transp;
-    u_int hred, hgreen, hblue, htransp;
-
-    red = cmap->red;
-    green = cmap->green;
-    blue = cmap->blue;
-    transp = cmap->transp;
-    start = cmap->start;
-
-    if (start < 0 || !info->fbops->fb_setcolreg)
-	return -EINVAL;
-    for (i = 0; i < cmap->len; i++) {
-	if (kspc) {
-	    hred = *red;
-	    hgreen = *green;
-	    hblue = *blue;
-	    htransp = transp ? *transp : 0xffff;
-	} else {
-	    get_user(hred, red);
-	    get_user(hgreen, green);
-	    get_user(hblue, blue);
-	    if (transp)
-		get_user(htransp, transp);
-	    else
-		htransp = 0xffff;
+	int i, start;
+	u16 *red, *green, *blue, *transp;
+	u_int hred, hgreen, hblue, htransp = 0xffff;
+
+	red = cmap->red;
+	green = cmap->green;
+	blue = cmap->blue;
+	transp = cmap->transp;
+	start = cmap->start;
+
+	if (start < 0 || !info->fbops->fb_setcolreg)
+		return -EINVAL;
+	for (i = 0; i < cmap->len; i++) {
+		hred = *red++;
+		hgreen = *green++;
+		hblue = *blue++;
+		if (transp)
+			htransp = *transp++;
+		if (info->fbops->fb_setcolreg(start++,
+					      hred, hgreen, hblue, htransp,
+					      info))
+			break;
 	}
-	red++;
-	green++;
-	blue++;
-	if (transp)
-	    transp++;
-	if (info->fbops->fb_setcolreg(start++, hred, hgreen, hblue, htransp, info))
-	    return 0;
-    }
-    return 0;
+	return 0;
 }
 
+int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
+{
+	int i, start;
+	u16 __user *red, *green, *blue, *transp;
+	u_int hred, hgreen, hblue, htransp = 0xffff;
+
+	red = cmap->red;
+	green = cmap->green;
+	blue = cmap->blue;
+	transp = cmap->transp;
+	start = cmap->start;
+
+	if (start < 0 || !info->fbops->fb_setcolreg)
+		return -EINVAL;
+	for (i = 0; i < cmap->len; i++, red++, blue++, green++) {
+		if (get_user(hred, red) ||
+		    get_user(hgreen, green) ||
+		    get_user(hblue, blue) ||
+		    (transp && get_user(htransp, transp)))
+			return -EFAULT;
+		if (info->fbops->fb_setcolreg(start++,
+					      hred, hgreen, hblue, htransp,
+					      info))
+			return 0;
+		if (transp)
+			transp++;
+	}
+	return 0;
+}
 
 /**
  *	fb_default_cmap - get default colormap
diff -urN linux-2.6.8-rc2/drivers/video/fbmem.c linux-2.6.8-rc3/drivers/video/fbmem.c
--- linux-2.6.8-rc2/drivers/video/fbmem.c	2004-08-03 15:21:09.864624623 -0700
+++ linux-2.6.8-rc3/drivers/video/fbmem.c	2004-08-03 15:21:57.247568399 -0700
@@ -563,7 +563,7 @@
 	return n < 0 ? d >> -n : d << n;
 }
 
-static void __init fb_set_logocmap(struct fb_info *info,
+static void fb_set_logocmap(struct fb_info *info,
 				   const struct linux_logo *logo)
 {
 	struct fb_cmap palette_cmap;
@@ -593,11 +593,11 @@
 			palette_cmap.blue[j] = clut[2] << 8 | clut[2];
 			clut += 3;
 		}
-		fb_set_cmap(&palette_cmap, 1, info);
+		fb_set_cmap(&palette_cmap, info);
 	}
 }
 
-static void  __init fb_set_logo_truepalette(struct fb_info *info,
+static void  fb_set_logo_truepalette(struct fb_info *info,
 					    const struct linux_logo *logo,
 					    u32 *palette)
 {
@@ -627,7 +627,7 @@
 	}
 }
 
-static void __init fb_set_logo_directpalette(struct fb_info *info,
+static void fb_set_logo_directpalette(struct fb_info *info,
 					     const struct linux_logo *logo,
 					     u32 *palette)
 {
@@ -642,7 +642,7 @@
 		palette[i] = i << redshift | i << greenshift | i << blueshift;
 }
 
-static void __init fb_set_logo(struct fb_info *info,
+static void fb_set_logo(struct fb_info *info,
 			       const struct linux_logo *logo, u8 *dst,
 			       int depth)
 {
@@ -938,53 +938,93 @@
 }
 
 int
-fb_cursor(struct fb_info *info, struct fb_cursor __user *sprite)
+fb_cursor(struct fb_info *info, struct fb_cursor_user __user *sprite)
 {
+	struct fb_cursor_user cursor_user;
 	struct fb_cursor cursor;
-	int err;
+	char *data = NULL, *mask = NULL;
+	u16 *red = NULL, *green = NULL, *blue = NULL, *transp = NULL;
+	int err = -EINVAL;
 	
-	if (copy_from_user(&cursor, sprite, sizeof(struct fb_cursor)))
+	if (copy_from_user(&cursor_user, sprite, sizeof(struct fb_cursor_user)))
 		return -EFAULT;
 
+	memcpy(&cursor, &cursor_user, sizeof(cursor));
+	cursor.mask = NULL;
+	cursor.image.data = NULL;
+	cursor.image.cmap.red = NULL;
+	cursor.image.cmap.green = NULL;
+	cursor.image.cmap.blue = NULL;
+	cursor.image.cmap.transp = NULL;
+
 	if (cursor.set & FB_CUR_SETCUR)
 		info->cursor.enable = 1;
 	
 	if (cursor.set & FB_CUR_SETCMAP) {
-		err = fb_copy_cmap(&cursor.image.cmap, &sprite->image.cmap, 1);
-		if (err)
-			return err;
+		unsigned len = cursor.image.cmap.len;
+		if ((int)len <= 0)
+			goto out;
+		len *= 2;
+		err = -ENOMEM;
+		red = kmalloc(len, GFP_USER);
+		green = kmalloc(len, GFP_USER);
+		blue = kmalloc(len, GFP_USER);
+		if (!red || !green || !blue)
+			goto out;
+		if (cursor_user.image.cmap.transp) {
+			transp = kmalloc(len, GFP_USER);
+			if (!transp)
+				goto out;
+		}
+		err = -EFAULT;
+		if (copy_from_user(red, cursor_user.image.cmap.red, len))
+			goto out;
+		if (copy_from_user(green, cursor_user.image.cmap.green, len))
+			goto out;
+		if (copy_from_user(blue, cursor_user.image.cmap.blue, len))
+			goto out;
+		if (transp) {
+			if (copy_from_user(transp,
+					   cursor_user.image.cmap.transp, len))
+				goto out;
+		}
+		cursor.image.cmap.red = red;
+		cursor.image.cmap.green = green;
+		cursor.image.cmap.blue = blue;
+		cursor.image.cmap.transp = transp;
 	}
 	
 	if (cursor.set & FB_CUR_SETSHAPE) {
 		int size = ((cursor.image.width + 7) >> 3) * cursor.image.height;		
-		char *data, *mask;
 
 		if ((cursor.image.height != info->cursor.image.height) ||
 		    (cursor.image.width != info->cursor.image.width))
 			cursor.set |= FB_CUR_SETSIZE;
 		
-		data = kmalloc(size, GFP_KERNEL);
-		if (!data)
-			return -ENOMEM;
+		err = -ENOMEM;
+		data = kmalloc(size, GFP_USER);
+		mask = kmalloc(size, GFP_USER);
+		if (!mask || !data)
+			goto out;
 		
-		mask = kmalloc(size, GFP_KERNEL);
-		if (!mask) {
-			kfree(data);
-			return -ENOMEM;
-		}
+		err = -EFAULT;
+		if (copy_from_user(data, cursor_user.image.data, size) ||
+		    copy_from_user(mask, cursor_user.mask, size))
+			goto out;
 		
-		if (copy_from_user(data, cursor.image.data, size) ||
-		    copy_from_user(mask, cursor.mask, size)) {
-			kfree(data);
-			kfree(mask);
-			return -EFAULT;
-		}
 		cursor.image.data = data;
 		cursor.mask = mask;
 	}
 	info->cursor.set = cursor.set;
 	info->cursor.rop = cursor.rop;
 	err = info->fbops->fb_cursor(info, &cursor);
+out:
+	kfree(data);
+	kfree(mask);
+	kfree(red);
+	kfree(green);
+	kfree(blue);
+	kfree(transp);
 	return err;
 }
 
@@ -1033,7 +1073,7 @@
 
 			fb_pan_display(info, &info->var);
 
-			fb_set_cmap(&info->cmap, 1, info);
+			fb_set_cmap(&info->cmap, info);
 
 			if (info->flags & FBINFO_MISC_MODECHANGEUSER) {
 				info->flags &= ~FBINFO_MISC_MODECHANGEUSER;
@@ -1062,7 +1102,7 @@
 		cmap.len = info->cmap.len;
 	} else
 		cmap = info->cmap;
-	return fb_set_cmap(&cmap, 1, info);
+	return fb_set_cmap(&cmap, info);
 }
 
 static int 
@@ -1077,7 +1117,7 @@
 #ifdef CONFIG_FRAMEBUFFER_CONSOLE
 	struct fb_con2fbmap con2fb;
 #endif
-	struct fb_cmap cmap;
+	struct fb_cmap_user cmap;
 	void __user *argp = (void __user *)arg;
 	int i;
 	
@@ -1105,11 +1145,11 @@
 	case FBIOPUTCMAP:
 		if (copy_from_user(&cmap, argp, sizeof(cmap)))
 			return -EFAULT;
-		return (fb_set_cmap(&cmap, 0, info));
+		return (fb_set_user_cmap(&cmap, info));
 	case FBIOGETCMAP:
 		if (copy_from_user(&cmap, argp, sizeof(cmap)))
 			return -EFAULT;
-		return (fb_copy_cmap(&info->cmap, &cmap, 2));
+		return fb_cmap_to_user(&info->cmap, &cmap);
 	case FBIOPAN_DISPLAY:
 		if (copy_from_user(&var, argp, sizeof(var)))
 			return -EFAULT;
diff -urN linux-2.6.8-rc2/drivers/video/matrox/matroxfb_base.h linux-2.6.8-rc3/drivers/video/matrox/matroxfb_base.h
--- linux-2.6.8-rc2/drivers/video/matrox/matroxfb_base.h	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/drivers/video/matrox/matroxfb_base.h	2004-08-03 15:21:57.446576562 -0700
@@ -217,21 +217,21 @@
 #ifdef MEMCPYTOIO_WORKS
 	memcpy_toio(va.vaddr + offs, src, len);
 #elif defined(MEMCPYTOIO_WRITEL)
-#define srcd ((const u_int32_t*)src)
 	if (offs & 3) {
 		while (len >= 4) {
-			mga_writel(va, offs, get_unaligned(srcd++));
+			mga_writel(va, offs, get_unaligned((u32 *)src));
 			offs += 4;
 			len -= 4;
+			src += 4;
 		}
 	} else {
 		while (len >= 4) {
-			mga_writel(va, offs, *srcd++);
+			mga_writel(va, offs, *(u32 *)src);
 			offs += 4;
 			len -= 4;
+			src += 4;
 		}
 	}
-#undef srcd
 	if (len) {
 		u_int32_t tmp;
 
diff -urN linux-2.6.8-rc2/drivers/video/offb.c linux-2.6.8-rc3/drivers/video/offb.c
--- linux-2.6.8-rc2/drivers/video/offb.c	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/drivers/video/offb.c	2004-08-03 15:21:57.465577342 -0700
@@ -235,7 +235,7 @@
 				break;
 			}
 	} else
-		fb_set_cmap(&info->cmap, 1, info);
+		fb_set_cmap(&info->cmap, info);
 	return 0;
 }
 
diff -urN linux-2.6.8-rc2/drivers/video/pxafb.c linux-2.6.8-rc3/drivers/video/pxafb.c
--- linux-2.6.8-rc2/drivers/video/pxafb.c	2004-08-03 15:21:09.873624992 -0700
+++ linux-2.6.8-rc3/drivers/video/pxafb.c	2004-08-03 15:21:57.502578860 -0700
@@ -386,7 +386,7 @@
 		//TODO if (pxafb_blank_helper) pxafb_blank_helper(blank);
 		if (fbi->fb.fix.visual == FB_VISUAL_PSEUDOCOLOR ||
 		    fbi->fb.fix.visual == FB_VISUAL_STATIC_PSEUDOCOLOR)
-			fb_set_cmap(&fbi->fb.cmap, 1, info);
+			fb_set_cmap(&fbi->fb.cmap, info);
 		pxafb_schedule_work(fbi, C_ENABLE);
 	}
 	return 0;
diff -urN linux-2.6.8-rc2/drivers/video/radeonfb.c linux-2.6.8-rc3/drivers/video/radeonfb.c
--- linux-2.6.8-rc2/drivers/video/radeonfb.c	2004-08-03 15:21:09.876625115 -0700
+++ linux-2.6.8-rc3/drivers/video/radeonfb.c	2004-08-03 15:21:57.505578983 -0700
@@ -1221,7 +1221,7 @@
 
 	dp = pci_device_to_OF_node(rinfo->pdev);
 
-	xtal = (unsigned int *) get_property(dp, "ATY,RefCLK", 0);
+	xtal = (unsigned int *) get_property(dp, "ATY,RefCLK", NULL);
 
 	rinfo->pll.ref_clk = *xtal / 10;
 
diff -urN linux-2.6.8-rc2/drivers/video/riva/fbdev.c linux-2.6.8-rc3/drivers/video/riva/fbdev.c
--- linux-2.6.8-rc2/drivers/video/riva/fbdev.c	2004-08-03 15:21:09.879625238 -0700
+++ linux-2.6.8-rc3/drivers/video/riva/fbdev.c	2004-08-03 15:21:57.518579516 -0700
@@ -48,6 +48,9 @@
 #include <asm/prom.h>
 #include <asm/pci-bridge.h>
 #endif
+#ifdef CONFIG_PMAC_BACKLIGHT
+#include <asm/backlight.h>
+#endif
 
 #include "rivafb.h"
 #include "nvreg.h"
@@ -64,15 +67,16 @@
  * various helpful macros and constants
  *
  * ------------------------------------------------------------------------- */
-
-#undef RIVAFBDEBUG
-#ifdef RIVAFBDEBUG
-#define DPRINTK(fmt, args...) printk(KERN_DEBUG "%s: " fmt, __FUNCTION__ , ## args)
+#ifdef CONFIG_FB_RIVA_DEBUG
+#define NVTRACE          printk
 #else
-#define DPRINTK(fmt, args...)
+#define NVTRACE          if(0) printk
 #endif
 
-#ifndef RIVA_NDEBUG
+#define NVTRACE_ENTER(...)  NVTRACE("%s START\n", __FUNCTION__)
+#define NVTRACE_LEAVE(...)  NVTRACE("%s END\n", __FUNCTION__)
+
+#ifdef CONFIG_FB_RIVA_DEBUG
 #define assert(expr) \
 	if(!(expr)) { \
 	printk( "Assertion failed! %s,%s,%s,line=%d\n",\
@@ -173,18 +177,18 @@
 	{ "GeForce2-GTS", NV_ARCH_10 },
 	{ "GeForce2-ULTRA", NV_ARCH_10 },
 	{ "Quadro2-PRO", NV_ARCH_10 },
-	{ "GeForce4-MX-460", NV_ARCH_20 },
-	{ "GeForce4-MX-440", NV_ARCH_20 },
-	{ "GeForce4-MX-420", NV_ARCH_20 },
-	{ "GeForce4-440-GO", NV_ARCH_20 },
-	{ "GeForce4-420-GO", NV_ARCH_20 },
-	{ "GeForce4-420-GO-M32", NV_ARCH_20 },
-	{ "Quadro4-500-XGL", NV_ARCH_20 },
-	{ "GeForce4-440-GO-M64", NV_ARCH_20 },
-	{ "Quadro4-200", NV_ARCH_20 },
-	{ "Quadro4-550-XGL", NV_ARCH_20 },
-	{ "Quadro4-500-GOGL", NV_ARCH_20 },
-	{ "GeForce2", NV_ARCH_20 },
+	{ "GeForce4-MX-460", NV_ARCH_10 },
+	{ "GeForce4-MX-440", NV_ARCH_10 },
+	{ "GeForce4-MX-420", NV_ARCH_10 },
+	{ "GeForce4-440-GO", NV_ARCH_10 },
+	{ "GeForce4-420-GO", NV_ARCH_10 },
+	{ "GeForce4-420-GO-M32", NV_ARCH_10 },
+	{ "Quadro4-500-XGL", NV_ARCH_10 },
+	{ "GeForce4-440-GO-M64", NV_ARCH_10 },
+	{ "Quadro4-200", NV_ARCH_10 },
+	{ "Quadro4-550-XGL", NV_ARCH_10 },
+	{ "Quadro4-500-GOGL", NV_ARCH_10 },
+	{ "GeForce2", NV_ARCH_10 },
 	{ "GeForce3", NV_ARCH_20 }, 
 	{ "GeForce3 Ti 200", NV_ARCH_20 },
 	{ "GeForce3 Ti 500", NV_ARCH_20 },
@@ -351,6 +355,38 @@
 	0xEB							/* MISC */
 };
 
+/*
+ * Backlight control
+ */
+#ifdef CONFIG_PMAC_BACKLIGHT
+
+static int riva_backlight_levels[] = {
+    0x158,
+    0x192,
+    0x1c6,
+    0x200,
+    0x234,
+    0x268,
+    0x2a2,
+    0x2d6,
+    0x310,
+    0x344,
+    0x378,
+    0x3b2,
+    0x3e6,
+    0x41a,
+    0x454,
+    0x534,
+};
+
+static int riva_set_backlight_enable(int on, int level, void *data);
+static int riva_set_backlight_level(int level, void *data);
+static struct backlight_controller riva_backlight_controller = {
+	riva_set_backlight_enable,
+	riva_set_backlight_level
+};
+#endif /* CONFIG_PMAC_BACKLIGHT */
+
 /* ------------------------------------------------------------------------- *
  *
  * MMIO access macros
@@ -592,6 +628,7 @@
 {
 	int i;
 
+	NVTRACE_ENTER();
 	par->riva.LockUnlock(&par->riva, 0);
 
 	par->riva.UnloadStateExt(&par->riva, &regs->ext);
@@ -609,6 +646,7 @@
 
 	for (i = 0; i < NUM_SEQ_REGS; i++)
 		regs->seq[i] = SEQin(par, i);
+	NVTRACE_LEAVE();
 }
 
 /**
@@ -630,6 +668,7 @@
 	RIVA_HW_STATE *state = &regs->ext;
 	int i;
 
+	NVTRACE_ENTER();
 	CRTCout(par, 0x11, 0x00);
 
 	par->riva.LockUnlock(&par->riva, 0);
@@ -656,6 +695,7 @@
 
 	for (i = 0; i < NUM_SEQ_REGS; i++)
 		SEQout(par, i, regs->seq[i]);
+	NVTRACE_LEAVE();
 }
 
 /**
@@ -676,6 +716,7 @@
 	struct riva_par *par = (struct riva_par *) info->par;
 	struct riva_regs newmode;
 	
+	NVTRACE_ENTER();
 	/* time to calculate */
 	rivafb_blank(1, info);
 
@@ -806,10 +847,12 @@
 	riva_load_state(par, &par->current_state);
 	par->riva.LockUnlock(&par->riva, 0); /* important for HW cursor */
 	rivafb_blank(0, info);
+	NVTRACE_LEAVE();
 }
 
 static void riva_update_var(struct fb_var_screeninfo *var, struct fb_videomode *modedb)
 {
+	NVTRACE_ENTER();
 	var->xres = var->xres_virtual = modedb->xres;
 	var->yres = modedb->yres;
         if (var->yres_virtual < var->yres)
@@ -824,6 +867,7 @@
         var->vsync_len = modedb->vsync_len;
         var->sync = modedb->sync;
         var->vmode = modedb->vmode;
+	NVTRACE_LEAVE();
 }
 
 /**
@@ -859,6 +903,7 @@
 	};
 	int i;
 
+	NVTRACE_ENTER();
 	/* use highest possible virtual resolution */
 	if (var->xres_virtual == -1 && var->yres_virtual == -1) {
 		printk(KERN_WARNING PFX
@@ -871,7 +916,7 @@
 		if (modes[i].xres == -1) {
 			printk(KERN_ERR PFX
 			       "could not find a virtual resolution that fits into video memory!!\n");
-			DPRINTK("EXIT - EINVAL error\n");
+			NVTRACE("EXIT - EINVAL error\n");
 			return -EINVAL;
 		}
 		var->xres_virtual = modes[i].xres;
@@ -897,7 +942,7 @@
 			printk(KERN_ERR PFX
 			       "mode %dx%dx%d rejected...resolution too high to fit into video memory!\n",
 			       var->xres, var->yres, var->bits_per_pixel);
-			DPRINTK("EXIT - EINVAL error\n");
+			NVTRACE("EXIT - EINVAL error\n");
 			return -EINVAL;
 		}
 	}
@@ -924,7 +969,7 @@
 		var->yres_virtual = 0x7fff/nom;
 	if (var->xres_virtual > 0x7fff/nom)
 		var->xres_virtual = 0x7fff/nom;
-
+	NVTRACE_LEAVE();
 	return 0;
 }
 
@@ -1004,6 +1049,36 @@
 
 /* ------------------------------------------------------------------------- *
  *
+ * Backlight operations
+ *
+ * ------------------------------------------------------------------------- */
+
+#ifdef CONFIG_PMAC_BACKLIGHT
+static int riva_set_backlight_enable(int on, int level, void *data)
+{
+	struct riva_par *par = (struct riva_par *)data;
+	U032 tmp_pcrt, tmp_pmc;
+
+	tmp_pmc = par->riva.PMC[0x10F0/4] & 0x0000FFFF;
+	tmp_pcrt = par->riva.PCRTC0[0x081C/4] & 0xFFFFFFFC;
+	if(on && (level > BACKLIGHT_OFF)) {
+		tmp_pcrt |= 0x1;
+		tmp_pmc |= (1 << 31); // backlight bit
+		tmp_pmc |= riva_backlight_levels[level-1] << 16; // level
+	}
+	par->riva.PCRTC0[0x081C/4] = tmp_pcrt;
+	par->riva.PMC[0x10F0/4] = tmp_pmc;
+	return 0;
+}
+
+static int riva_set_backlight_level(int level, void *data)
+{
+	return riva_set_backlight_enable(1, level, data);
+}
+#endif /* CONFIG_PMAC_BACKLIGHT */
+
+/* ------------------------------------------------------------------------- *
+ *
  * framebuffer operations
  *
  * ------------------------------------------------------------------------- */
@@ -1013,6 +1088,7 @@
 	struct riva_par *par = (struct riva_par *) info->par;
 	int cnt = atomic_read(&par->ref_count);
 
+	NVTRACE_ENTER();
 	if (!cnt) {
 		memset(&par->state, 0, sizeof(struct vgastate));
 		par->state.flags = VGA_SAVE_MODE  | VGA_SAVE_FONTS;
@@ -1029,6 +1105,7 @@
 		riva_save_state(par, &par->initial_state);
 	}
 	atomic_inc(&par->ref_count);
+	NVTRACE_LEAVE();
 	return 0;
 }
 
@@ -1037,6 +1114,7 @@
 	struct riva_par *par = (struct riva_par *) info->par;
 	int cnt = atomic_read(&par->ref_count);
 
+	NVTRACE_ENTER();
 	if (!cnt)
 		return -EINVAL;
 	if (cnt == 1) {
@@ -1047,6 +1125,7 @@
 		par->riva.LockUnlock(&par->riva, 1);
 	}
 	atomic_dec(&par->ref_count);
+	NVTRACE_LEAVE();
 	return 0;
 }
 
@@ -1056,6 +1135,7 @@
 	int nom, den;		/* translating from pixels->bytes */
 	int mode_valid = 0;
 	
+	NVTRACE_ENTER();
 	switch (var->bits_per_pixel) {
 	case 1 ... 8:
 		var->red.offset = var->green.offset = var->blue.offset = 0;
@@ -1101,7 +1181,7 @@
 		printk(KERN_ERR PFX
 		       "mode %dx%dx%d rejected...color depth not supported.\n",
 		       var->xres, var->yres, var->bits_per_pixel);
-		DPRINTK("EXIT, returning -EINVAL\n");
+		NVTRACE("EXIT, returning -EINVAL\n");
 		return -EINVAL;
 	}
 
@@ -1191,6 +1271,7 @@
 	    var->green.msb_right =
 	    var->blue.msb_right =
 	    var->transp.offset = var->transp.length = var->transp.msb_right = 0;
+	NVTRACE_LEAVE();
 	return 0;
 }
 
@@ -1198,6 +1279,7 @@
 {
 	struct riva_par *par = (struct riva_par *) info->par;
 
+	NVTRACE_ENTER();
 	riva_common_setup(par);
 	RivaGetConfig(&par->riva, par->Chipset);
 	/* vgaHWunlock() + riva unlock (0x7F) */
@@ -1211,6 +1293,7 @@
 	info->fix.line_length = (info->var.xres_virtual * (info->var.bits_per_pixel >> 3));
 	info->fix.visual = (info->var.bits_per_pixel == 8) ?
 				FB_VISUAL_PSEUDOCOLOR : FB_VISUAL_DIRECTCOLOR;
+	NVTRACE_LEAVE();
 	return 0;
 }
 
@@ -1233,6 +1316,7 @@
 	struct riva_par *par = (struct riva_par *)info->par;
 	unsigned int base;
 
+	NVTRACE_ENTER();
 	if (var->xoffset > (var->xres_virtual - var->xres))
 		return -EINVAL;
 	if (var->yoffset > (var->yres_virtual - var->yres))
@@ -1259,6 +1343,7 @@
 		info->var.vmode |= FB_VMODE_YWRAP;
 	else
 		info->var.vmode &= ~FB_VMODE_YWRAP;
+	NVTRACE_LEAVE();
 	return 0;
 }
 
@@ -1270,6 +1355,7 @@
 	tmp = SEQin(par, 0x01) & ~0x20;	/* screen on/off */
 	vesa = CRTCin(par, 0x1a) & ~0xc0;	/* sync on/off */
 
+	NVTRACE_ENTER();
 	if (blank) {
 		tmp |= 0x20;
 		switch (blank - 1) {
@@ -1288,6 +1374,14 @@
 	}
 	SEQout(par, 0x01, tmp);
 	CRTCout(par, 0x1a, vesa);
+
+#ifdef CONFIG_PMAC_BACKLIGHT
+	if ( par->FlatPanel && _machine == _MACH_Pmac) {
+		set_backlight_enable(!blank);
+	}
+#endif
+
+	NVTRACE_LEAVE();
 	return 0;
 }
 
@@ -1676,6 +1770,7 @@
 {
 	unsigned int cmap_len;
 
+	NVTRACE_ENTER();
 	info->flags = FBINFO_DEFAULT
 		    | FBINFO_HWACCEL_XPAN
 		    | FBINFO_HWACCEL_YPAN
@@ -1696,6 +1791,7 @@
 	info->pixmap.scan_align = 4;
 	info->pixmap.flags = FB_PIXMAP_SYSTEM;
 	info->var.yres_virtual = -1;
+	NVTRACE_LEAVE();
 	return (rivafb_check_var(&info->var, info));
 }
 
@@ -1710,6 +1806,7 @@
 		"DFP,EDID", "LCD,EDID", "EDID", "EDID1", "EDID,B", "EDID,A", NULL };
 	int i;
 
+	NVTRACE_ENTER();
 	dp = pci_device_to_OF_node(pd);
 	for (; dp != NULL; dp = dp->child) {
 		disptype = (unsigned char *)get_property(dp, "display-type", NULL);
@@ -1726,6 +1823,7 @@
 			}
 		}
 	}
+	NVTRACE_LEAVE();
 		return 0;
 }
 #endif /* CONFIG_PPC_OF */
@@ -1735,6 +1833,7 @@
 	struct fb_monspecs *specs = &info->monspecs;
 	struct fb_videomode modedb;
 
+	NVTRACE_ENTER();
 	/* respect mode options */
 	if (mode_option) {
 		fb_find_mode(var, info, mode_option,
@@ -1759,20 +1858,24 @@
 		riva_update_var(var, &modedb);
 	}
 	var->accel_flags |= FB_ACCELF_TEXT;
+	NVTRACE_LEAVE();
 }
 
 
 static void riva_get_EDID(struct fb_info *info, struct pci_dev *pdev)
 {
+	struct riva_par *par;
+	int i;
+
+	NVTRACE_ENTER();
 #ifdef CONFIG_PPC_OF
 	if (!riva_get_EDID_OF(info, pdev))
 		printk("rivafb: could not retrieve EDID from OF\n");
 #else
 	/* XXX use other methods later */
 #ifdef CONFIG_FB_RIVA_I2C
-	struct riva_par *par = (struct riva_par *) info->par;
-	int i;
 
+	par = (struct riva_par *) info->par;
 	riva_create_i2c_busses(par);
 	for (i = par->bus; i >= 1; i--) {
 		riva_probe_i2c_connector(par, i, &par->EDID);
@@ -1784,6 +1887,7 @@
 	riva_delete_i2c_busses(par);
 #endif
 #endif
+	NVTRACE_LEAVE();
 }
 
 
@@ -1813,6 +1917,7 @@
 	struct riva_par *default_par;
 	struct fb_info *info;
 
+	NVTRACE_ENTER();
 	assert(pd != NULL);
 	assert(rci != NULL);
 
@@ -1958,6 +2063,12 @@
 		info->fix.id,
 		info->fix.smem_len / (1024 * 1024),
 		info->fix.smem_start);
+#ifdef CONFIG_PMAC_BACKLIGHT
+	if (default_par->FlatPanel && _machine == _MACH_Pmac)
+	register_backlight_controller(&riva_backlight_controller,
+						default_par, "mnca");
+#endif
+	NVTRACE_LEAVE();
 	return 0;
 
 err_out_iounmap_fb:
@@ -1986,6 +2097,7 @@
 	struct fb_info *info = pci_get_drvdata(pd);
 	struct riva_par *par = (struct riva_par *) info->par;
 	
+	NVTRACE_ENTER();
 	if (!info)
 		return;
 
@@ -2007,6 +2119,7 @@
 	kfree(par);
 	kfree(info);
 	pci_set_drvdata(pd, NULL);
+	NVTRACE_LEAVE();
 }
 
 /* ------------------------------------------------------------------------- *
@@ -2020,6 +2133,7 @@
 {
 	char *this_opt;
 
+	NVTRACE_ENTER();
 	if (!options || !*options)
 		return 0;
 
@@ -2043,6 +2157,7 @@
 		} else
 			mode_option = this_opt;
 	}
+	NVTRACE_LEAVE();
 	return 0;
 }
 #endif /* !MODULE */
diff -urN linux-2.6.8-rc2/drivers/video/sa1100fb.c linux-2.6.8-rc3/drivers/video/sa1100fb.c
--- linux-2.6.8-rc2/drivers/video/sa1100fb.c	2004-08-03 15:21:09.884625443 -0700
+++ linux-2.6.8-rc3/drivers/video/sa1100fb.c	2004-08-03 15:21:57.616583536 -0700
@@ -1074,7 +1074,7 @@
 	case VESA_NO_BLANKING:
 		if (fbi->fb.fix.visual == FB_VISUAL_PSEUDOCOLOR ||
 		    fbi->fb.fix.visual == FB_VISUAL_STATIC_PSEUDOCOLOR)
-			fb_set_cmap(&fbi->fb.cmap, 1, info);
+			fb_set_cmap(&fbi->fb.cmap, info);
 		sa1100fb_schedule_work(fbi, C_ENABLE);
 	}
 	return 0;
diff -urN linux-2.6.8-rc2/drivers/video/sbuslib.c linux-2.6.8-rc3/drivers/video/sbuslib.c
--- linux-2.6.8-rc2/drivers/video/sbuslib.c	2004-06-15 22:19:03.000000000 -0700
+++ linux-2.6.8-rc3/drivers/video/sbuslib.c	2004-08-03 15:21:57.637584398 -0700
@@ -93,7 +93,7 @@
 {
 	switch(cmd) {
 	case FBIOGTYPE: {
-		struct fbtype *f = (struct fbtype *) arg;
+		struct fbtype __user *f = (struct fbtype __user *) arg;
 
 		if (put_user(type, &f->fb_type) ||
 		    __put_user(info->var.yres, &f->fb_height) ||
@@ -105,10 +105,12 @@
 		return 0;
 	}
 	case FBIOPUTCMAP_SPARC: {
-		struct fbcmap *c = (struct fbcmap *) arg;
+		struct fbcmap __user *c = (struct fbcmap __user *) arg;
 		struct fb_cmap cmap;
 		u16 red, green, blue;
-		unsigned char *ured, *ugreen, *ublue;
+		unsigned char __user *ured;
+		unsigned char __user *ugreen;
+		unsigned char __user *ublue;
 		int index, count, i;
 
 		if (get_user(index, &c->index) ||
@@ -132,15 +134,17 @@
 				return -EFAULT;
 
 			cmap.start = index + i;
-			err = fb_set_cmap(&cmap, 0, info);
+			err = fb_set_cmap(&cmap, info);
 			if (err)
 				return err;
 		}
 		return 0;
 	}
 	case FBIOGETCMAP_SPARC: {
-		struct fbcmap *c = (struct fbcmap *) arg;
-		unsigned char *ured, *ugreen, *ublue;
+		struct fbcmap __user *c = (struct fbcmap __user *) arg;
+		unsigned char __user *ured;
+		unsigned char __user *ugreen;
+		unsigned char __user *ublue;
 		struct fb_cmap *cmap = &info->cmap;
 		int index, count, i;
 
diff -urN linux-2.6.8-rc2/drivers/video/sis/sis_main.c linux-2.6.8-rc3/drivers/video/sis/sis_main.c
--- linux-2.6.8-rc2/drivers/video/sis/sis_main.c	2004-08-03 15:21:10.094634051 -0700
+++ linux-2.6.8-rc3/drivers/video/sis/sis_main.c	2004-08-03 15:21:58.299611556 -0700
@@ -1566,10 +1566,10 @@
         if(con != ivideo->currcon) return;
 
         if(fb_display[con].cmap.len) {
-		fb_set_cmap(&fb_display[con].cmap, 1, sisfb_setcolreg, info);
+		fb_set_cmap(&fb_display[con].cmap, sisfb_setcolreg, info);
         } else {
 		int size = sisfb_get_cmap_len(&fb_display[con].var);
-		fb_set_cmap(fb_default_cmap(size), 1, sisfb_setcolreg, info);
+		fb_set_cmap(fb_default_cmap(size), sisfb_setcolreg, info);
 	}
 }
 
diff -urN linux-2.6.8-rc2/drivers/video/softcursor.c linux-2.6.8-rc3/drivers/video/softcursor.c
--- linux-2.6.8-rc2/drivers/video/softcursor.c	2004-08-03 15:21:10.102634380 -0700
+++ linux-2.6.8-rc3/drivers/video/softcursor.c	2004-08-03 15:21:58.353613771 -0700
@@ -43,7 +43,7 @@
 			info->cursor.image.fg_color = cursor->image.fg_color;
 		} else {
 			if (cursor->image.cmap.len)
-				fb_copy_cmap(&cursor->image.cmap, &info->cursor.image.cmap, 0);
+				fb_copy_cmap(&cursor->image.cmap, &info->cursor.image.cmap);
 		}
 		info->cursor.image.depth = cursor->image.depth;
 	}	
diff -urN linux-2.6.8-rc2/drivers/video/tdfxfb.c linux-2.6.8-rc3/drivers/video/tdfxfb.c
--- linux-2.6.8-rc2/drivers/video/tdfxfb.c	2004-08-03 15:21:10.105634503 -0700
+++ linux-2.6.8-rc3/drivers/video/tdfxfb.c	2004-08-03 15:21:58.418616438 -0700
@@ -1050,7 +1050,7 @@
 		bg_color = ((cmap.red[cmap.start+1] << 16) |
 			    (cmap.green[cmap.start+1] << 8) |
 			    (cmap.blue[cmap.start+1]));
-		fb_copy_cmap(&cmap, &info->cursor.image.cmap, 0);
+		fb_copy_cmap(&cmap, &info->cursor.image.cmap);
 		spin_lock_irqsave(&par->DAClock, flags);
 		banshee_make_room(par, 2);
 		tdfx_outl(par, HWCURC0, bg_color);
diff -urN linux-2.6.8-rc2/drivers/video/valkyriefb.c linux-2.6.8-rc3/drivers/video/valkyriefb.c
--- linux-2.6.8-rc2/drivers/video/valkyriefb.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/drivers/video/valkyriefb.c	2004-08-03 15:21:58.418616438 -0700
@@ -118,9 +118,7 @@
 static int valkyriefb_blank(int blank_mode, struct fb_info *info);
 
 static int read_valkyrie_sense(struct fb_info_valkyrie *p);
-static inline int valkyrie_vram_reqd(int video_mode, int color_mode);
 static void set_valkyrie_clock(unsigned char *params);
-static inline int valkyrie_par_to_var(struct fb_par_valkyrie *par, struct fb_var_screeninfo *var);
 static int valkyrie_var_to_par(struct fb_var_screeninfo *var,
 	struct fb_par_valkyrie *par, const struct fb_info *fb_info);
 
@@ -171,6 +169,12 @@
 	return 0;
 }
 
+static inline int valkyrie_par_to_var(struct fb_par_valkyrie *par,
+				      struct fb_var_screeninfo *var)
+{
+	return mac_vmode_to_var(par->vmode, par->cmode, var);
+}
+
 static int
 valkyriefb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
 {
@@ -252,7 +256,7 @@
 	return 0;
 }
 
-static int valkyrie_vram_reqd(int video_mode, int color_mode)
+static inline int valkyrie_vram_reqd(int video_mode, int color_mode)
 {
 	int pitch;
 	struct valkyrie_regvals *init = valkyrie_reg_init[video_mode-1];
@@ -504,11 +508,6 @@
 	return 0;
 }
 
-static int valkyrie_par_to_var(struct fb_par_valkyrie *par, struct fb_var_screeninfo *var)
-{
-	return mac_vmode_to_var(par->vmode, par->cmode, var);
-}
-
 static void valkyrie_init_fix(struct fb_fix_screeninfo *fix, struct fb_info_valkyrie *p)
 {
 	memset(fix, 0, sizeof(*fix));
diff -urN linux-2.6.8-rc2/drivers/w1/Kconfig linux-2.6.8-rc3/drivers/w1/Kconfig
--- linux-2.6.8-rc2/drivers/w1/Kconfig	2004-08-03 15:21:10.107634585 -0700
+++ linux-2.6.8-rc3/drivers/w1/Kconfig	2004-08-03 15:21:58.460618161 -0700
@@ -13,7 +13,7 @@
 
 config W1_MATROX
 	tristate "Matrox G400 transport layer for 1-wire"
-	depends on W1
+	depends on W1 && PCI
 	help
 	  Say Y here if you want to communicate with your 1-wire devices
 	  using Matrox's G400 GPIO pins.
diff -urN linux-2.6.8-rc2/drivers/w1/matrox_w1.c linux-2.6.8-rc3/drivers/w1/matrox_w1.c
--- linux-2.6.8-rc2/drivers/w1/matrox_w1.c	2004-08-03 15:21:10.109634667 -0700
+++ linux-2.6.8-rc3/drivers/w1/matrox_w1.c	2004-08-03 15:21:58.461618202 -0700
@@ -22,8 +22,8 @@
 #include <asm/atomic.h>
 #include <asm/types.h>
 #include <asm/io.h>
-#include <asm/delay.h>
 
+#include <linux/delay.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/list.h>
diff -urN linux-2.6.8-rc2/drivers/w1/w1.c linux-2.6.8-rc3/drivers/w1/w1.c
--- linux-2.6.8-rc2/drivers/w1/w1.c	2004-08-03 15:21:10.110634708 -0700
+++ linux-2.6.8-rc3/drivers/w1/w1.c	2004-08-03 15:21:58.462618243 -0700
@@ -20,8 +20,8 @@
  */
 
 #include <asm/atomic.h>
-#include <asm/delay.h>
 
+#include <linux/delay.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
diff -urN linux-2.6.8-rc2/drivers/w1/w1_int.c linux-2.6.8-rc3/drivers/w1/w1_int.c
--- linux-2.6.8-rc2/drivers/w1/w1_int.c	2004-08-03 15:21:10.113634831 -0700
+++ linux-2.6.8-rc3/drivers/w1/w1_int.c	2004-08-03 15:21:58.465618366 -0700
@@ -49,7 +49,7 @@
 	dev = kmalloc(sizeof(struct w1_master) + sizeof(struct w1_bus_master), GFP_KERNEL);
 	if (!dev) {
 		printk(KERN_ERR
-			"Failed to allocate %d bytes for new w1 device.\n",
+			"Failed to allocate %zd bytes for new w1 device.\n",
 			sizeof(struct w1_master));
 		return NULL;
 	}
diff -urN linux-2.6.8-rc2/drivers/w1/w1_io.c linux-2.6.8-rc3/drivers/w1/w1_io.c
--- linux-2.6.8-rc2/drivers/w1/w1_io.c	2004-08-03 15:21:10.114634872 -0700
+++ linux-2.6.8-rc3/drivers/w1/w1_io.c	2004-08-03 15:21:58.466618407 -0700
@@ -20,8 +20,8 @@
  */
 
 #include <asm/io.h>
-#include <asm/delay.h>
 
+#include <linux/delay.h>
 #include <linux/moduleparam.h>
 
 #include "w1.h"
diff -urN linux-2.6.8-rc2/fs/Kconfig linux-2.6.8-rc3/fs/Kconfig
--- linux-2.6.8-rc2/fs/Kconfig	2004-08-03 15:21:10.164636923 -0700
+++ linux-2.6.8-rc3/fs/Kconfig	2004-08-03 15:21:58.516620458 -0700
@@ -554,44 +554,6 @@
 config FAT_FS
 	tristate
 	select NLS
-	help
-	  If you want to use one of the FAT-based file systems (the MS-DOS,
-	  VFAT (Windows 95) and UMSDOS (used to run Linux on top of an
-	  ordinary DOS partition) file systems), then you must say Y or M here
-	  to include FAT support. You will then be able to mount partitions or
-	  diskettes with FAT-based file systems and transparently access the
-	  files on them, i.e. MSDOS files will look and behave just like all
-	  other Unix files.
-
-	  This FAT support is not a file system in itself, it only provides
-	  the foundation for the other file systems. You will have to say Y or
-	  M to at least one of "MSDOS fs support" or "VFAT fs support" in
-	  order to make use of it.
-
-	  Another way to read and write MSDOS floppies and hard drive
-	  partitions from within Linux (but not transparently) is with the
-	  mtools ("man mtools") program suite. You don't need to say Y here in
-	  order to do that.
-
-	  If you need to move large files on floppies between a DOS and a
-	  Linux box, say Y here, mount the floppy under Linux with an MSDOS
-	  file system and use GNU tar's M option. GNU tar is a program
-	  available for Unix and DOS ("man tar" or "info tar").
-
-	  It is now also becoming possible to read and write compressed FAT
-	  file systems; read <file:Documentation/filesystems/fat_cvf.txt> for
-	  details.
-
-	  The FAT support will enlarge your kernel by about 37 KB. If unsure,
-	  say Y.
-
-	  To compile this as a module, choose M here: the module will be called
-	  fat.  Note that if you compile the FAT support as a module, you
-	  cannot compile any of the FAT-based file systems into the kernel
-	  -- they will have to be modules as well.
-	  The file system of your root partition (the one containing the
-	  directory /) cannot be a module, so don't say M here if you intend
-	  to use UMSDOS as your root file system.
 
 config MSDOS_FS
 	tristate "MSDOS fs support"
@@ -644,25 +606,6 @@
 	  To compile this as a module, choose M here: the module will be called
 	  vfat.
 
-config FAT_DEFAULT_CODEPAGE
-	int "Default codepage for FAT"
-	depends on MSDOS_FS || VFAT_FS
-	default 437
-	help
-	  This option should be set to the codepage of your FAT filesystems.
-	  It can be overridden with the 'codepage' mount option.
-
-config FAT_DEFAULT_IOCHARSET
-	string "Default iocharset for FAT"
-	depends on VFAT_FS
-	default "iso8859-1"
-	help
-	  Set this to the default I/O character set you'd like FAT to use.
-	  It should probably match the character set that most of your
-	  FAT filesystems use, and can be overridded with the 'iocharset'
-	  mount option for FAT filesystems.  Note that UTF8 is *not* a
-	  supported charset for FAT filesystems.
-
 config UMSDOS_FS
 #dep_tristate '    UMSDOS: Unix-like file system on top of standard MSDOS fs' CONFIG_UMSDOS_FS $CONFIG_MSDOS_FS
 # UMSDOS is temprory broken
@@ -1652,6 +1595,22 @@
           Enabling this option will cause statistics for each server share
 	  mounted by the cifs client to be displayed in /proc/fs/cifs/Stats
 
+config CIFS_XATTR
+        bool "CIFS extended attributes (EXPERIMENTAL)"
+        depends on CIFS
+        help
+          Extended attributes are name:value pairs associated with inodes by
+          the kernel or by users (see the attr(5) manual page, or visit
+          <http://acl.bestbits.at/> for details).  CIFS maps the name of
+          extended attributes beginning with the user namespace prefix
+          to SMB/CIFS EAs. EAs are stored on Windows servers without the
+          user namespace prefix, but their names are seen by Linux cifs clients
+          prefaced by the user namespace prefix. The system namespace
+          (used by some filesystems to store ACLs) is not supported at
+          this time.
+                                                                                                    
+          If unsure, say N.
+
 config CIFS_POSIX
         bool "CIFS POSIX Extensions (EXPERIMENTAL)"
         depends on CIFS
diff -urN linux-2.6.8-rc2/fs/binfmt_elf.c linux-2.6.8-rc3/fs/binfmt_elf.c
--- linux-2.6.8-rc2/fs/binfmt_elf.c	2004-08-03 15:21:10.430647836 -0700
+++ linux-2.6.8-rc3/fs/binfmt_elf.c	2004-08-03 15:21:59.043642077 -0700
@@ -237,8 +237,8 @@
 	if (interp_aout) {
 		argv = sp + 2;
 		envp = argv + argc + 1;
-		__put_user((elf_addr_t)(long)argv, sp++);
-		__put_user((elf_addr_t)(long)envp, sp++);
+		__put_user((elf_addr_t)(unsigned long)argv, sp++);
+		__put_user((elf_addr_t)(unsigned long)envp, sp++);
 	} else {
 		argv = sp;
 		envp = argv + argc + 1;
@@ -492,7 +492,7 @@
   	struct exec interp_ex;
 	char passed_fileno[6];
 	struct files_struct *files;
-	int executable_stack = EXSTACK_DEFAULT;
+	int have_pt_gnu_stack, executable_stack = EXSTACK_DEFAULT;
 	unsigned long def_flags = 0;
 	
 	/* Get the exec-header */
@@ -627,8 +627,7 @@
 				executable_stack = EXSTACK_DISABLE_X;
 			break;
 		}
-	if (i == elf_ex.e_phnum)
-		def_flags |= VM_EXEC | VM_MAYEXEC;
+	have_pt_gnu_stack = (i < elf_ex.e_phnum);
 
 	/* Some simple consistency checks for the interpreter */
 	if (elf_interpreter) {
@@ -701,6 +700,8 @@
 	/* Do this immediately, since STACK_TOP as used in setup_arg_pages
 	   may depend on the personality.  */
 	SET_PERSONALITY(elf_ex, ibcs2_interpreter);
+	if (elf_read_implies_exec(elf_ex, have_pt_gnu_stack))
+		current->personality |= READ_IMPLIES_EXEC;
 
 	/* Do this so that we can load the interpreter, if need be.  We will
 	   change some of these later */
diff -urN linux-2.6.8-rc2/fs/bio.c linux-2.6.8-rc3/fs/bio.c
--- linux-2.6.8-rc2/fs/bio.c	2004-08-03 15:21:10.449648615 -0700
+++ linux-2.6.8-rc3/fs/bio.c	2004-08-03 15:21:59.148646385 -0700
@@ -376,6 +376,115 @@
 			      len, offset);
 }
 
+/**
+ *	bio_uncopy_user	-	finish previously mapped bio
+ *	@bio: bio being terminated
+ *
+ *	Free pages allocated from bio_copy_user() and write back data
+ *	to user space in case of a read.
+ */
+int bio_uncopy_user(struct bio *bio)
+{
+	struct bio_vec *bvec;
+	int i, ret = 0;
+
+	if (bio_data_dir(bio) == READ) {
+		char *uaddr = bio->bi_private;
+
+		__bio_for_each_segment(bvec, bio, i, 0) {
+			char *addr = page_address(bvec->bv_page);
+
+			if (!ret && copy_to_user(uaddr, addr, bvec->bv_len))
+				ret = -EFAULT;
+
+			__free_page(bvec->bv_page);
+			uaddr += bvec->bv_len;
+		}
+	}
+
+	bio_put(bio);
+	return ret;
+}
+
+/**
+ *	bio_copy_user	-	copy user data to bio
+ *	@q: destination block queue
+ *	@uaddr: start of user address
+ *	@len: length in bytes
+ *	@write_to_vm: bool indicating writing to pages or not
+ *
+ *	Prepares and returns a bio for indirect user io, bouncing data
+ *	to/from kernel pages as necessary. Must be paired with
+ *	call bio_uncopy_user() on io completion.
+ */
+struct bio *bio_copy_user(request_queue_t *q, unsigned long uaddr,
+			  unsigned int len, int write_to_vm)
+{
+	unsigned long end = (uaddr + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+	unsigned long start = uaddr >> PAGE_SHIFT;
+	struct bio_vec *bvec;
+	struct page *page;
+	struct bio *bio;
+	int i, ret;
+
+	bio = bio_alloc(GFP_KERNEL, end - start);
+	if (!bio)
+		return ERR_PTR(-ENOMEM);
+
+	ret = 0;
+	while (len) {
+		unsigned int bytes = PAGE_SIZE;
+
+		if (bytes > len)
+			bytes = len;
+
+		page = alloc_page(q->bounce_gfp | GFP_KERNEL);
+		if (!page) {
+			ret = -ENOMEM;
+			break;
+		}
+
+		if (__bio_add_page(q, bio, page, bytes, 0) < bytes) {
+			ret = -EINVAL;
+			break;
+		}
+
+		len -= bytes;
+	}
+
+	/*
+	 * success
+	 */
+	if (!ret) {
+		if (!write_to_vm) {
+			bio->bi_rw |= (1 << BIO_RW);
+			/*
+	 		 * for a write, copy in data to kernel pages
+			 */
+			ret = -EFAULT;
+			bio_for_each_segment(bvec, bio, i) {
+				char *addr = page_address(bvec->bv_page);
+
+				if (copy_from_user(addr, (char *) uaddr, bvec->bv_len))
+					goto cleanup;
+			}
+		}
+
+		bio->bi_private = (void *) uaddr;
+		return bio;
+	}
+
+	/*
+	 * cleanup
+	 */
+cleanup:
+	bio_for_each_segment(bvec, bio, i)
+		__free_page(bvec->bv_page);
+
+	bio_put(bio);
+	return ERR_PTR(ret);
+}
+
 static struct bio *__bio_map_user(request_queue_t *q, struct block_device *bdev,
 				  unsigned long uaddr, unsigned int len,
 				  int write_to_vm)
@@ -392,12 +501,13 @@
 	 * size for now, in the future we can relax this restriction
 	 */
 	if ((uaddr & queue_dma_alignment(q)) || (len & queue_dma_alignment(q)))
-		return NULL;
+		return ERR_PTR(-EINVAL);
 
 	bio = bio_alloc(GFP_KERNEL, nr_pages);
 	if (!bio)
-		return NULL;
+		return ERR_PTR(-ENOMEM);
 
+	ret = -ENOMEM;
 	pages = kmalloc(nr_pages * sizeof(struct page *), GFP_KERNEL);
 	if (!pages)
 		goto out;
@@ -446,12 +556,12 @@
 	if (!write_to_vm)
 		bio->bi_rw |= (1 << BIO_RW);
 
-	blk_queue_bounce(q, &bio);
+	bio->bi_flags |= (1 << BIO_USER_MAPPED);
 	return bio;
 out:
 	kfree(pages);
 	bio_put(bio);
-	return NULL;
+	return ERR_PTR(ret);
 }
 
 /**
@@ -462,7 +572,7 @@
  *	@write_to_vm: bool indicating writing to pages or not
  *
  *	Map the user space address into a bio suitable for io to a block
- *	device.
+ *	device. Returns an error pointer in case of error.
  */
 struct bio *bio_map_user(request_queue_t *q, struct block_device *bdev,
 			 unsigned long uaddr, unsigned int len, int write_to_vm)
@@ -471,26 +581,29 @@
 
 	bio = __bio_map_user(q, bdev, uaddr, len, write_to_vm);
 
-	if (bio) {
-		/*
-		 * subtle -- if __bio_map_user() ended up bouncing a bio,
-		 * it would normally disappear when its bi_end_io is run.
-		 * however, we need it for the unmap, so grab an extra
-		 * reference to it
-		 */
-		bio_get(bio);
+	if (IS_ERR(bio))
+		return bio;
 
-		if (bio->bi_size < len) {
-			bio_endio(bio, bio->bi_size, 0);
-			bio_unmap_user(bio, 0);
-			return NULL;
-		}
-	}
+	/*
+	 * subtle -- if __bio_map_user() ended up bouncing a bio,
+	 * it would normally disappear when its bi_end_io is run.
+	 * however, we need it for the unmap, so grab an extra
+	 * reference to it
+	 */
+	bio_get(bio);
 
-	return bio;
+	if (bio->bi_size == len)
+		return bio;
+
+	/*
+	 * don't support partial mappings
+	 */
+	bio_endio(bio, bio->bi_size, 0);
+	bio_unmap_user(bio);
+	return ERR_PTR(-EINVAL);
 }
 
-static void __bio_unmap_user(struct bio *bio, int write_to_vm)
+static void __bio_unmap_user(struct bio *bio)
 {
 	struct bio_vec *bvec;
 	int i;
@@ -511,7 +624,7 @@
 	 * make sure we dirty pages we wrote to
 	 */
 	__bio_for_each_segment(bvec, bio, i, 0) {
-		if (write_to_vm)
+		if (bio_data_dir(bio) == READ)
 			set_page_dirty_lock(bvec->bv_page);
 
 		page_cache_release(bvec->bv_page);
@@ -523,17 +636,15 @@
 /**
  *	bio_unmap_user	-	unmap a bio
  *	@bio:		the bio being unmapped
- *	@write_to_vm:	bool indicating whether pages were written to
  *
- *	Unmap a bio previously mapped by bio_map_user(). The @write_to_vm
- *	must be the same as passed into bio_map_user(). Must be called with
+ *	Unmap a bio previously mapped by bio_map_user(). Must be called with
  *	a process context.
  *
  *	bio_unmap_user() may sleep.
  */
-void bio_unmap_user(struct bio *bio, int write_to_vm)
+void bio_unmap_user(struct bio *bio)
 {
-	__bio_unmap_user(bio, write_to_vm);
+	__bio_unmap_user(bio);
 	bio_put(bio);
 }
 
@@ -864,3 +975,5 @@
 EXPORT_SYMBOL(bio_pair_release);
 EXPORT_SYMBOL(bio_split);
 EXPORT_SYMBOL(bio_split_pool);
+EXPORT_SYMBOL(bio_copy_user);
+EXPORT_SYMBOL(bio_uncopy_user);
diff -urN linux-2.6.8-rc2/fs/cifs/CHANGES linux-2.6.8-rc3/fs/cifs/CHANGES
--- linux-2.6.8-rc2/fs/cifs/CHANGES	2004-08-03 15:21:10.516651364 -0700
+++ linux-2.6.8-rc3/fs/cifs/CHANGES	2004-08-03 15:21:59.271651431 -0700
@@ -1,3 +1,21 @@
+Version 1.22
+------------
+Add config option to enable XATTR (extended attribute) support, mapping
+xattr names in the "user." namespace space to SMB/CIFS EAs.
+
+Version 1.21
+------------
+Add new mount parm to control whether mode check (vfs_permission) is done on
+the client.  If Unix extensions are enabled and the uids on the client
+and server do not match, client permission checks are meaningless on
+server uids that do not exist on the client (this does not affect the
+normal ACL check which occurs on the server).  Fix default uid
+on mknod to match create and mkdir. Add optional mount parm to allow
+override of the default uid behavior (in which the server sets the uid
+and gid of newly created files). Normally for network filesystem mounts
+user want the server to set the uid/gid on newly created files (rather than 
+using uid of the client processes you would in a local filesystem).
+
 Version 1.20
 ------------
 Make transaction counts more consistent. Merge /proc/fs/cifs/SimultaneousOps
diff -urN linux-2.6.8-rc2/fs/cifs/README linux-2.6.8-rc3/fs/cifs/README
--- linux-2.6.8-rc2/fs/cifs/README	2004-08-03 15:21:10.517651405 -0700
+++ linux-2.6.8-rc3/fs/cifs/README	2004-08-03 15:21:59.273651513 -0700
@@ -31,7 +31,7 @@
 5) make dep
 6) make modules (or "make" if CIFS VFS not to be built as a module)
 
-For Linux 2.5:
+For Linux 2.6:
 1) Download the kernel (e.g. from http://www.kernel.org or from bitkeeper
 at bk://linux.bkbits.net/linux-2.5) and change directory into the top
 of the kernel directory tree (e.g. /usr/src/linux-2.5.73)
@@ -56,7 +56,7 @@
 similar files reside (usually /sbin).  Although the helper software is not  
 required, mount.cifs is recommended.  Eventually the Samba 3.0 utility program 
 "net" may also be helpful since it may someday provide easier mount syntax for
-users who are used to Windows e.g.  net use <mount point> <UNC name or cifs URL>  
+users who are used to Windows e.g.  net use <mount point> <UNC name or cifs URL>
 Note that running the Winbind pam/nss module (logon service) on all of your
 Linux clients is useful in mapping Uids and Gids consistently across the
 domain to the proper network user.  The mount.cifs mount helper can be
@@ -64,6 +64,17 @@
 
 	gcc samba/source/client/mount.cifs.c -o mount.cifs
 
+Allowing User Mounts
+====================
+To permit users to mount and unmount over directories they own is possible
+with the cifs vfs.  A way to enable such mounting is to mark the mount.cifs
+utility as suid (e.g. "chmod +s /sbin/mount/cifs). To enable users to 
+umount shares they mount requires
+1) mount.cifs version 1.4 or later
+2) an entry for the share in /etc/fstab indicating that a user may
+unmount it e.g.
+//server/usersharename  /mnt/username cifs user 0 0
+
 Note that when the mount.cifs utility is run suid (allowing user mounts), 
 in order to reduce risks, the "nosuid" mount flag is passed in on mount to
 disallow execution of an suid program mounted on the remote target.
@@ -99,21 +110,27 @@
 	delete readonly = yes 
 	ea support = yes
 
-Note that ea support is required for supporting Linux xattrs. 
-Some administrators also change the "map archive" and the "create mask" 
-parameters from their default values.  Creating special devices (mknod) 
+Note that server ea support is required for supporting xattrs from the Linux
+cifs client, and that EA support is present in later versions of Samba (e.g. 
+3.0.6 and later (also EA support works in all versions of Windows, at least to
+shares on NTFS filesystems).  Extended Attribute (xattr) support is an optional
+feature of most Linux filesystems which may require enabling via
+make menuconfig
+ 
+Some administrators may want to change Samba's smb.conf "map archive" and 
+"create mask" parameters from the default.  Creating special devices (mknod) 
 remotely may require specifying a mkdev function to Samba if you are not using 
-Samba 3.0.5 or later.  For more information on these see the manual pages
+Samba 3.0.6 or later.  For more information on these see the manual pages
 ("man smb.conf") on the Samba server system.  Note that the cifs vfs,
 unlike the smbfs vfs, does not read the smb.conf on the client system 
 (the few optional settings are passed in on mount via -o parameters instead).  
 Note that Samba 2.2.7 or later includes a fix that allows the CIFS VFS to delete
 open files (required for strict POSIX compliance).  Windows Servers already 
 supported this feature. Samba server does not allow symlinks that refer to files
-outside of the share, so in Samba versions prior to 3.0.5, most symlinks to
+outside of the share, so in Samba versions prior to 3.0.6, most symlinks to
 files with absolute paths (ie beginning with slash) such as:
 	 ln -s /mnt/foo bar
-would be forbidden. Samba 3.0.5 server or later includes the ability to create 
+would be forbidden. Samba 3.0.6 server or later includes the ability to create 
 such symlinks safely by converting unsafe symlinks (ie symlinks to server 
 files that are outside of the share) to a samba specific format on the server
 that is ignored by local server applications and non-cifs clients and that will
@@ -148,6 +165,12 @@
 running an altered binary on your local system (downloaded from a hostile server
 or altered by a hostile router).
 
+Although mounting using format corresponding to the CIFS URL specification is
+not possible in mount.cifs yet, it is possible to use an alternate format
+for the server and sharename (which is somewhat similar to NFS style mount
+syntax) instead of the more widely used UNC format (i.e. \\server\share):
+  mount -t cifs tcp_name_of_server:share_name /mnt -o user=myname,pass=mypasswd
+
 When using the mount helper mount.cifs, passwords may be specified via alternate
 mechanisms, instead of specifying it after -o using the normal "pass=" syntax
 on the command line:
@@ -255,7 +278,33 @@
 		mount helper will not prompt the user for a password
 		if guest is specified on the mount options.  If no
 		password is specified a null password will be used.
-
+  perm          Client does permission checks (vfs_permission check of uid
+		and gid of the file against the mode and desired operation),
+		Note that this is in addition to the normal ACL check on the
+		target machine done by the server software. 
+		Client permission checking is enabled by default.
+  noperm        Client does not do permission checks.  This can expose
+		files on this mount to access by other users on the local
+		client system. It is typically only needed when the server
+		supports the CIFS Unix Extensions but the UIDs/GIDs on the
+		client and server system do not match closely enough to allow
+		access by the user doing the mount.
+		Note that this does not affect the normal ACL check on the
+		target machine done by the server software (of the server
+		ACL against the user name provided at mount time).
+  setuids       If the CIFS Unix extensions are negotiated with the server
+		the client will attempt to set the effective uid and gid of
+		the local process on newly created files, directories, and
+		devices (create, mkdir, mknod).
+  nosetuids     The client will not attempt to set the uid and gid on
+		on newly created files, directories, and devices (create, 
+		mkdir, mknod) which will result in the server setting the
+		uid and gid to the default (usually the server uid of the
+		usern who mounted the share).  Letting the server (rather than
+		the client) set the uid and gid is the default. This
+		parameter has no effect if the CIFS Unix Extensions are not
+		negotiated.
+		
 The mount.cifs mount helper also accepts a few mount options before -o
 including:
 
@@ -325,13 +374,11 @@
 
 	echo 1 > /proc/fs/cifs/traceSMB
 
-Three other experimental features are under development and to test 
+Two other experimental features are under development and to test 
 require enabling an ifdef (e.g. by  adding "#define CIFS_FCNTL" in cifsglob.h)
 
 	CONFIG_CIFS_QUOTA
 
-	CONFIG_CIFS_XATTR
-
 	CONFIG_CIFS_FCNTL  (fcntl needed for support of directory change 
 			    notification and perhaps later for file leases)
 
diff -urN linux-2.6.8-rc2/fs/cifs/TODO linux-2.6.8-rc3/fs/cifs/TODO
--- linux-2.6.8-rc2/fs/cifs/TODO	2004-08-03 15:21:10.517651405 -0700
+++ linux-2.6.8-rc3/fs/cifs/TODO	2004-08-03 15:21:59.285652005 -0700
@@ -1,4 +1,4 @@
-version 1.16 May 27, 2004
+version 1.22 July 30, 2004 
 
 A Partial List of Missing Features
 ==================================
@@ -10,7 +10,8 @@
 a) Support for SecurityDescriptors for chmod/chgrp/chown so
 these can be supported for Windows servers
 
-b) Better pam/winbind integration
+b) Better pam/winbind integration (e.g. to handle uid mapping
+better)
 
 c) multi-user mounts - multiplexed sessionsetups over single vc
 (ie tcp session) - prettying up needed
@@ -32,42 +33,37 @@
 
 h) quota support
 
-i) support for the Linux 2.5 kernel new feature get_xattr and set_xattr
-which will allow us to expose dos attributes as well as real
-ACLs. This support has been started in the current code, but is
-ifdeffed out.
-
-k) finish writepages support (multi-page write behind for improved
+j) finish writepages support (multi-page write behind for improved
 performance) and syncpage
 
-l) hook lower into the sockets api (as NFS/SunRPC does) to avoid the
+k) hook lower into the sockets api (as NFS/SunRPC does) to avoid the
 extra copy in/out of the socket buffers in some cases.
 
-m) finish support for IPv6.  This is mostly complete but
+l) finish support for IPv6.  This is mostly complete but
 needs a simple inet_pton like function to convert ipv6
 addresses in string representation.
 
-o) Better optimize open (and pathbased setfilesize) to reduce the
+m) Better optimize open (and pathbased setfilesize) to reduce the
 oplock breaks coming from windows srv.  Piggyback identical file
 opens on top of each other by incrementing reference count rather
 than resending (helps reduce server resource utilization and avoid
 spurious oplock breaks).
 
-p) Improve performance of readpages by sending more than one read
+o) Improve performance of readpages by sending more than one read
 at a time when 8 pages or more are requested.  Evaluate whether
 reads larger than 16K would be helpful.
 
-q) For support of Windows9x/98 we need to retry failed mounts
+p) For support of Windows9x/98 we need to retry failed mounts
 to *SMBSERVER (default server name) with the uppercase hostname
 in the RFC1001 session_init request.
 
-r) Add Extended Attributed support (for storing UID/GID info
-to Windows servers)
+q) Add support for storing symlink and fifo info to Windows servers 
+in the Extended Attribute format their SFU clients would recognize.
 
-s) Finish fcntl D_NOTIFY support so kde and gnome file list windows
+r) Finish fcntl D_NOTIFY support so kde and gnome file list windows
 will autorefresh
 
-t) Add GUI tool to configure /proc/fs/cifs settings and for display of
+s) Add GUI tool to configure /proc/fs/cifs settings and for display of
 the CIFS statistics
 
 KNOWN BUGS (updated May 27, 2004)
@@ -87,11 +83,14 @@
 differences but worth investigating).  Also debug Samba to 
 see why lock test case 7 takes longer to complete to Samba
 than to Windows.
+5) implement search rewind (seeking backward in a readdir), which is
+necessary for one of the "special" subsection of posix file API
+tests in the Connectathon nfs test suite.
 
 Misc testing to do
 ==================
 1) check out max path names and max path name components against various server
-types. Try nested symlinks. Return max path name in stat -f information
+types. Try nested symlinks (8 deep). Return max path name in stat -f information
 
 2) Modify file portion of ltp so it can run against a mounted network
 share and run it against cifs vfs.
@@ -102,5 +101,6 @@
 negotiated size) and send larger write sizes to modern servers.
 
 4) More exhaustively test the recently added NT4 support against various
-NT4 service pack levels.
+NT4 service pack levels, and fix cifs_setattr for setting file times and 
+size to fall back to level 1 when error invalid level returned.
 
diff -urN linux-2.6.8-rc2/fs/cifs/cifs_fs_sb.h linux-2.6.8-rc3/fs/cifs/cifs_fs_sb.h
--- linux-2.6.8-rc2/fs/cifs/cifs_fs_sb.h	2004-06-15 22:19:02.000000000 -0700
+++ linux-2.6.8-rc3/fs/cifs/cifs_fs_sb.h	2004-08-03 15:21:59.374655656 -0700
@@ -18,6 +18,9 @@
 #ifndef _CIFS_FS_SB_H
 #define _CIFS_FS_SB_H
 
+#define CIFS_MOUNT_NO_PERM	1 /* do not do client vfs_perm check */
+#define CIFS_MOUNT_SET_UID      2 /* set current->euid in create etc. */
+
 struct cifs_sb_info {
 	struct cifsTconInfo *tcon;	/* primary mount */
 	struct list_head nested_tcon_q;
@@ -28,5 +31,6 @@
 	gid_t	mnt_gid;
 	mode_t	mnt_file_mode;
 	mode_t	mnt_dir_mode;
+	int     mnt_cifs_flags;
 };
 #endif				/* _CIFS_FS_SB_H */
diff -urN linux-2.6.8-rc2/fs/cifs/cifsfs.c linux-2.6.8-rc3/fs/cifs/cifsfs.c
--- linux-2.6.8-rc2/fs/cifs/cifsfs.c	2004-08-03 15:21:10.521651569 -0700
+++ linux-2.6.8-rc3/fs/cifs/cifsfs.c	2004-08-03 15:21:59.406656969 -0700
@@ -41,8 +41,6 @@
 #include "cifs_fs_sb.h"
 #include <linux/mm.h>
 #define CIFS_MAGIC_NUMBER 0xFF534D42	/* the first four bytes of SMB PDUs */
-/* BB when mempool_resize is added back in, we will resize pool on new mount */
-#define CIFS_MIN_RCV_POOL 11 /* enough for progress to five servers */
 
 #ifdef CONFIG_CIFS_QUOTA
 static struct quotactl_ops cifs_quotactl_ops;
@@ -192,15 +190,11 @@
 
 static int cifs_permission(struct inode * inode, int mask, struct nameidata *nd)
 {
-        struct cifs_sb_info *cifs_sb;
+	struct cifs_sb_info *cifs_sb;
 
-        cifs_sb = CIFS_SB(inode->i_sb);
+	cifs_sb = CIFS_SB(inode->i_sb);
 
-        if (cifs_sb->tcon->ses->capabilities & CAP_UNIX) {
-		/* the server supports the Unix-like mode bits and does its
-		own permission checks, and therefore we do not allow the file
-		mode to be overriden on these mounts - so do not do perm
-		check on client side */
+	if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_PERM) {
 		return 0;
 	} else /* file mode might have been restricted at mount time 
 		on the client (above and beyond ACL on servers) for  
@@ -746,6 +740,7 @@
  */
 	atomic_set(&sesInfoAllocCount, 0);
 	atomic_set(&tconInfoAllocCount, 0);
+	atomic_set(&tcpSesAllocCount,0);
 	atomic_set(&tcpSesReconnectCount, 0);
 	atomic_set(&tconInfoReconnectCount, 0);
 
diff -urN linux-2.6.8-rc2/fs/cifs/cifsfs.h linux-2.6.8-rc3/fs/cifs/cifsfs.h
--- linux-2.6.8-rc2/fs/cifs/cifsfs.h	2004-08-03 15:21:10.522651610 -0700
+++ linux-2.6.8-rc3/fs/cifs/cifsfs.h	2004-08-03 15:21:59.406656969 -0700
@@ -32,14 +32,10 @@
 #define TRUE 1
 #endif
 
-extern int map_cifs_error(int error_class, int error_code,
-			  int status_codes_negotiated);
-
 extern struct address_space_operations cifs_addr_ops;
 
 /* Functions related to super block operations */
 extern struct super_operations cifs_super_ops;
-extern void cifs_put_inode(struct inode *);
 extern void cifs_read_inode(struct inode *);
 extern void cifs_delete_inode(struct inode *);
 /* extern void cifs_write_inode(struct inode *); *//* BB not needed yet */
diff -urN linux-2.6.8-rc2/fs/cifs/cifsglob.h linux-2.6.8-rc3/fs/cifs/cifsglob.h
--- linux-2.6.8-rc2/fs/cifs/cifsglob.h	2004-08-03 15:21:10.522651610 -0700
+++ linux-2.6.8-rc3/fs/cifs/cifsglob.h	2004-08-03 15:21:59.407657010 -0700
@@ -32,6 +32,8 @@
 				   termination then *2 for unicode versions */
 #define MAX_PASSWORD_SIZE 16
 
+#define CIFS_MIN_RCV_POOL 4
+
 /*
  * MAX_REQ is the maximum number of requests that WE will send
  * on one socket concurently. It also matches the most common
@@ -391,7 +393,7 @@
  */
 GLOBAL_EXTERN atomic_t sesInfoAllocCount;
 GLOBAL_EXTERN atomic_t tconInfoAllocCount;
-
+GLOBAL_EXTERN atomic_t tcpSesAllocCount;
 GLOBAL_EXTERN atomic_t tcpSesReconnectCount;
 GLOBAL_EXTERN atomic_t tconInfoReconnectCount;
 
diff -urN linux-2.6.8-rc2/fs/cifs/cifspdu.h linux-2.6.8-rc3/fs/cifs/cifspdu.h
--- linux-2.6.8-rc2/fs/cifs/cifspdu.h	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/fs/cifs/cifspdu.h	2004-08-03 15:21:59.472659677 -0700
@@ -1046,6 +1046,8 @@
 
 /* PathInfo/FileInfo infolevels */
 #define SMB_INFO_STANDARD                   1
+#define SMB_SET_FILE_EA                     2
+#define SMB_QUERY_FILE_EA_SIZE              2
 #define SMB_INFO_QUERY_EAS_FROM_LIST        3
 #define SMB_INFO_QUERY_ALL_EAS              4
 #define SMB_INFO_IS_NAME_VALID              6
@@ -1620,6 +1622,19 @@
 	char LinkDest[1];
 } FILE_UNIX_LINK_INFO;		/* level 513 QPathInfo */
 
+typedef struct {
+	__u16 CreationDate;
+	__u16 CreationTime;
+	__u16 LastAccessDate;
+	__u16 LastAccessTime;
+	__u16 LastWriteDate;
+	__u16 LastWriteTime;
+	__u32 DataSize; /* File Size (EOF) */
+	__u32 AllocationSize;
+	__u16 Attributes; /* verify not u32 */
+	__u32 EASize;
+} FILE_INFO_STANDARD;  /* level 1 SetPath/FileInfo */
+
 /* defines for enumerating possible values of the Unix type field below */
 #define UNIX_FILE      0
 #define UNIX_DIR       1
@@ -1680,12 +1695,12 @@
 } FILE_DIRECTORY_INFO;   /* level 257 FF response data area */
 
 struct gea {
-	unsigned char cbName;
-	char szName[1];
+	unsigned char name_len;
+	char name[1];
 };
 
 struct gealist {
-	unsigned long cbList;
+	unsigned long list_len;
 	struct gea list[1];
 };
 
@@ -1693,7 +1708,7 @@
 	unsigned char EA_flags;
 	__u8 name_len;
 	__u16 value_len;
-	char szName[1];
+	char name[1];
 	/* optionally followed by value */
 };
 /* flags for _FEA.fEA */
diff -urN linux-2.6.8-rc2/fs/cifs/cifsproto.h linux-2.6.8-rc3/fs/cifs/cifsproto.h
--- linux-2.6.8-rc2/fs/cifs/cifsproto.h	2004-08-03 15:21:10.523651651 -0700
+++ linux-2.6.8-rc3/fs/cifs/cifsproto.h	2004-08-03 15:21:59.507661113 -0700
@@ -128,10 +128,10 @@
 			const struct nls_table *nls_codepage);
 
 extern int CIFSSMBSetTimes(const int xid, struct cifsTconInfo *tcon,
-			char *fileName, FILE_BASIC_INFO * data,
+			const char *fileName, const FILE_BASIC_INFO * data,
 			const struct nls_table *nls_codepage);
 extern int CIFSSMBSetEOF(const int xid, struct cifsTconInfo *tcon,
-			char *fileName, __u64 size,int setAllocationSizeFlag,
+			const char *fileName, __u64 size,int setAllocationSizeFlag,
 			const struct nls_table *nls_codepage);
 extern int CIFSSMBSetFileSize(const int xid, struct cifsTconInfo *tcon,
 			 __u64 size, __u16 fileHandle,__u32 opener_pid, int AllocSizeFlag);
@@ -213,31 +213,6 @@
 extern int cifs_calculate_mac_key(char * key,const char * rn,const char * pass);
 extern void CalcNTLMv2_partial_mac_key(struct cifsSesInfo *, struct nls_table *);
 extern void CalcNTLMv2_response(const struct cifsSesInfo *,char * );
-
-extern int CIFSBuildServerList(int xid, char *serverBufferList,
-			int recordlength, int *entries,
-			int *totalEntries, int *topoChangedFlag);
-extern int CIFSSMBQueryShares(int xid, struct cifsTconInfo *tcon,
-			struct shareInfo *shareList, int bufferLen,
-			int *entries, int *totalEntries);
-extern int CIFSSMBQueryAlias(int xid, struct cifsTconInfo *tcon,
-			struct aliasInfo *aliasList, int bufferLen,
-			int *entries, int *totalEntries);
-extern int CIFSSMBAliasInfo(int xid, struct cifsTconInfo *tcon,
-			char *aliasName, char *serverName,
-			char *shareName, char *comment);
-extern int CIFSSMBGetShareInfo(int xid, struct cifsTconInfo *tcon,
-			char *share, char *comment);
-extern int CIFSSMBGetUserPerms(int xid, struct cifsTconInfo *tcon,
-			char *userName, char *searchName, int *perms);
-extern int CIFSSMBSync(int xid, struct cifsTconInfo *tcon, int netfid, int pid);
-
-extern int CIFSSMBSeek(int xid,
-			struct cifsTconInfo *tcon,
-			int netfid,
-			int pid,
-			int whence, unsigned long offset, long long *newoffset);
-
 extern int CIFSSMBCopy(int xid,
 			struct cifsTconInfo *source_tcon,
 			const char *fromName,
@@ -247,8 +222,15 @@
 extern int CIFSSMBNotify(const int xid, struct cifsTconInfo *tcon, 
 			const int notify_subdirs,const __u16 netfid,__u32 filter,
 			const struct nls_table *nls_codepage);
-extern int CIFSSMBQAllEAs(const int xid, struct cifsTconInfo *tcon,
-		 const unsigned char *searchName,
-		 char * EAData, size_t size,
-		 const struct nls_table *nls_codepage);
+extern ssize_t CIFSSMBQAllEAs(const int xid, struct cifsTconInfo *tcon,
+			const unsigned char *searchName, char * EAData,
+			size_t bufsize, const struct nls_table *nls_codepage);
+extern ssize_t CIFSSMBQueryEA(const int xid,struct cifsTconInfo * tcon,
+		const unsigned char * searchName,const unsigned char * ea_name,
+		unsigned char * ea_value, size_t buf_size, 
+		const struct nls_table *nls_codepage);
+extern int CIFSSMBSetEA(const int xid, struct cifsTconInfo *tcon, 
+		const char *fileName, const char * ea_name, 
+		const void * ea_value, const __u16 ea_value_len, 
+		const struct nls_table *nls_codepage);
 #endif			/* _CIFSPROTO_H */
diff -urN linux-2.6.8-rc2/fs/cifs/cifssmb.c linux-2.6.8-rc3/fs/cifs/cifssmb.c
--- linux-2.6.8-rc2/fs/cifs/cifssmb.c	2004-08-03 15:21:10.525651733 -0700
+++ linux-2.6.8-rc3/fs/cifs/cifssmb.c	2004-08-03 15:21:59.540662466 -0700
@@ -2287,7 +2287,7 @@
 }
 
 int
-CIFSSMBQFSAttributeInfo(int xid, struct cifsTconInfo *tcon,
+CIFSSMBQFSAttributeInfo(const int xid, struct cifsTconInfo *tcon,
 			const struct nls_table *nls_codepage)
 {
 /* level 0x105  SMB_QUERY_FILE_SYSTEM_INFO */
@@ -2359,7 +2359,7 @@
 }
 
 int
-CIFSSMBQFSDeviceInfo(int xid, struct cifsTconInfo *tcon,
+CIFSSMBQFSDeviceInfo(const int xid, struct cifsTconInfo *tcon,
 		     const struct nls_table *nls_codepage)
 {
 /* level 0x104 SMB_QUERY_FILE_SYSTEM_INFO */
@@ -2432,7 +2432,7 @@
 }
 
 int
-CIFSSMBQFSUnixInfo(int xid, struct cifsTconInfo *tcon,
+CIFSSMBQFSUnixInfo(const int xid, struct cifsTconInfo *tcon,
 		   const struct nls_table *nls_codepage)
 {
 /* level 0x200  SMB_QUERY_CIFS_UNIX_INFO */
@@ -2512,7 +2512,7 @@
    in Samba which this routine can run into */
 
 int
-CIFSSMBSetEOF(int xid, struct cifsTconInfo *tcon, char *fileName,
+CIFSSMBSetEOF(const int xid, struct cifsTconInfo *tcon, const char *fileName,
 	      __u64 size, int SetAllocation, const struct nls_table *nls_codepage)
 {
 	struct smb_com_transaction2_spi_req *pSMB = NULL;
@@ -2692,8 +2692,9 @@
 }
 
 int
-CIFSSMBSetTimes(int xid, struct cifsTconInfo *tcon, char *fileName,
-		FILE_BASIC_INFO * data, const struct nls_table *nls_codepage)
+CIFSSMBSetTimes(const int xid, struct cifsTconInfo *tcon, const char *fileName,
+		const FILE_BASIC_INFO * data, 
+		const struct nls_table *nls_codepage)
 {
 	TRANSACTION2_SPI_REQ *pSMB = NULL;
 	TRANSACTION2_SPI_RSP *pSMBr = NULL;
@@ -2770,6 +2771,89 @@
 	return rc;
 }
 
+
+int
+CIFSSMBSetTimesLegacy(int xid, struct cifsTconInfo *tcon, char *fileName,
+		FILE_INFO_STANDARD * data, const struct nls_table *nls_codepage)
+{
+	TRANSACTION2_SPI_REQ *pSMB = NULL;
+	TRANSACTION2_SPI_RSP *pSMBr = NULL;
+	int name_len;
+	int rc = 0;
+	int bytes_returned = 0;
+	char *data_offset;
+
+	cFYI(1, ("In SetTimesLegacy"));
+
+SetTimesRetryLegacy:
+	rc = smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB,
+		      (void **) &pSMBr);
+	if (rc)
+		return rc;
+
+	if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
+		name_len =
+		    cifs_strtoUCS((wchar_t *) pSMB->FileName, fileName, 530
+				  /* find define for this maxpathcomponent */
+				  , nls_codepage);
+		name_len++;	/* trailing null */
+		name_len *= 2;
+	} else {		/* BB improve the check for buffer overruns BB */
+		name_len = strnlen(fileName, 530);
+		name_len++;	/* trailing null */
+		strncpy(pSMB->FileName, fileName, name_len);
+	}
+/* BB fixme - we have to map to FILE_STANDARD_INFO (level 1 info
+	in parent function, from the better and ususal FILE_BASIC_INFO */
+	pSMB->ParameterCount = 6 + name_len;
+	pSMB->DataCount = sizeof (FILE_INFO_STANDARD);
+	pSMB->MaxParameterCount = cpu_to_le16(2);
+	pSMB->MaxDataCount = cpu_to_le16(1000);	/* BB find exact max SMB PDU from sess structure BB */
+	pSMB->MaxSetupCount = 0;
+	pSMB->Reserved = 0;
+	pSMB->Flags = 0;
+	pSMB->Timeout = 0;
+	pSMB->Reserved2 = 0;
+	pSMB->ParameterOffset = offsetof(struct smb_com_transaction2_spi_req,
+                                     InformationLevel) - 4;
+	pSMB->DataOffset = pSMB->ParameterOffset + pSMB->ParameterCount;
+	data_offset = (char *) (&pSMB->hdr.Protocol) + pSMB->DataOffset;
+	pSMB->ParameterOffset = cpu_to_le16(pSMB->ParameterOffset);
+	pSMB->DataOffset = cpu_to_le16(pSMB->DataOffset);
+	pSMB->SetupCount = 1;
+	pSMB->Reserved3 = 0;
+	pSMB->SubCommand = cpu_to_le16(TRANS2_SET_PATH_INFORMATION);
+	pSMB->ByteCount = 3 /* pad */  + pSMB->ParameterCount + pSMB->DataCount;
+
+	pSMB->DataCount = cpu_to_le16(pSMB->DataCount);
+	pSMB->ParameterCount = cpu_to_le16(pSMB->ParameterCount);
+	pSMB->TotalDataCount = pSMB->DataCount;
+	pSMB->TotalParameterCount = pSMB->ParameterCount;
+	/* I doubt that passthrough levels apply to this old
+	preNT info level */
+/*	if (tcon->ses->capabilities & CAP_INFOLEVEL_PASSTHRU)
+		pSMB->InformationLevel = cpu_to_le16(SMB_SET_FILE_BASIC_INFO2);
+	else*/
+		pSMB->InformationLevel = cpu_to_le16(SMB_INFO_STANDARD);
+	pSMB->Reserved4 = 0;
+	pSMB->hdr.smb_buf_length += pSMB->ByteCount;
+	memcpy(data_offset, data, sizeof (FILE_INFO_STANDARD));
+	pSMB->ByteCount = cpu_to_le16(pSMB->ByteCount);
+	rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
+			 (struct smb_hdr *) pSMBr, &bytes_returned, 0);
+	if (rc) {
+		cFYI(1, ("SetPathInfo (times legacy) returned %d", rc));
+	}
+
+	if (pSMB)
+		cifs_buf_release(pSMB);
+
+	if (rc == -EAGAIN)
+		goto SetTimesRetryLegacy;
+
+	return rc;
+}
+
 int
 CIFSSMBUnixSetPerms(const int xid, struct cifsTconInfo *tcon,
 		    char *fileName, __u64 mode, __u64 uid, __u64 gid,
@@ -2915,10 +2999,10 @@
 	return rc;	
 }
 #ifdef CONFIG_CIFS_XATTR
-int
+ssize_t
 CIFSSMBQAllEAs(const int xid, struct cifsTconInfo *tcon,
 		 const unsigned char *searchName,
-		 char * EAData, size_t size,
+		 char * EAData, size_t buf_size,
 		 const struct nls_table *nls_codepage)
 {
 		/* BB assumes one setup word */
@@ -2927,6 +3011,8 @@
 	int rc = 0;
 	int bytes_returned;
 	int name_len;
+	struct fea * temp_fea;
+	char * temp_ptr;
 
 	cFYI(1, ("In Query All EAs path %s", searchName));
 QAllEAsRetry:
@@ -2942,7 +3028,7 @@
 				  , nls_codepage);
 		name_len++;	/* trailing null */
 		name_len *= 2;
-	} else {		/* BB improve the check for buffer overruns BB */
+	} else {	/* BB improve the check for buffer overruns BB */
 		name_len = strnlen(searchName, 530);
 		name_len++;	/* trailing null */
 		strncpy(pSMB->FileName, searchName, name_len);
@@ -3001,7 +3087,53 @@
 			ea_response_data = (struct fealist *)
 				(((char *) &pSMBr->hdr.Protocol) +
 				pSMBr->DataOffset);
+			ea_response_data->list_len = 
+				cpu_to_le32(ea_response_data->list_len);
 			cFYI(1,("ea length %d",ea_response_data->list_len));
+			name_len = ea_response_data->list_len;
+			if(name_len <= 8) {
+			/* returned EA size zeroed at top of function */
+				cFYI(1,("empty EA list returned from server"));
+			} else {
+				/* account for ea list len */
+				name_len -= 4;
+				temp_fea = ea_response_data->list;
+				temp_ptr = (char *)temp_fea;
+				while(name_len > 0) {
+					name_len -= 4;
+					temp_ptr += 4;
+					rc += temp_fea->name_len;
+				/* account for prefix user. and trailing null */
+					rc = rc + 5 + 1; 
+					if(rc<buf_size) {
+						memcpy(EAData,"user.",5);
+						EAData+=5;
+						memcpy(EAData,temp_ptr,temp_fea->name_len);
+						EAData+=temp_fea->name_len;
+						/* null terminate name */
+						*EAData = 0;
+						EAData = EAData + 1;
+					} else if(buf_size == 0) {
+						/* skip copy - calc size only */
+					} else {
+						/* stop before overrun buffer */
+						rc = -ERANGE;
+						break;
+					}
+					name_len -= temp_fea->name_len;
+					temp_ptr += temp_fea->name_len;
+					/* account for trailing null */
+					name_len--;
+					temp_ptr++;
+					temp_fea->value_len = cpu_to_le16(temp_fea->value_len);
+					name_len -= temp_fea->value_len;
+					temp_ptr += temp_fea->value_len;
+					/* BB check that temp_ptr is still within smb BB*/
+				/* no trailing null to account for in value len */
+					/* go on to next EA */
+					temp_fea = (struct fea *)temp_ptr;
+				}
+			}
 		}
 	}
 	if (pSMB)
@@ -3011,4 +3143,255 @@
 
 	return rc;
 }
+
+ssize_t CIFSSMBQueryEA(const int xid,struct cifsTconInfo * tcon,
+		const unsigned char * searchName,const unsigned char * ea_name,
+		unsigned char * ea_value, size_t buf_size, 
+		const struct nls_table *nls_codepage)
+{
+	TRANSACTION2_QPI_REQ *pSMB = NULL;
+	TRANSACTION2_QPI_RSP *pSMBr = NULL;
+	int rc = 0;
+	int bytes_returned;
+	int name_len;
+	struct fea * temp_fea;
+	char * temp_ptr;
+
+	cFYI(1, ("In Query EA path %s", searchName));
+QEARetry:
+	rc = smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB,
+		      (void **) &pSMBr);
+	if (rc)
+		return rc;
+
+	if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
+		name_len =
+		    cifs_strtoUCS((wchar_t *) pSMB->FileName, searchName, 530
+				  /* find define for this maxpathcomponent */
+				  , nls_codepage);
+		name_len++;	/* trailing null */
+		name_len *= 2;
+	} else {	/* BB improve the check for buffer overruns BB */
+		name_len = strnlen(searchName, 530);
+		name_len++;	/* trailing null */
+		strncpy(pSMB->FileName, searchName, name_len);
+	}
+
+	pSMB->TotalParameterCount = 2 /* level */  + 4 /* reserved */  +
+	    name_len /* includes null */ ;
+	pSMB->TotalDataCount = 0;
+	pSMB->MaxParameterCount = cpu_to_le16(2);
+	pSMB->MaxDataCount = cpu_to_le16(4000);	/* BB find exact max SMB PDU from sess structure BB */
+	pSMB->MaxSetupCount = 0;
+	pSMB->Reserved = 0;
+	pSMB->Flags = 0;
+	pSMB->Timeout = 0;
+	pSMB->Reserved2 = 0;
+	pSMB->ParameterOffset = cpu_to_le16(offsetof(
+        struct smb_com_transaction2_qpi_req ,InformationLevel) - 4);
+	pSMB->DataCount = 0;
+	pSMB->DataOffset = 0;
+	pSMB->SetupCount = 1;
+	pSMB->Reserved3 = 0;
+	pSMB->SubCommand = cpu_to_le16(TRANS2_QUERY_PATH_INFORMATION);
+	pSMB->ByteCount = pSMB->TotalParameterCount + 1 /* pad */ ;
+	pSMB->TotalParameterCount = cpu_to_le16(pSMB->TotalParameterCount);
+	pSMB->ParameterCount = pSMB->TotalParameterCount;
+	pSMB->InformationLevel = cpu_to_le16(SMB_INFO_QUERY_ALL_EAS);
+	pSMB->Reserved4 = 0;
+	pSMB->hdr.smb_buf_length += pSMB->ByteCount;
+	pSMB->ByteCount = cpu_to_le16(pSMB->ByteCount);
+
+	rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
+			 (struct smb_hdr *) pSMBr, &bytes_returned, 0);
+	if (rc) {
+		cFYI(1, ("Send error in Query EA = %d", rc));
+	} else {		/* decode response */
+		pSMBr->DataOffset = le16_to_cpu(pSMBr->DataOffset);
+		/* BB also check enough total bytes returned */
+		/* BB we need to improve the validity checking
+		of these trans2 responses */
+		if ((pSMBr->ByteCount < 4) || (pSMBr->DataOffset > 512)) 
+			rc = -EIO;	/* bad smb */
+	   /* else if (pFindData){
+			memcpy((char *) pFindData,
+			       (char *) &pSMBr->hdr.Protocol +
+			       pSMBr->DataOffset, kl);
+		}*/ else {
+			/* check that length of list is not more than bcc */
+			/* check that each entry does not go beyond length
+			   of list */
+			/* check that each element of each entry does not
+			   go beyond end of list */
+			struct fealist * ea_response_data;
+			rc = -ENOENT;
+			/* validate_trans2_offsets() */
+			/* BB to check if(start of smb + pSMBr->DataOffset > &bcc+ bcc)*/
+			ea_response_data = (struct fealist *)
+				(((char *) &pSMBr->hdr.Protocol) +
+				pSMBr->DataOffset);
+			ea_response_data->list_len = 
+				cpu_to_le32(ea_response_data->list_len);
+			cFYI(1,("ea length %d",ea_response_data->list_len));
+			name_len = ea_response_data->list_len;
+			if(name_len <= 8) {
+			/* returned EA size zeroed at top of function */
+				cFYI(1,("empty EA list returned from server"));
+			} else {
+				/* account for ea list len */
+				name_len -= 4;
+				temp_fea = ea_response_data->list;
+				temp_ptr = (char *)temp_fea;
+				/* loop through checking if we have a matching
+				name and then return the associated value */
+				while(name_len > 0) {
+					name_len -= 4;
+					temp_ptr += 4;
+					temp_fea->value_len = cpu_to_le16(temp_fea->value_len);
+				/* BB validate that value_len falls within SMB, 
+				even though maximum for name_len is 255 */ 
+					if(memcmp(temp_fea->name,ea_name,
+						  temp_fea->name_len) == 0) {
+						/* found a match */
+						rc = temp_fea->value_len;
+				/* account for prefix user. and trailing null */
+						if(rc<=buf_size) {
+							memcpy(ea_value,
+								temp_fea->name+temp_fea->name_len+1,
+								rc);
+							/* ea values, unlike ea names,
+							are not null terminated */
+						} else if(buf_size == 0) {
+						/* skip copy - calc size only */
+						} else {
+							/* stop before overrun buffer */
+							rc = -ERANGE;
+						}
+						break;
+					}
+					name_len -= temp_fea->name_len;
+					temp_ptr += temp_fea->name_len;
+					/* account for trailing null */
+					name_len--;
+					temp_ptr++;
+					name_len -= temp_fea->value_len;
+					temp_ptr += temp_fea->value_len;
+				/* no trailing null to account for in value len */
+					/* go on to next EA */
+					temp_fea = (struct fea *)temp_ptr;
+				}
+			} 
+		}
+	}
+	if (pSMB)
+		cifs_buf_release(pSMB);
+	if (rc == -EAGAIN)
+		goto QEARetry;
+
+	return rc;
+}
+
+int
+CIFSSMBSetEA(const int xid, struct cifsTconInfo *tcon, const char *fileName,
+		const char * ea_name, const void * ea_value, 
+		const __u16 ea_value_len, const struct nls_table *nls_codepage)
+{
+	struct smb_com_transaction2_spi_req *pSMB = NULL;
+	struct smb_com_transaction2_spi_rsp *pSMBr = NULL;
+	struct fealist *parm_data;
+	int name_len;
+	int rc = 0;
+	int bytes_returned = 0;
+
+	cFYI(1, ("In SetEA"));
+SetEARetry:
+	rc = smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB,
+		      (void **) &pSMBr);
+	if (rc)
+		return rc;
+
+	if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
+		name_len =
+		    cifs_strtoUCS((wchar_t *) pSMB->FileName, fileName, 530
+				  /* find define for this maxpathcomponent */
+				  , nls_codepage);
+		name_len++;	/* trailing null */
+		name_len *= 2;
+	} else {		/* BB improve the check for buffer overruns BB */
+		name_len = strnlen(fileName, 530);
+		name_len++;	/* trailing null */
+		strncpy(pSMB->FileName, fileName, name_len);
+	}
+
+	pSMB->ParameterCount = 6 + name_len;
+
+	/* done calculating parms using name_len of file name,
+	now use name_len to calculate length of ea name
+	we are going to create in the inode xattrs */
+	if(ea_name == NULL)
+		name_len = 0;
+	else
+		name_len = strnlen(ea_name,255);
+
+	pSMB->DataCount = sizeof(*parm_data) + ea_value_len + name_len + 1;
+	pSMB->MaxParameterCount = cpu_to_le16(2);
+	pSMB->MaxDataCount = cpu_to_le16(1000);	/* BB find max SMB size from sess */
+	pSMB->MaxSetupCount = 0;
+	pSMB->Reserved = 0;
+	pSMB->Flags = 0;
+	pSMB->Timeout = 0;
+	pSMB->Reserved2 = 0;
+	pSMB->ParameterOffset = offsetof(struct smb_com_transaction2_spi_req,
+                                     InformationLevel) - 4;
+	pSMB->DataOffset = pSMB->ParameterOffset + pSMB->ParameterCount;
+	pSMB->InformationLevel =
+		cpu_to_le16(SMB_SET_FILE_EA);
+
+	parm_data =
+		(struct fealist *) (((char *) &pSMB->hdr.Protocol) +
+				       pSMB->DataOffset);
+	pSMB->ParameterOffset = cpu_to_le16(pSMB->ParameterOffset);
+	pSMB->DataOffset = cpu_to_le16(pSMB->DataOffset);
+	pSMB->SetupCount = 1;
+	pSMB->Reserved3 = 0;
+	pSMB->SubCommand = cpu_to_le16(TRANS2_SET_PATH_INFORMATION);
+	pSMB->ByteCount = 3 /* pad */  + pSMB->ParameterCount + pSMB->DataCount;
+	pSMB->DataCount = cpu_to_le16(pSMB->DataCount);
+	parm_data->list_len = (__u32)(pSMB->DataCount);
+	parm_data->list[0].EA_flags = 0;
+	/* we checked above that name len is less than 255 */
+	parm_data->list[0].name_len = (__u8)name_len;;
+	/* EA names are always ASCII */
+	strncpy(parm_data->list[0].name,ea_name,name_len);
+	parm_data->list[0].name[name_len] = 0;
+	parm_data->list[0].value_len = cpu_to_le16(ea_value_len);
+	/* caller ensures that ea_value_len is less than 64K but
+	we need to ensure that it fits within the smb */
+
+	/*BB add length check that it would fit in negotiated SMB buffer size BB */
+	/* if(ea_value_len > buffer_size - 512 (enough for header)) */
+	if(ea_value_len)
+		memcpy(parm_data->list[0].name+name_len+1,ea_value,ea_value_len);
+
+	pSMB->TotalDataCount = pSMB->DataCount;
+	pSMB->ParameterCount = cpu_to_le16(pSMB->ParameterCount);
+	pSMB->TotalParameterCount = pSMB->ParameterCount;
+	pSMB->Reserved4 = 0;
+	pSMB->hdr.smb_buf_length += pSMB->ByteCount;
+	pSMB->ByteCount = cpu_to_le16(pSMB->ByteCount);
+	rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
+			 (struct smb_hdr *) pSMBr, &bytes_returned, 0);
+	if (rc) {
+		cFYI(1, ("SetPathInfo (EA) returned %d", rc));
+	}
+
+	if (pSMB)
+		cifs_buf_release(pSMB);
+
+	if (rc == -EAGAIN)
+		goto SetEARetry;
+
+	return rc;
+}
+
 #endif
diff -urN linux-2.6.8-rc2/fs/cifs/connect.c linux-2.6.8-rc3/fs/cifs/connect.c
--- linux-2.6.8-rc2/fs/cifs/connect.c	2004-08-03 15:21:10.528651856 -0700
+++ linux-2.6.8-rc3/fs/cifs/connect.c	2004-08-03 15:21:59.551662918 -0700
@@ -28,6 +28,7 @@
 #include <linux/pagemap.h>
 #include <linux/ctype.h>
 #include <linux/utsname.h>
+#include <linux/mempool.h>
 #include <asm/uaccess.h>
 #include <asm/processor.h>
 #include "cifspdu.h"
@@ -49,6 +50,8 @@
 			 unsigned char *p24);
 extern int cifs_inet_pton(int, const char *, void *dst);
 
+extern mempool_t *cifs_req_poolp;
+
 struct smb_vol {
 	char *username;
 	char *password;
@@ -64,6 +67,8 @@
 	int rw:1;
 	int retry:1;
 	int intr:1;
+	int setuids:1;
+	int noperm:1;
 	unsigned int rsize;
 	unsigned int wsize;
 	unsigned int sockopt;
@@ -202,6 +207,15 @@
 	current->flags |= PF_MEMALLOC;
 	server->tsk = current;	/* save process info to wake at shutdown */
 	cFYI(1, ("Demultiplex PID: %d", current->pid));
+	write_lock(&GlobalSMBSeslock);
+	atomic_inc(&tcpSesAllocCount);
+	length = tcpSesAllocCount.counter;
+	write_unlock(&GlobalSMBSeslock);
+	if(length  > 1) {
+		mempool_resize(cifs_req_poolp,
+			length + CIFS_MIN_RCV_POOL,
+			GFP_KERNEL);
+	}
 
 	while (server->tcpStatus != CifsExiting) {
 		if (smb_buffer == NULL)
@@ -465,6 +479,16 @@
 	}
 	kfree(server);
 
+	write_lock(&GlobalSMBSeslock);
+	atomic_dec(&tcpSesAllocCount);
+	length = tcpSesAllocCount.counter;
+	write_unlock(&GlobalSMBSeslock);
+	if(length  > 0) {
+		mempool_resize(cifs_req_poolp,
+			length + CIFS_MIN_RCV_POOL,
+			GFP_KERNEL);
+	}
+
 	set_current_state(TASK_INTERRUPTIBLE);
 	schedule_timeout(HZ/4);
 	return 0;
@@ -740,6 +764,14 @@
 			vol->retry = 1;
 		} else if (strnicmp(data, "soft", 4) == 0) {
 			vol->retry = 0;
+		} else if (strnicmp(data, "perm", 4) == 0) {
+			vol->noperm = 0;
+		} else if (strnicmp(data, "noperm", 6) == 0) {
+			vol->noperm = 1;
+		} else if (strnicmp(data, "setuids", 7) == 0) {
+			vol->setuids = 1;
+		} else if (strnicmp(data, "nosetuids", 9) == 0) {
+			vol->setuids = 0;
 		} else if (strnicmp(data, "nohard", 6) == 0) {
 			vol->retry = 0;
 		} else if (strnicmp(data, "nosoft", 6) == 0) {
@@ -1314,6 +1346,12 @@
 		cifs_sb->mnt_file_mode = volume_info.file_mode;
 		cifs_sb->mnt_dir_mode = volume_info.dir_mode;
 		cFYI(1,("file mode: 0x%x  dir mode: 0x%x",cifs_sb->mnt_file_mode,cifs_sb->mnt_dir_mode));
+
+		if(volume_info.noperm)
+			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_PERM;
+		if(volume_info.setuids)
+			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
+
 		tcon =
 		    find_unc(sin_server.sin_addr.s_addr, volume_info.UNC,
 			     volume_info.username);
diff -urN linux-2.6.8-rc2/fs/cifs/dir.c linux-2.6.8-rc3/fs/cifs/dir.c
--- linux-2.6.8-rc2/fs/cifs/dir.c	2004-08-03 15:21:10.529651897 -0700
+++ linux-2.6.8-rc3/fs/cifs/dir.c	2004-08-03 15:21:59.571663738 -0700
@@ -243,11 +243,19 @@
 		then we now have to set the mode if possible */
 		if ((cifs_sb->tcon->ses->capabilities & CAP_UNIX) &&
 			(oplock & CIFS_CREATE_ACTION))
-			CIFSSMBUnixSetPerms(xid, pTcon, full_path, mode,
+			if(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID) {
+				CIFSSMBUnixSetPerms(xid, pTcon, full_path, mode,
+					(__u64)current->euid,
+					(__u64)current->egid,
+					0 /* dev */,
+					cifs_sb->local_nls);
+			} else {
+				CIFSSMBUnixSetPerms(xid, pTcon, full_path, mode,
 					(__u64)-1,
 					(__u64)-1,
 					0 /* dev */,
 					cifs_sb->local_nls);
+			}
 		else {
 			/* BB implement via Windows security descriptors */
 			/* eg CIFSSMBWinSetPerms(xid,pTcon,full_path,mode,-1,-1,local_nls);*/
@@ -348,9 +356,16 @@
 		rc = -ENOMEM;
 	
 	if (full_path && (pTcon->ses->capabilities & CAP_UNIX)) {
-		rc = CIFSSMBUnixSetPerms(xid, pTcon,
-			full_path, mode, current->euid, current->egid,
-			device_number, cifs_sb->local_nls);
+		if(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID) {
+			rc = CIFSSMBUnixSetPerms(xid, pTcon, full_path,
+				mode,(__u64)current->euid,(__u64)current->egid,
+				device_number, cifs_sb->local_nls);
+		} else {
+			rc = CIFSSMBUnixSetPerms(xid, pTcon,
+				full_path, mode, (__u64)-1, (__u64)-1,
+				device_number, cifs_sb->local_nls);
+		}
+
 		if(!rc) {
 			rc = cifs_get_inode_info_unix(&newinode, full_path,
 						inode->i_sb,xid);
diff -urN linux-2.6.8-rc2/fs/cifs/inode.c linux-2.6.8-rc3/fs/cifs/inode.c
--- linux-2.6.8-rc2/fs/cifs/inode.c	2004-08-03 15:21:10.532652020 -0700
+++ linux-2.6.8-rc3/fs/cifs/inode.c	2004-08-03 15:21:59.596664764 -0700
@@ -480,12 +480,20 @@
 		d_instantiate(direntry, newinode);
 		if(direntry->d_inode)
 			direntry->d_inode->i_nlink = 2;
-		if (cifs_sb->tcon->ses->capabilities & CAP_UNIX)                
-			CIFSSMBUnixSetPerms(xid, pTcon, full_path, mode,
-				(__u64)-1,  
-				(__u64)-1,
-				0 /* dev_t */,
-				cifs_sb->local_nls);
+		if (cifs_sb->tcon->ses->capabilities & CAP_UNIX)
+			if(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID) {
+				CIFSSMBUnixSetPerms(xid, pTcon, full_path, mode,
+						(__u64)current->euid,  
+						(__u64)current->egid,
+						0 /* dev_t */,
+						cifs_sb->local_nls);
+			} else {
+				CIFSSMBUnixSetPerms(xid, pTcon, full_path, mode,
+						(__u64)-1,  
+						(__u64)-1,
+						0 /* dev_t */,
+						cifs_sb->local_nls);
+			}
 		else { /* BB to be implemented via Windows secrty descriptors*/
 		/* eg CIFSSMBWinSetPerms(xid,pTcon,full_path,mode,-1,-1,local_nls);*/
 		}
diff -urN linux-2.6.8-rc2/fs/cifs/smbencrypt.c linux-2.6.8-rc3/fs/cifs/smbencrypt.c
--- linux-2.6.8-rc2/fs/cifs/smbencrypt.c	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/fs/cifs/smbencrypt.c	2004-08-03 15:21:59.598664846 -0700
@@ -70,8 +70,6 @@
 void NTLMSSPOWFencrypt(unsigned char passwd[8],
 		       unsigned char *ntlmchalresp, unsigned char p24[24]);
 void SMBNTencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24);
-int decode_pw_buffer(char in_buffer[516], char *new_pwrd,
-		     int new_pwrd_size, __u32 * new_pw_len);
 
 /*
    This implements the X/Open SMB password encryption
diff -urN linux-2.6.8-rc2/fs/cifs/smberr.h linux-2.6.8-rc3/fs/cifs/smberr.h
--- linux-2.6.8-rc2/fs/cifs/smberr.h	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/fs/cifs/smberr.h	2004-08-03 15:21:59.599664887 -0700
@@ -1,7 +1,7 @@
 /*
  *   fs/cifs/smberr.h
  *
- *   Copyright (c) International Business Machines  Corp., 2002
+ *   Copyright (c) International Business Machines  Corp., 2002,2004
  *   Author(s): Steve French (sfrench@us.ibm.com)
  *
  *   See Error Codes section of the SNIA CIFS Specification 
@@ -60,6 +60,7 @@
 #define ERRinvparm   87
 #define ERRdiskfull  112
 #define ERRinvname   123
+#define ERRinvlevel  124
 #define ERRdirnotempty 145
 #define ERRnotlocked   158
 #define ERRalreadyexists 183
diff -urN linux-2.6.8-rc2/fs/cifs/xattr.c linux-2.6.8-rc3/fs/cifs/xattr.c
--- linux-2.6.8-rc2/fs/cifs/xattr.c	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/fs/cifs/xattr.c	2004-08-03 15:21:59.620665748 -0700
@@ -26,27 +26,178 @@
 #include "cifsproto.h"
 #include "cifs_debug.h"
 
-int cifs_removexattr(struct dentry * direntry, const char * name)
+#define MAX_EA_VALUE_SIZE 65535
+#define CIFS_XATTR_DOS_ATTRIB "user.DOSATTRIB"
+#define CIFS_XATTR_USER_PREFIX "user."
+#define CIFS_XATTR_SYSTEM_PREFIX "system."
+#define CIFS_XATTR_OS2_PREFIX "OS2." /* BB should check for this someday */
+/* also note could add check for security prefix XATTR_SECURITY_PREFIX */ 
+
+
+int cifs_removexattr(struct dentry * direntry, const char * ea_name)
 {
 	int rc = -EOPNOTSUPP;
+#ifdef CONFIG_CIFS_XATTR
+	int xid;
+	struct cifs_sb_info *cifs_sb;
+	struct cifsTconInfo *pTcon;
+	struct super_block * sb;
+	char * full_path;
+                                                                                     
+	if(direntry == NULL)
+		return -EIO;
+	if(direntry->d_inode == NULL)
+		return -EIO;
+	sb = direntry->d_inode->i_sb;
+	if(sb == NULL)
+		return -EIO;
+	xid = GetXid();
+                                                                                     
+	cifs_sb = CIFS_SB(sb);
+	pTcon = cifs_sb->tcon;
+                                                                                     
+	down(&sb->s_vfs_rename_sem);
+	full_path = build_path_from_dentry(direntry);
+	up(&sb->s_vfs_rename_sem);
+	if(full_path == NULL) {
+		FreeXid(xid);
+		return -ENOMEM;
+	}
+	if(ea_name == NULL) {
+		cFYI(1,("Null xattr names not supported"));
+	} else if(strncmp(ea_name,CIFS_XATTR_USER_PREFIX,5)) {
+		cFYI(1,("illegal xattr namespace %s (only user namespace supported)",ea_name));
+		/* BB what if no namespace prefix? */
+		/* Should we just pass them to server, except for
+		system and perhaps security prefixes? */
+	} else {
+		ea_name+=5; /* skip past user. prefix */
+		rc = CIFSSMBSetEA(xid,pTcon,full_path,ea_name,NULL,
+			(__u16)0, cifs_sb->local_nls);
+	}
+	if (full_path)
+		kfree(full_path);
+	FreeXid(xid);
+#endif
 	return rc;
 }
 
-int cifs_setxattr(struct dentry * direntry, const char * name,
-        const void * value, size_t size, int flags)
+int cifs_setxattr(struct dentry * direntry, const char * ea_name,
+        const void * ea_value, size_t value_size, int flags)
 {
 	int rc = -EOPNOTSUPP;
+#ifdef CONFIG_CIFS_XATTR
+	int xid;
+	struct cifs_sb_info *cifs_sb;
+	struct cifsTconInfo *pTcon;
+	struct super_block * sb;
+	char * full_path;
+
+	if(direntry == NULL)
+		return -EIO;
+	if(direntry->d_inode == NULL)
+		return -EIO;
+	sb = direntry->d_inode->i_sb;
+	if(sb == NULL)
+		return -EIO;
+	xid = GetXid();
+
+	cifs_sb = CIFS_SB(sb);
+	pTcon = cifs_sb->tcon;
+
+	down(&sb->s_vfs_rename_sem);
+	full_path = build_path_from_dentry(direntry);
+	up(&sb->s_vfs_rename_sem);
+	if(full_path == NULL) {
+		FreeXid(xid);
+		return -ENOMEM;
+	}
+	/* return dos attributes as pseudo xattr */
+	/* return alt name if available as pseudo attr */
+
+	/* if proc/fs/cifs/streamstoxattr is set then
+		search server for EAs or streams to 
+		returns as xattrs */
+	if(value_size > MAX_EA_VALUE_SIZE) {
+		cFYI(1,("size of EA value too large"));
+		if(full_path)
+			kfree(full_path);
+		FreeXid(xid);
+		return -EOPNOTSUPP;
+	}
+
+	if(ea_name == NULL) {
+		cFYI(1,("Null xattr names not supported"));
+	} else if(strncmp(ea_name,CIFS_XATTR_USER_PREFIX,5)) {
+		cFYI(1,("illegal xattr namespace %s (only user namespace supported)",ea_name));
+		  /* BB what if no namespace prefix? */
+		  /* Should we just pass them to server, except for 
+		  system and perhaps security prefixes? */
+	} else {
+		ea_name+=5; /* skip past user. prefix */
+		rc = CIFSSMBSetEA(xid,pTcon,full_path,ea_name,ea_value,
+			(__u16)value_size, cifs_sb->local_nls);
+	}
+	if (full_path)
+		kfree(full_path);
+	FreeXid(xid);
+#endif
 	return rc;
 }
 
-ssize_t cifs_getxattr(struct dentry * direntry, const char * name,
-         void * value, size_t size)
+ssize_t cifs_getxattr(struct dentry * direntry, const char * ea_name,
+         void * ea_value, size_t buf_size)
 {
 	ssize_t rc = -EOPNOTSUPP;
+#ifdef CONFIG_CIFS_XATTR
+	int xid;
+	struct cifs_sb_info *cifs_sb;
+	struct cifsTconInfo *pTcon;
+	struct super_block * sb;
+	char * full_path;
+
+	if(direntry == NULL)
+		return -EIO;
+	if(direntry->d_inode == NULL)
+		return -EIO;
+	sb = direntry->d_inode->i_sb;
+	if(sb == NULL)
+		return -EIO;
+	xid = GetXid();
+
+	cifs_sb = CIFS_SB(sb);
+	pTcon = cifs_sb->tcon;
+
+	down(&sb->s_vfs_rename_sem);
+	full_path = build_path_from_dentry(direntry);
+	up(&sb->s_vfs_rename_sem);
+	if(full_path == NULL) {
+		FreeXid(xid);
+		return -ENOMEM;
+	}
+	/* return dos attributes as pseudo xattr */
+	/* return alt name if available as pseudo attr */
+	if(strncmp(ea_name,CIFS_XATTR_USER_PREFIX,5)) {
+		cFYI(1,("illegal xattr namespace %s (only user namespace supported)",ea_name));
+		/* BB what if no namespace prefix? */
+		/* Should we just pass them to server, except for system? */
+	} else {
+	/* We could add a check here
+	    if proc/fs/cifs/streamstoxattr is set then
+		search server for EAs or streams to 
+		returns as xattrs */
+		ea_name+=5; /* skip past user. */
+		rc = CIFSSMBQueryEA(xid,pTcon,full_path,ea_name,ea_value,
+				buf_size, cifs_sb->local_nls);
+	}
+	if (full_path)
+		kfree(full_path);
+	FreeXid(xid);
+#endif
 	return rc;
 }
 
-ssize_t cifs_listxattr(struct dentry * direntry, char * ea_data, size_t ea_size)
+ssize_t cifs_listxattr(struct dentry * direntry, char * data, size_t buf_size)
 {
 	ssize_t rc = -EOPNOTSUPP;
 #ifdef CONFIG_CIFS_XATTR
@@ -55,6 +206,7 @@
 	struct cifsTconInfo *pTcon;
 	struct super_block * sb;
 	char * full_path;
+
 	if(direntry == NULL)
 		return -EIO;
 	if(direntry->d_inode == NULL)
@@ -74,13 +226,17 @@
 		FreeXid(xid);
 		return -ENOMEM;
 	}
-	/* return dosattributes as pseudo xattr */
+	/* return dos attributes as pseudo xattr */
 	/* return alt name if available as pseudo attr */
 
 	/* if proc/fs/cifs/streamstoxattr is set then
 		search server for EAs or streams to 
 		returns as xattrs */
-	rc = CIFSSMBQAllEAs(xid,pTcon,full_path,ea_data,ea_size,cifs_sb->local_nls);
+	rc = CIFSSMBQAllEAs(xid,pTcon,full_path,data,buf_size,
+				cifs_sb->local_nls);
+
+	if (full_path)
+		kfree(full_path);
 	FreeXid(xid);
 #endif
 	return rc;
diff -urN linux-2.6.8-rc2/fs/compat_ioctl.c linux-2.6.8-rc3/fs/compat_ioctl.c
--- linux-2.6.8-rc2/fs/compat_ioctl.c	2004-08-03 15:21:10.541652390 -0700
+++ linux-2.6.8-rc3/fs/compat_ioctl.c	2004-08-03 15:21:59.739670630 -0700
@@ -851,7 +851,7 @@
 
 static int fb_getput_cmap(unsigned int fd, unsigned int cmd, unsigned long arg)
 {
-	struct fb_cmap __user *cmap;
+	struct fb_cmap_user __user *cmap;
 	struct fb_cmap32 __user *cmap32;
 	__u32 data;
 	int err;
diff -urN linux-2.6.8-rc2/fs/exec.c linux-2.6.8-rc3/fs/exec.c
--- linux-2.6.8-rc2/fs/exec.c	2004-08-03 15:21:10.716659569 -0700
+++ linux-2.6.8-rc3/fs/exec.c	2004-08-03 15:21:59.929678425 -0700
@@ -887,8 +887,10 @@
 
 	if(!(bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)) {
 		/* Set-uid? */
-		if (mode & S_ISUID)
+		if (mode & S_ISUID) {
+			current->personality &= ~PER_CLEAR_ON_SETID;
 			bprm->e_uid = inode->i_uid;
+		}
 
 		/* Set-gid? */
 		/*
@@ -896,8 +898,10 @@
 		 * is a candidate for mandatory locking, not a setgid
 		 * executable.
 		 */
-		if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
+		if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
+			current->personality &= ~PER_CLEAR_ON_SETID;
 			bprm->e_gid = inode->i_gid;
+		}
 	}
 
 	/* fill in binprm security blob */
diff -urN linux-2.6.8-rc2/fs/ext2/dir.c linux-2.6.8-rc3/fs/ext2/dir.c
--- linux-2.6.8-rc2/fs/ext2/dir.c	2004-06-15 22:19:35.000000000 -0700
+++ linux-2.6.8-rc3/fs/ext2/dir.c	2004-08-03 15:21:59.960679696 -0700
@@ -257,10 +257,10 @@
 	unsigned chunk_mask = ~(ext2_chunk_size(inode)-1);
 	unsigned char *types = NULL;
 	int need_revalidate = (filp->f_version != inode->i_version);
-	int ret = 0;
+	int ret;
 
 	if (pos > inode->i_size - EXT2_DIR_REC_LEN(1))
-		goto done;
+		goto success;
 
 	if (EXT2_HAS_INCOMPAT_FEATURE(sb, EXT2_FEATURE_INCOMPAT_FILETYPE))
 		types = ext2_filetype_table;
@@ -300,17 +300,19 @@
 						le32_to_cpu(de->inode), d_type);
 				if (over) {
 					ext2_put_page(page);
-					goto done;
+					goto success;
 				}
 			}
 		}
 		ext2_put_page(page);
 	}
 
+success:
+	ret = 0;
 done:
 	filp->f_pos = (n << PAGE_CACHE_SHIFT) | offset;
 	filp->f_version = inode->i_version;
-	return 0;
+	return ret;
 }
 
 /*
diff -urN linux-2.6.8-rc2/fs/fat/inode.c linux-2.6.8-rc3/fs/fat/inode.c
--- linux-2.6.8-rc2/fs/fat/inode.c	2004-08-03 15:21:11.014671795 -0700
+++ linux-2.6.8-rc3/fs/fat/inode.c	2004-08-03 15:22:00.648707921 -0700
@@ -23,14 +23,6 @@
 #include <linux/parser.h>
 #include <asm/unaligned.h>
 
-#ifndef CONFIG_FAT_DEFAULT_IOCHARSET
-/* if user don't select VFAT, this is undefined. */
-#define CONFIG_FAT_DEFAULT_IOCHARSET	""
-#endif
-
-static int fat_default_codepage = CONFIG_FAT_DEFAULT_CODEPAGE;
-static char fat_default_iocharset[] = CONFIG_FAT_DEFAULT_IOCHARSET;
-
 /*
  * New FAT inode stuff. We do the following:
  *	a) i_ino is constant and has nothing with on-disk location.
@@ -174,15 +166,15 @@
 	if (sbi->nls_disk) {
 		unload_nls(sbi->nls_disk);
 		sbi->nls_disk = NULL;
-		sbi->options.codepage = fat_default_codepage;
+		sbi->options.codepage = 0;
 	}
 	if (sbi->nls_io) {
 		unload_nls(sbi->nls_io);
 		sbi->nls_io = NULL;
 	}
-	if (sbi->options.iocharset != fat_default_iocharset) {
+	if (sbi->options.iocharset) {
 		kfree(sbi->options.iocharset);
-		sbi->options.iocharset = fat_default_iocharset;
+		sbi->options.iocharset = NULL;
 	}
 
 	sb->s_fs_info = NULL;
@@ -201,11 +193,10 @@
 		seq_printf(m, ",gid=%u", opts->fs_gid);
 	seq_printf(m, ",fmask=%04o", opts->fs_fmask);
 	seq_printf(m, ",dmask=%04o", opts->fs_dmask);
-	if (sbi->nls_disk && opts->codepage != fat_default_codepage)
+	if (sbi->nls_disk && opts->codepage)
 		seq_printf(m, ",codepage=%s", sbi->nls_disk->charset);
 	if (isvfat) {
-		if (sbi->nls_io &&
-		    strcmp(opts->iocharset, fat_default_iocharset))
+		if (sbi->nls_io && opts->iocharset)
 			seq_printf(m, ",iocharset=%s", sbi->nls_io->charset);
 
 		switch (opts->shortname) {
@@ -336,15 +327,14 @@
 	char *p;
 	substring_t args[MAX_OPT_ARGS];
 	int option;
-	char *iocharset;
 
 	opts->isvfat = is_vfat;
 
 	opts->fs_uid = current->uid;
 	opts->fs_gid = current->gid;
 	opts->fs_fmask = opts->fs_dmask = current->fs->umask;
-	opts->codepage = fat_default_codepage;
-	opts->iocharset = fat_default_iocharset;
+	opts->codepage = 0;
+	opts->iocharset = NULL;
 	if (is_vfat)
 		opts->shortname = VFAT_SFN_DISPLAY_LOWER|VFAT_SFN_CREATE_WIN95;
 	else
@@ -443,12 +433,11 @@
 
 		/* vfat specific */
 		case Opt_charset:
-			if (opts->iocharset != fat_default_iocharset)
+			if (opts->iocharset)
 				kfree(opts->iocharset);
-			iocharset = match_strdup(&args[0]);
-			if (!iocharset)
+			opts->iocharset = match_strdup(&args[0]);
+			if (opts->iocharset == NULL)
 				return -ENOMEM;
-			opts->iocharset = iocharset;
 			break;
 		case Opt_shortname_lower:
 			opts->shortname = VFAT_SFN_DISPLAY_LOWER
@@ -497,15 +486,9 @@
 			return -EINVAL;
 		}
 	}
-	/* UTF8 doesn't provide FAT semantics */
-	if (!strcmp(opts->iocharset, "utf8")) {
-		printk(KERN_ERR "FAT: utf8 is not a recommended IO charset"
-		       " for FAT filesystems, filesystem will be case sensitive!\n");
-	}
-
 	if (opts->unicode_xlate)
 		opts->utf8 = 0;
-	
+
 	return 0;
 }
 
@@ -785,6 +768,66 @@
 	.get_parent	= fat_get_parent,
 };
 
+static int fat_load_nls(struct super_block *sb)
+{
+	struct msdos_sb_info *sbi = MSDOS_SB(sb);
+	struct fat_mount_options *opts = &sbi->options;
+	char codepage[50], *iocharset;
+	int error = 0, not_specified = 0;
+
+	if (opts->codepage)
+		snprintf(codepage, sizeof(codepage), "cp%d", opts->codepage);
+	else {
+		not_specified = 1;
+		strcpy(codepage, "default");
+	}
+	sbi->nls_disk = load_nls(codepage);
+	if (sbi->nls_disk == NULL) {
+		printk(KERN_ERR "FAT: codepage %s not found\n", codepage);
+		error = -EINVAL;
+		goto out;
+	}
+
+	if (opts->isvfat) {
+		if (opts->iocharset)
+			iocharset = opts->iocharset;
+		else {
+			not_specified = 1;
+			iocharset = "default";
+		}
+		/*
+		 * FIXME: utf8 is using iocharset for upper/lower conversion
+		 * UTF8 doesn't provide FAT semantics
+		 */
+		if (!strcmp(iocharset, "utf8")) {
+			printk(KERN_WARNING
+			       "FAT: utf8 is not a recommended IO charset"
+			       " for FAT filesystem,"
+			       " filesystem will be case sensitive!\n");
+		}
+		sbi->nls_io = load_nls(iocharset);
+		if (sbi->nls_io == NULL) {
+			printk(KERN_ERR "FAT: IO charset %s not found\n",
+			       iocharset);
+			error = -EINVAL;
+			goto out;
+		}
+	}
+
+	if (not_specified) {
+		unsigned long not_ro = !(sb->s_flags & MS_RDONLY);
+		if (not_ro)
+			sb->s_flags |= MS_RDONLY;
+
+		printk(KERN_INFO "FAT: %s option didn't specified\n"
+		       "     File name can not access proper%s\n",
+		       opts->isvfat ? "codepage or iocharset" : "codepage",
+		       not_ro ? " (mounted as read-only)" : "");
+	}
+out:
+	return error;
+}
+
 /*
  * Read the super block of an MS-DOS FS.
  */
@@ -800,7 +843,6 @@
 	int debug, first;
 	unsigned int media;
 	long error;
-	char buf[50];
 
 	sbi = kmalloc(sizeof(struct msdos_sb_info), GFP_KERNEL);
 	if (!sbi)
@@ -1015,23 +1057,9 @@
 		goto out_invalid;
 	}
 
-	error = -EINVAL;
-	sprintf(buf, "cp%d", sbi->options.codepage);
-	sbi->nls_disk = load_nls(buf);
-	if (!sbi->nls_disk) {
-		printk(KERN_ERR "FAT: codepage %s not found\n", buf);
+	error = fat_load_nls(sb);
+	if (error)
 		goto out_fail;
-	}
-
-	/* FIXME: utf8 is using iocharset for upper/lower conversion */
-	if (sbi->options.isvfat) {
-		sbi->nls_io = load_nls(sbi->options.iocharset);
-		if (!sbi->nls_io) {
-			printk(KERN_ERR "FAT: IO charset %s not found\n",
-			       sbi->options.iocharset);
-			goto out_fail;
-		}
-	}
 
 	error = -ENOMEM;
 	root_inode = new_inode(sb);
@@ -1065,7 +1093,7 @@
 		unload_nls(sbi->nls_io);
 	if (sbi->nls_disk)
 		unload_nls(sbi->nls_disk);
-	if (sbi->options.iocharset != fat_default_iocharset)
+	if (sbi->options.iocharset)
 		kfree(sbi->options.iocharset);
 	sb->s_fs_info = NULL;
 	kfree(sbi);
diff -urN linux-2.6.8-rc2/fs/hugetlbfs/inode.c linux-2.6.8-rc3/fs/hugetlbfs/inode.c
--- linux-2.6.8-rc2/fs/hugetlbfs/inode.c	2004-08-03 15:21:11.216680082 -0700
+++ linux-2.6.8-rc3/fs/hugetlbfs/inode.c	2004-08-03 15:22:01.216731222 -0700
@@ -52,6 +52,9 @@
 	loff_t len, vma_len;
 	int ret;
 
+	if (vma->vm_pgoff & (HPAGE_SIZE / PAGE_SIZE - 1))
+		return -EINVAL;
+
 	if (vma->vm_start & ~HPAGE_MASK)
 		return -EINVAL;
 
@@ -278,16 +281,16 @@
 		unsigned long v_length;
 		unsigned long v_offset;
 
-		h_vm_pgoff = vma->vm_pgoff << (HPAGE_SHIFT - PAGE_SHIFT);
-		v_length = vma->vm_end - vma->vm_start;
+		h_vm_pgoff = vma->vm_pgoff >> (HPAGE_SHIFT - PAGE_SHIFT);
 		v_offset = (h_pgoff - h_vm_pgoff) << HPAGE_SHIFT;
-
 		/*
 		 * Is this VMA fully outside the truncation point?
 		 */
 		if (h_vm_pgoff >= h_pgoff)
 			v_offset = 0;
 
+		v_length = vma->vm_end - vma->vm_start;
+
 		zap_hugepage_range(vma,
 				vma->vm_start + v_offset,
 				v_length - v_offset);
diff -urN linux-2.6.8-rc2/fs/jffs/jffs_proc.c linux-2.6.8-rc3/fs/jffs/jffs_proc.c
--- linux-2.6.8-rc2/fs/jffs/jffs_proc.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/fs/jffs/jffs_proc.c	2004-08-03 15:22:02.184770934 -0700
@@ -68,9 +68,9 @@
 int jffs_register_jffs_proc_dir(int mtd, struct jffs_control *c)
 {
 	struct jffs_partition_dir *part_dir;
-	struct proc_dir_entry *part_info = 0;
-	struct proc_dir_entry *part_layout = 0;
-	struct proc_dir_entry *part_root = 0;
+	struct proc_dir_entry *part_info = NULL;
+	struct proc_dir_entry *part_layout = NULL;
+	struct proc_dir_entry *part_root = NULL;
 	char name[10];
 
 	sprintf(name, "%d", mtd);
@@ -127,7 +127,7 @@
 int jffs_unregister_jffs_proc_dir(struct jffs_control *c)
 {
 	struct jffs_partition_dir *part_dir = jffs_part_dirs;
-	struct jffs_partition_dir *prev_part_dir = 0;
+	struct jffs_partition_dir *prev_part_dir = NULL;
 
 	while (part_dir) {
 		if (part_dir->c == c) {
@@ -209,8 +209,8 @@
 		int count, int *eof, void *data)
 {
 	struct jffs_control *c = (struct jffs_control *) data;
-	struct jffs_fm *fm = 0;
-	struct jffs_fm *last_fm = 0;
+	struct jffs_fm *fm = NULL;
+	struct jffs_fm *last_fm = NULL;
 	int len = 0;
 
 	/* Get the first item in the list */
diff -urN linux-2.6.8-rc2/fs/jffs2/erase.c linux-2.6.8-rc3/fs/jffs2/erase.c
--- linux-2.6.8-rc2/fs/jffs2/erase.c	2004-08-03 15:21:11.374686564 -0700
+++ linux-2.6.8-rc3/fs/jffs2/erase.c	2004-08-03 15:22:02.423780738 -0700
@@ -402,7 +402,7 @@
 			goto bad2;
 		}
 		if (retlen != sizeof(marker)) {
-			printk(KERN_WARNING "Short write to newly-erased block at 0x%08x: Wanted %d, got %zd\n",
+			printk(KERN_WARNING "Short write to newly-erased block at 0x%08x: Wanted %zd, got %zd\n",
 			       jeb->offset, sizeof(marker), retlen);
 			goto bad2;
 		}
diff -urN linux-2.6.8-rc2/fs/jffs2/gc.c linux-2.6.8-rc3/fs/jffs2/gc.c
--- linux-2.6.8-rc2/fs/jffs2/gc.c	2004-08-03 15:21:11.379686769 -0700
+++ linux-2.6.8-rc3/fs/jffs2/gc.c	2004-08-03 15:22:02.507784184 -0700
@@ -824,7 +824,7 @@
 				continue;
 			}
 			if (retlen != rawlen) {
-				printk(KERN_WARNING "jffs2_g_c_deletion_dirent(): Short read (%zd not %zd) reading header from obsolete node at %08x\n",
+				printk(KERN_WARNING "jffs2_g_c_deletion_dirent(): Short read (%zd not %u) reading header from obsolete node at %08x\n",
 				       retlen, rawlen, ref_offset(raw));
 				continue;
 			}
diff -urN linux-2.6.8-rc2/fs/locks.c linux-2.6.8-rc3/fs/locks.c
--- linux-2.6.8-rc2/fs/locks.c	2004-08-03 15:21:11.644697640 -0700
+++ linux-2.6.8-rc3/fs/locks.c	2004-08-03 15:22:03.790836818 -0700
@@ -60,7 +60,7 @@
  *
  *  Initial implementation of mandatory locks. SunOS turned out to be
  *  a rotten model, so I implemented the "obvious" semantics.
- *  See 'linux/Documentation/mandatory.txt' for details.
+ *  See 'Documentation/mandatory.txt' for details.
  *  Andy Walker (andy@lysaker.kvaerner.no), April 06, 1996.
  *
  *  Don't allow mandatory locks on mmap()'ed files. Added simple functions to
diff -urN linux-2.6.8-rc2/fs/mpage.c linux-2.6.8-rc3/fs/mpage.c
--- linux-2.6.8-rc2/fs/mpage.c	2004-08-03 15:21:11.670698707 -0700
+++ linux-2.6.8-rc3/fs/mpage.c	2004-08-03 15:22:03.867839977 -0700
@@ -553,7 +553,12 @@
 			bh = bh->b_this_page;
 		} while (bh != head);
 
-		if (buffer_heads_over_limit)
+		/*
+		 * we cannot drop the bh if the page is not uptodate
+		 * or a concurrent readpage would fail to serialize with the bh
+		 * and it would read from disk before we reach the platter.
+		 */
+		if (buffer_heads_over_limit && PageUptodate(page))
 			try_to_free_buffers(page);
 	}
 
diff -urN linux-2.6.8-rc2/fs/namespace.c linux-2.6.8-rc3/fs/namespace.c
--- linux-2.6.8-rc2/fs/namespace.c	2004-08-03 15:21:11.684699281 -0700
+++ linux-2.6.8-rc3/fs/namespace.c	2004-08-03 15:22:03.871840141 -0700
@@ -1037,6 +1037,7 @@
 	struct namespace *new_ns;
 	struct vfsmount *rootmnt = NULL, *pwdmnt = NULL, *altrootmnt = NULL;
 	struct fs_struct *fs = tsk->fs;
+	struct vfsmount *p, *q;
 
 	if (!namespace)
 		return 0;
@@ -1071,14 +1072,16 @@
 	list_add_tail(&new_ns->list, &new_ns->root->mnt_list);
 	spin_unlock(&vfsmount_lock);
 
-	/* Second pass: switch the tsk->fs->* elements */
-	if (fs) {
-		struct vfsmount *p, *q;
-		write_lock(&fs->lock);
-
-		p = namespace->root;
-		q = new_ns->root;
-		while (p) {
+	/*
+	 * Second pass: switch the tsk->fs->* elements and mark new vfsmounts
+	 * as belonging to new namespace.  We have already acquired a private
+	 * fs_struct, so tsk->fs->lock is not needed.
+	 */
+	p = namespace->root;
+	q = new_ns->root;
+	while (p) {
+		q->mnt_namespace = new_ns;
+		if (fs) {
 			if (p == fs->rootmnt) {
 				rootmnt = p;
 				fs->rootmnt = mntget(q);
@@ -1091,10 +1094,9 @@
 				altrootmnt = p;
 				fs->altrootmnt = mntget(q);
 			}
-			p = next_mnt(p, namespace->root);
-			q = next_mnt(q, new_ns->root);
 		}
-		write_unlock(&fs->lock);
+		p = next_mnt(p, namespace->root);
+		q = next_mnt(q, new_ns->root);
 	}
 	up_write(&tsk->namespace->sem);
 
diff -urN linux-2.6.8-rc2/fs/ncpfs/inode.c linux-2.6.8-rc3/fs/ncpfs/inode.c
--- linux-2.6.8-rc2/fs/ncpfs/inode.c	2004-08-03 15:21:11.734701333 -0700
+++ linux-2.6.8-rc3/fs/ncpfs/inode.c	2004-08-03 15:22:04.000845433 -0700
@@ -957,7 +957,7 @@
 #endif
 	}
 	if (!result)
-		inode_setattr(inode, attr);
+		result = inode_setattr(inode, attr);
 out:
 	unlock_kernel();
 	return result;
diff -urN linux-2.6.8-rc2/fs/nfs/inode.c linux-2.6.8-rc3/fs/nfs/inode.c
--- linux-2.6.8-rc2/fs/nfs/inode.c	2004-06-15 22:19:44.000000000 -0700
+++ linux-2.6.8-rc3/fs/nfs/inode.c	2004-08-03 15:22:04.335859176 -0700
@@ -456,7 +456,7 @@
 
 	/* Create RPC client handles */
 	server->client = nfs_create_client(server, data);
-	if (server->client == NULL)
+	if (IS_ERR(server->client))
 		goto out_fail;
 	/* RFC 2623, sec 2.3.2 */
 	if (authflavor != RPC_AUTH_UNIX) {
@@ -1550,16 +1550,17 @@
 		err = PTR_ERR(clnt);
 		goto out_remove_list;
 	}
+
+	clnt->cl_intr     = (server->flags & NFS4_MOUNT_INTR) ? 1 : 0;
+	clnt->cl_softrtry = (server->flags & NFS4_MOUNT_SOFT) ? 1 : 0;
+	server->client    = clnt;
+
 	err = -ENOMEM;
 	if (server->nfs4_state->cl_idmap == NULL) {
 		printk(KERN_WARNING "NFS: failed to create idmapper.\n");
 		goto out_shutdown;
 	}
 
-	clnt->cl_intr     = (server->flags & NFS4_MOUNT_INTR) ? 1 : 0;
-	clnt->cl_softrtry = (server->flags & NFS4_MOUNT_SOFT) ? 1 : 0;
-	server->client    = clnt;
-
 	if (clnt->cl_auth->au_flavor != authflavour) {
 		if (rpcauth_create(authflavour, clnt) == NULL) {
 			printk(KERN_WARNING "NFS: couldn't create credcache!\n");
diff -urN linux-2.6.8-rc2/fs/ntfs/compress.c linux-2.6.8-rc3/fs/ntfs/compress.c
--- linux-2.6.8-rc2/fs/ntfs/compress.c	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/fs/ntfs/compress.c	2004-08-03 15:22:05.480906149 -0700
@@ -195,7 +195,7 @@
 
 	ntfs_debug("Entering, cb_size = 0x%x.", cb_size);
 do_next_sb:
-	ntfs_debug("Beginning sub-block at offset = 0x%x in the cb.",
+	ntfs_debug("Beginning sub-block at offset = 0x%zx in the cb.",
 			cb - cb_start);
 	/*
 	 * Have we reached the end of the compression block or the end of the
diff -urN linux-2.6.8-rc2/fs/ntfs/dir.c linux-2.6.8-rc3/fs/ntfs/dir.c
--- linux-2.6.8-rc2/fs/ntfs/dir.c	2004-08-03 15:21:11.985711630 -0700
+++ linux-2.6.8-rc3/fs/ntfs/dir.c	2004-08-03 15:22:05.518907707 -0700
@@ -1222,7 +1222,7 @@
 	 * or signals an error (both covered by the rc test).
 	 */
 	for (;; ie = (INDEX_ENTRY*)((u8*)ie + le16_to_cpu(ie->length))) {
-		ntfs_debug("In index root, offset 0x%x.", (u8*)ie - (u8*)ir);
+		ntfs_debug("In index root, offset 0x%zx.", (u8*)ie - (u8*)ir);
 		/* Bounds checks. */
 		if (unlikely((u8*)ie < (u8*)ir || (u8*)ie +
 				sizeof(INDEX_ENTRY_HEADER) > index_end ||
diff -urN linux-2.6.8-rc2/fs/ntfs/super.c linux-2.6.8-rc3/fs/ntfs/super.c
--- linux-2.6.8-rc2/fs/ntfs/super.c	2004-08-03 15:21:12.012712737 -0700
+++ linux-2.6.8-rc3/fs/ntfs/super.c	2004-08-03 15:22:05.756917471 -0700
@@ -1190,7 +1190,7 @@
 			goto read_partial_upcase_page;
 	}
 	vol->upcase_len = ino->i_size >> UCHAR_T_SIZE_BITS;
-	ntfs_debug("Read %llu bytes from $UpCase (expected %u bytes).",
+	ntfs_debug("Read %llu bytes from $UpCase (expected %zu bytes).",
 			ino->i_size, 64 * 1024 * sizeof(ntfschar));
 	iput(ino);
 	down(&ntfs_lock);
diff -urN linux-2.6.8-rc2/fs/openpromfs/inode.c linux-2.6.8-rc3/fs/openpromfs/inode.c
--- linux-2.6.8-rc2/fs/openpromfs/inode.c	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/fs/openpromfs/inode.c	2004-08-03 15:22:05.757917512 -0700
@@ -64,7 +64,7 @@
 static struct dentry *openpromfs_lookup(struct inode *, struct dentry *dentry, struct nameidata *nd);
 static int openpromfs_unlink (struct inode *, struct dentry *dentry);
 
-static ssize_t nodenum_read(struct file *file, char *buf,
+static ssize_t nodenum_read(struct file *file, char __user *buf,
 			    size_t count, loff_t *ppos)
 {
 	struct inode *inode = file->f_dentry->d_inode;
@@ -83,7 +83,7 @@
 	return count;
 }
 
-static ssize_t property_read(struct file *filp, char *buf,
+static ssize_t property_read(struct file *filp, char __user *buf,
 			     size_t count, loff_t *ppos)
 {
 	struct inode *inode = filp->f_dentry->d_inode;
@@ -101,7 +101,7 @@
 		i = ((u32)(long)inode->u.generic_ip) >> 16;
 		if ((u16)((long)inode->u.generic_ip) == aliases) {
 			if (i >= aliases_nodes)
-				p = 0;
+				p = NULL;
 			else
 				p = alias_names [i];
 		} else
@@ -135,7 +135,7 @@
 			return -EIO;
 		op->value [k] = 0;
 		if (k) {
-			for (s = 0, p = op->value; p < op->value + k; p++) {
+			for (s = NULL, p = op->value; p < op->value + k; p++) {
 				if ((*p >= ' ' && *p <= '~') || *p == '\n') {
 					op->flag |= OPP_STRING;
 					s = p;
@@ -318,7 +318,7 @@
 	return count;
 }
 
-static ssize_t property_write(struct file *filp, const char *buf,
+static ssize_t property_write(struct file *filp, const char __user *buf,
 			      size_t count, loff_t *ppos)
 {
 	int i, j, k;
@@ -330,7 +330,7 @@
 	if (filp->f_pos >= 0xffffff || count >= 0xffffff)
 		return -EINVAL;
 	if (!filp->private_data) {
-		i = property_read (filp, NULL, 0, 0);
+		i = property_read (filp, NULL, 0, NULL);
 		if (i)
 			return i;
 	}
@@ -416,7 +416,7 @@
 			mask &= mask2;
 			if (mask) {
 				*first &= ~mask;
-				*first |= simple_strtoul (tmp, 0, 16);
+				*first |= simple_strtoul (tmp, NULL, 16);
 				op->flag |= OPP_DIRTY;
 			}
 		} else {
@@ -433,7 +433,7 @@
 						for (j = 0; j < first_off; j++)
 							mask >>= 1;
 						*q &= ~mask;
-						*q |= simple_strtoul (tmp,0,16);
+						*q |= simple_strtoul (tmp,NULL,16);
 					}
 					buf += 9;
 				} else if ((q == last - 1) && last_cnt
@@ -445,14 +445,14 @@
 					for (j = 0; j < 8 - last_cnt; j++)
 						mask <<= 1;
 					*q &= ~mask;
-					*q |= simple_strtoul (tmp, 0, 16);
+					*q |= simple_strtoul (tmp, NULL, 16);
 					buf += last_cnt;
 				} else {
 					char tchars[17]; /* XXX yuck... */
 
 					if (copy_from_user(tchars, buf, 16))
 						return -EFAULT;
-					*q = simple_strtoul (tchars, 0, 16);
+					*q = simple_strtoul (tchars, NULL, 16);
 					buf += 9;
 				}
 			}
diff -urN linux-2.6.8-rc2/fs/partitions/check.c linux-2.6.8-rc3/fs/partitions/check.c
--- linux-2.6.8-rc2/fs/partitions/check.c	2004-08-03 15:21:12.046714132 -0700
+++ linux-2.6.8-rc3/fs/partitions/check.c	2004-08-03 15:22:05.794919030 -0700
@@ -395,7 +395,7 @@
 	if (disk->fops->revalidate_disk)
 		disk->fops->revalidate_disk(disk);
 	if (!get_capacity(disk) || !(state = check_partition(disk, bdev)))
-		return res;
+		return -EIO;
 	for (p = 1; p < state->limit; p++) {
 		sector_t size = state->parts[p].size;
 		sector_t from = state->parts[p].from;
@@ -408,7 +408,7 @@
 #endif
 	}
 	kfree(state);
-	return res;
+	return 0;
 }
 
 unsigned char *read_dev_sector(struct block_device *bdev, sector_t n, Sector *p)
diff -urN linux-2.6.8-rc2/fs/proc/proc_devtree.c linux-2.6.8-rc3/fs/proc/proc_devtree.c
--- linux-2.6.8-rc2/fs/proc/proc_devtree.c	2004-06-15 22:19:43.000000000 -0700
+++ linux-2.6.8-rc3/fs/proc/proc_devtree.c	2004-08-03 15:22:05.890922968 -0700
@@ -88,7 +88,7 @@
 	child = NULL;
 	while ((child = of_get_next_child(np, child))) {
 		p = strrchr(child->full_name, '/');
-		if (p == 0)
+		if (!p)
 			p = child->full_name;
 		else
 			++p;
@@ -140,7 +140,7 @@
 		lastp = &al->next;
 	}
 	of_node_put(child);
-	*lastp = 0;
+	*lastp = NULL;
 	de->subdir = list;
 }
 
@@ -152,7 +152,7 @@
 	struct device_node *root;
 	if ( !have_of )
 		return;
-	proc_device_tree = proc_mkdir("device-tree", 0);
+	proc_device_tree = proc_mkdir("device-tree", NULL);
 	if (proc_device_tree == 0)
 		return;
 	root = of_find_node_by_path("/");
diff -urN linux-2.6.8-rc2/include/asm-alpha/uaccess.h linux-2.6.8-rc3/include/asm-alpha/uaccess.h
--- linux-2.6.8-rc2/include/asm-alpha/uaccess.h	2004-08-03 15:21:12.959751588 -0700
+++ linux-2.6.8-rc3/include/asm-alpha/uaccess.h	2004-08-03 15:22:07.868004072 -0700
@@ -107,7 +107,7 @@
 #define __get_user_check(x,ptr,size,segment)				\
 ({									\
 	long __gu_err = -EFAULT, __gu_val = 0;				\
-	const __typeof__(*(ptr)) *__gu_addr = (ptr);			\
+	const __typeof__(*(ptr)) __user *__gu_addr = (ptr);		\
 	__chk_user_ptr(ptr);						\
 	if (__access_ok((unsigned long)__gu_addr,size,segment)) {	\
 		__gu_err = 0;						\
@@ -222,7 +222,7 @@
 #define __put_user_check(x,ptr,size,segment)				\
 ({									\
 	long __pu_err = -EFAULT;					\
-	__typeof__(*(ptr)) *__pu_addr = (ptr);				\
+	__typeof__(*(ptr)) __user *__pu_addr = (ptr);			\
 	__chk_user_ptr(ptr);						\
 	if (__access_ok((unsigned long)__pu_addr,size,segment)) {	\
 		__pu_err = 0;						\
diff -urN linux-2.6.8-rc2/include/asm-arm/bitops.h linux-2.6.8-rc3/include/asm-arm/bitops.h
--- linux-2.6.8-rc2/include/asm-arm/bitops.h	2004-06-15 22:18:54.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-arm/bitops.h	2004-08-03 15:22:08.306022041 -0700
@@ -227,7 +227,7 @@
 extern int _find_first_zero_bit_be(void * p, unsigned size);
 extern int _find_next_zero_bit_be(void * p, int size, int offset);
 extern int _find_first_bit_be(const unsigned long *p, unsigned size);
-extern int _find_next_bit_be(unsigned long *p, int size, int offset);
+extern int _find_next_bit_be(const unsigned long *p, int size, int offset);
 
 /*
  * The __* form of bitops are non-atomic and may be reordered.
diff -urN linux-2.6.8-rc2/include/asm-arm/cacheflush.h linux-2.6.8-rc3/include/asm-arm/cacheflush.h
--- linux-2.6.8-rc2/include/asm-arm/cacheflush.h	2004-06-15 22:20:03.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-arm/cacheflush.h	2004-08-03 15:22:08.324022779 -0700
@@ -97,7 +97,7 @@
  *	Start addresses are inclusive and end addresses are exclusive;
  *	start addresses should be rounded down, end addresses up.
  *
- *	See linux/Documentation/cachetlb.txt for more information.
+ *	See Documentation/cachetlb.txt for more information.
  *	Please note that the implementation of these, and the required
  *	effects are cache-type (VIVT/VIPT/PIPT) specific.
  *
diff -urN linux-2.6.8-rc2/include/asm-arm/io.h linux-2.6.8-rc3/include/asm-arm/io.h
--- linux-2.6.8-rc2/include/asm-arm/io.h	2004-06-15 22:19:11.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-arm/io.h	2004-08-03 15:22:08.338023353 -0700
@@ -263,7 +263,7 @@
  * ioremap and friends.
  *
  * ioremap takes a PCI memory address, as specified in
- * linux/Documentation/IO-mapping.txt.
+ * Documentation/IO-mapping.txt.
  */
 extern void * __ioremap(unsigned long, size_t, unsigned long, unsigned long);
 extern void __iounmap(void *addr);
diff -urN linux-2.6.8-rc2/include/asm-arm/ipc.h linux-2.6.8-rc3/include/asm-arm/ipc.h
--- linux-2.6.8-rc2/include/asm-arm/ipc.h	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-arm/ipc.h	2004-08-03 15:22:08.339023394 -0700
@@ -7,7 +7,7 @@
  * See arch/arm/kernel/sys-arm.c for ugly details..
  */
 struct ipc_kludge {
-	struct msgbuf *msgp;
+	struct msgbuf __user *msgp;
 	long msgtyp;
 };
 
diff -urN linux-2.6.8-rc2/include/asm-arm/setup.h linux-2.6.8-rc3/include/asm-arm/setup.h
--- linux-2.6.8-rc2/include/asm-arm/setup.h	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-arm/setup.h	2004-08-03 15:22:08.387025363 -0700
@@ -8,7 +8,7 @@
  * published by the Free Software Foundation.
  *
  *  Structure passed to kernel to tell it about the
- *  hardware it's running on.  See linux/Documentation/arm/Setup
+ *  hardware it's running on.  See Documentation/arm/Setup
  *  for more info.
  */
 #ifndef __ASMARM_SETUP_H
diff -urN linux-2.6.8-rc2/include/asm-arm/signal.h linux-2.6.8-rc3/include/asm-arm/signal.h
--- linux-2.6.8-rc2/include/asm-arm/signal.h	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-arm/signal.h	2004-08-03 15:22:08.388025404 -0700
@@ -133,7 +133,11 @@
 #define SIG_SETMASK        2	/* for setting the signal mask */
 
 /* Type of a signal handler.  */
-typedef void (*__sighandler_t)(int);
+typedef void __signalfn_t(int);
+typedef __signalfn_t __user *__sighandler_t;
+
+typedef void __restorefn_t(void);
+typedef __restorefn_t __user *__sigrestore_t;
 
 #define SIG_DFL	((__sighandler_t)0)	/* default signal handling */
 #define SIG_IGN	((__sighandler_t)1)	/* ignore signal */
@@ -144,13 +148,13 @@
 	__sighandler_t sa_handler;
 	old_sigset_t sa_mask;
 	unsigned long sa_flags;
-	void (*sa_restorer)(void);
+	__sigrestore_t sa_restorer;
 };
 
 struct sigaction {
 	__sighandler_t sa_handler;
 	unsigned long sa_flags;
-	void (*sa_restorer)(void);
+	__sigrestore_t sa_restorer;
 	sigset_t sa_mask;		/* mask last for extensibility */
 };
 
@@ -177,7 +181,7 @@
 #endif /* __KERNEL__ */
 
 typedef struct sigaltstack {
-	void *ss_sp;
+	void __user *ss_sp;
 	int ss_flags;
 	size_t ss_size;
 } stack_t;
diff -urN linux-2.6.8-rc2/include/asm-arm/uaccess.h linux-2.6.8-rc3/include/asm-arm/uaccess.h
--- linux-2.6.8-rc2/include/asm-arm/uaccess.h	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-arm/uaccess.h	2004-08-03 15:22:08.389025446 -0700
@@ -68,6 +68,7 @@
 /* We use 33-bit arithmetic here... */
 #define __range_ok(addr,size) ({ \
 	unsigned long flag, sum; \
+	__chk_user_ptr(addr);	\
 	__asm__("adds %1, %2, %3; sbcccs %1, %1, %0; movcc %0, #0" \
 		: "=&r" (flag), "=&r" (sum) \
 		: "r" (addr), "Ir" (size), "0" (current_thread_info()->addr_limit) \
@@ -117,7 +118,7 @@
 
 #define get_user(x,p)							\
 	({								\
-		const register typeof(*(p)) *__p asm("r0") = (p);	\
+		const register typeof(*(p)) __user *__p asm("r0") = (p);\
 		register typeof(*(p)) __r1 asm("r1");			\
 		register int __e asm("r0");				\
 		switch (sizeof(*(__p))) {				\
@@ -156,6 +157,7 @@
 do {									\
 	unsigned long __gu_addr = (unsigned long)(ptr);			\
 	unsigned long __gu_val;						\
+	__chk_user_ptr(ptr);						\
 	switch (sizeof(*(ptr))) {					\
 	case 1:	__get_user_asm_byte(__gu_val,__gu_addr,err);	break;	\
 	case 2:	__get_user_asm_half(__gu_val,__gu_addr,err);	break;	\
@@ -236,7 +238,7 @@
 #define put_user(x,p)							\
 	({								\
 		const register typeof(*(p)) __r1 asm("r1") = (x);	\
-		const register typeof(*(p)) *__p asm("r0") = (p);	\
+		const register typeof(*(p)) __user *__p asm("r0") = (p);\
 		register int __e asm("r0");				\
 		switch (sizeof(*(__p))) {				\
 		case 1:							\
@@ -273,6 +275,7 @@
 do {									\
 	unsigned long __pu_addr = (unsigned long)(ptr);			\
 	__typeof__(*(ptr)) __pu_val = (x);				\
+	__chk_user_ptr(ptr);						\
 	switch (sizeof(*(ptr))) {					\
 	case 1: __put_user_asm_byte(__pu_val,__pu_addr,err);	break;	\
 	case 2: __put_user_asm_half(__pu_val,__pu_addr,err);	break;	\
diff -urN linux-2.6.8-rc2/include/asm-arm26/io.h linux-2.6.8-rc3/include/asm-arm26/io.h
--- linux-2.6.8-rc2/include/asm-arm26/io.h	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-arm26/io.h	2004-08-03 15:22:08.515030614 -0700
@@ -386,7 +386,7 @@
  * ioremap and friends.
  *
  * ioremap takes a PCI memory address, as specified in
- * linux/Documentation/IO-mapping.txt.
+ * Documentation/IO-mapping.txt.
  */
 extern void * __ioremap(unsigned long, size_t, unsigned long, unsigned long);
 extern void __iounmap(void *addr);
diff -urN linux-2.6.8-rc2/include/asm-arm26/setup.h linux-2.6.8-rc3/include/asm-arm26/setup.h
--- linux-2.6.8-rc2/include/asm-arm26/setup.h	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-arm26/setup.h	2004-08-03 15:22:08.596033937 -0700
@@ -8,7 +8,7 @@
  * published by the Free Software Foundation.
  *
  *  Structure passed to kernel to tell it about the
- *  hardware it's running on.  See linux/Documentation/arm/Setup
+ *  hardware it's running on.  See Documentation/arm/Setup
  *  for more info.
  */
 #ifndef __ASMARM_SETUP_H
diff -urN linux-2.6.8-rc2/include/asm-generic/pgtable.h linux-2.6.8-rc3/include/asm-generic/pgtable.h
--- linux-2.6.8-rc2/include/asm-generic/pgtable.h	2004-06-15 22:19:10.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-generic/pgtable.h	2004-08-03 15:22:08.702038286 -0700
@@ -122,4 +122,8 @@
 #define page_test_and_clear_young(page) (0)
 #endif
 
+#ifndef __HAVE_ARCH_PGD_OFFSET_GATE
+#define pgd_offset_gate(mm, addr)	pgd_offset(mm, addr)
+#endif
+
 #endif /* _ASM_GENERIC_PGTABLE_H */
diff -urN linux-2.6.8-rc2/include/asm-i386/elf.h linux-2.6.8-rc3/include/asm-i386/elf.h
--- linux-2.6.8-rc2/include/asm-i386/elf.h	2004-06-15 22:19:42.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-i386/elf.h	2004-08-03 15:22:08.839043906 -0700
@@ -117,7 +117,13 @@
 #define AT_SYSINFO_EHDR		33
 
 #ifdef __KERNEL__
-#define SET_PERSONALITY(ex, ibcs2) set_personality((ibcs2)?PER_SVR4:PER_LINUX)
+#define SET_PERSONALITY(ex, ibcs2) do { } while (0)
+
+/*
+ * An executable for which elf_read_implies_exec() returns TRUE will
+ * have the READ_IMPLIES_EXEC personality flag set automatically.
+ */
+#define elf_read_implies_exec_binary(ex, have_pt_gnu_stack)	(!(have_pt_gnu_stack))
 
 extern int dump_task_regs (struct task_struct *, elf_gregset_t *);
 extern int dump_task_fpu (struct task_struct *, elf_fpregset_t *);
diff -urN linux-2.6.8-rc2/include/asm-i386/io_apic.h linux-2.6.8-rc3/include/asm-i386/io_apic.h
--- linux-2.6.8-rc2/include/asm-i386/io_apic.h	2004-08-03 15:21:13.240763116 -0700
+++ linux-2.6.8-rc3/include/asm-i386/io_apic.h	2004-08-03 15:22:08.855044563 -0700
@@ -13,7 +13,7 @@
 
 #ifdef CONFIG_X86_IO_APIC
 
-#ifdef CONFIG_PCI_USE_VECTOR
+#ifdef CONFIG_PCI_MSI
 static inline int use_pci_vector(void)	{return 1;}
 static inline void disable_edge_ioapic_vector(unsigned int vector) { }
 static inline void mask_and_ack_level_ioapic_vector(unsigned int vector) { }
diff -urN linux-2.6.8-rc2/include/asm-i386/mach-default/irq_vectors_limits.h linux-2.6.8-rc3/include/asm-i386/mach-default/irq_vectors_limits.h
--- linux-2.6.8-rc2/include/asm-i386/mach-default/irq_vectors_limits.h	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-i386/mach-default/irq_vectors_limits.h	2004-08-03 15:22:08.870045178 -0700
@@ -1,7 +1,7 @@
 #ifndef _ASM_IRQ_VECTORS_LIMITS_H
 #define _ASM_IRQ_VECTORS_LIMITS_H
 
-#ifdef CONFIG_PCI_USE_VECTOR
+#ifdef CONFIG_PCI_MSI
 #define NR_IRQS FIRST_SYSTEM_VECTOR
 #define NR_IRQ_VECTORS NR_IRQS
 #else
diff -urN linux-2.6.8-rc2/include/asm-i386/page.h linux-2.6.8-rc3/include/asm-i386/page.h
--- linux-2.6.8-rc2/include/asm-i386/page.h	2004-08-03 15:21:13.275764552 -0700
+++ linux-2.6.8-rc3/include/asm-i386/page.h	2004-08-03 15:22:08.993050224 -0700
@@ -140,8 +140,10 @@
 
 #define virt_addr_valid(kaddr)	pfn_valid(__pa(kaddr) >> PAGE_SHIFT)
 
-#define VM_DATA_DEFAULT_FLAGS	(VM_READ | VM_WRITE | \
-				 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+#define VM_DATA_DEFAULT_FLAGS \
+	(VM_READ | VM_WRITE | \
+	((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0 ) | \
+		 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
 
 #endif /* __KERNEL__ */
 
diff -urN linux-2.6.8-rc2/include/asm-i386/string.h linux-2.6.8-rc3/include/asm-i386/string.h
--- linux-2.6.8-rc2/include/asm-i386/string.h	2004-08-03 15:21:13.288765085 -0700
+++ linux-2.6.8-rc3/include/asm-i386/string.h	2004-08-03 15:22:09.052052644 -0700
@@ -27,6 +27,7 @@
  */
 #if !defined(IN_STRING_C)
 
+#define __HAVE_ARCH_STRCPY
 static inline char * strcpy(char * dest,const char *src)
 {
 int d0, d1, d2;
@@ -40,6 +41,7 @@
 return dest;
 }
 
+#define __HAVE_ARCH_STRNCPY
 static inline char * strncpy(char * dest,const char *src,size_t count)
 {
 int d0, d1, d2, d3;
@@ -58,6 +60,7 @@
 return dest;
 }
 
+#define __HAVE_ARCH_STRCAT
 static inline char * strcat(char * dest,const char * src)
 {
 int d0, d1, d2, d3;
@@ -74,6 +77,7 @@
 return dest;
 }
 
+#define __HAVE_ARCH_STRNCAT
 static inline char * strncat(char * dest,const char * src,size_t count)
 {
 int d0, d1, d2, d3;
@@ -96,6 +100,7 @@
 return dest;
 }
 
+#define __HAVE_ARCH_STRCMP
 static inline int strcmp(const char * cs,const char * ct)
 {
 int d0, d1;
@@ -116,6 +121,7 @@
 return __res;
 }
 
+#define __HAVE_ARCH_STRNCMP
 static inline int strncmp(const char * cs,const char * ct,size_t count)
 {
 register int __res;
@@ -138,6 +144,7 @@
 return __res;
 }
 
+#define __HAVE_ARCH_STRCHR
 static inline char * strchr(const char * s, int c)
 {
 int d0;
@@ -156,6 +163,7 @@
 return __res;
 }
 
+#define __HAVE_ARCH_STRRCHR
 static inline char * strrchr(const char * s, int c)
 {
 int d0, d1;
diff -urN linux-2.6.8-rc2/include/asm-i386/uaccess.h linux-2.6.8-rc3/include/asm-i386/uaccess.h
--- linux-2.6.8-rc2/include/asm-i386/uaccess.h	2004-06-15 22:18:59.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-i386/uaccess.h	2004-08-03 15:22:09.055052767 -0700
@@ -261,7 +261,7 @@
 #define __put_user_check(x,ptr,size)					\
 ({									\
 	long __pu_err = -EFAULT;					\
-	__typeof__(*(ptr)) *__pu_addr = (ptr);				\
+	__typeof__(*(ptr)) __user *__pu_addr = (ptr);			\
 	might_sleep();						\
 	if (access_ok(VERIFY_WRITE,__pu_addr,size))			\
 		__put_user_size((x),__pu_addr,(size),__pu_err,-EFAULT);	\
diff -urN linux-2.6.8-rc2/include/asm-i386/unistd.h linux-2.6.8-rc3/include/asm-i386/unistd.h
--- linux-2.6.8-rc2/include/asm-i386/unistd.h	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-i386/unistd.h	2004-08-03 15:22:09.056052808 -0700
@@ -425,15 +425,7 @@
  * won't be any messing with the stack from main(), but we define
  * some others too.
  */
-static inline _syscall0(pid_t,setsid)
-static inline _syscall3(int,write,int,fd,const char *,buf,off_t,count)
-static inline _syscall3(int,read,int,fd,char *,buf,off_t,count)
-static inline _syscall3(off_t,lseek,int,fd,off_t,offset,int,count)
-static inline _syscall1(int,dup,int,fd)
 static inline _syscall3(int,execve,const char *,file,char **,argv,char **,envp)
-static inline _syscall3(int,open,const char *,file,int,flag,int,mode)
-static inline _syscall1(int,close,int,fd)
-static inline _syscall3(pid_t,waitpid,pid_t,pid,int *,wait_stat,int,options)
 
 asmlinkage int sys_modify_ldt(int func, void __user *ptr, unsigned long bytecount);
 asmlinkage long sys_mmap2(unsigned long addr, unsigned long len,
diff -urN linux-2.6.8-rc2/include/asm-ia64/elf.h linux-2.6.8-rc3/include/asm-ia64/elf.h
--- linux-2.6.8-rc2/include/asm-ia64/elf.h	2004-06-15 22:19:42.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-ia64/elf.h	2004-08-03 15:22:09.124055598 -0700
@@ -185,9 +185,9 @@
 #define AT_SYSINFO_EHDR	33
 
 #ifdef __KERNEL__
-struct elf64_hdr;
-extern void ia64_set_personality (struct elf64_hdr *elf_ex, int ibcs2_interpreter);
-#define SET_PERSONALITY(ex, ibcs2)	ia64_set_personality(&(ex), ibcs2)
+#define SET_PERSONALITY(ex, ibcs2)	set_personality(PER_LINUX)
+#define elf_read_implies_exec(ex, have_pt_gnu_stack)					\
+	(!(have_pt_gnu_stack) && ((ex).e_flags & EF_IA_64_LINUX_EXECUTABLE_STACK) != 0)
 
 struct task_struct;
 
diff -urN linux-2.6.8-rc2/include/asm-ia64/page.h linux-2.6.8-rc3/include/asm-ia64/page.h
--- linux-2.6.8-rc2/include/asm-ia64/page.h	2004-06-15 22:18:58.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-ia64/page.h	2004-08-03 15:22:09.219059495 -0700
@@ -184,7 +184,7 @@
 
 #define VM_DATA_DEFAULT_FLAGS		(VM_READ | VM_WRITE |					\
 					 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC |		\
-					 (((current->thread.flags & IA64_THREAD_XSTACK) != 0)	\
+					 (((current->personality & READ_IMPLIES_EXEC) != 0)	\
 					  ? VM_EXEC : 0))
 
 #endif /* _ASM_IA64_PAGE_H */
diff -urN linux-2.6.8-rc2/include/asm-ia64/pgtable.h linux-2.6.8-rc3/include/asm-ia64/pgtable.h
--- linux-2.6.8-rc2/include/asm-ia64/pgtable.h	2004-08-03 15:21:13.298765495 -0700
+++ linux-2.6.8-rc3/include/asm-ia64/pgtable.h	2004-08-03 15:22:09.220059536 -0700
@@ -321,6 +321,11 @@
 #define pgd_offset_k(addr) \
 	(init_mm.pgd + (((addr) >> PGDIR_SHIFT) & (PTRS_PER_PGD - 1)))
 
+/* Look up a pgd entry in the gate area.  On IA-64, the gate-area
+   resides in the kernel-mapped segment, hence we use pgd_offset_k()
+   here.  */
+#define pgd_offset_gate(mm, addr)	pgd_offset_k(addr)
+
 /* Find an entry in the second-level page table.. */
 #define pmd_offset(dir,addr) \
 	((pmd_t *) pgd_page(*(dir)) + (((addr) >> PMD_SHIFT) & (PTRS_PER_PMD - 1)))
@@ -552,6 +557,7 @@
 #define __HAVE_ARCH_PTEP_SET_WRPROTECT
 #define __HAVE_ARCH_PTEP_MKDIRTY
 #define __HAVE_ARCH_PTE_SAME
+#define __HAVE_ARCH_PGD_OFFSET_GATE
 #include <asm-generic/pgtable.h>
 
 #endif /* _ASM_IA64_PGTABLE_H */
diff -urN linux-2.6.8-rc2/include/asm-ia64/processor.h linux-2.6.8-rc3/include/asm-ia64/processor.h
--- linux-2.6.8-rc2/include/asm-ia64/processor.h	2004-08-03 15:21:13.299765536 -0700
+++ linux-2.6.8-rc3/include/asm-ia64/processor.h	2004-08-03 15:22:09.221059577 -0700
@@ -2,7 +2,7 @@
 #define _ASM_IA64_PROCESSOR_H
 
 /*
- * Copyright (C) 1998-2003 Hewlett-Packard Co
+ * Copyright (C) 1998-2004 Hewlett-Packard Co
  *	David Mosberger-Tang <davidm@hpl.hp.com>
  *	Stephane Eranian <eranian@hpl.hp.com>
  * Copyright (C) 1999 Asit Mallick <asit.k.mallick@intel.com>
@@ -61,7 +61,6 @@
 							/* bit 5 is currently unused */
 #define IA64_THREAD_FPEMU_NOPRINT (__IA64_UL(1) << 6)	/* don't log any fpswa faults */
 #define IA64_THREAD_FPEMU_SIGFPE  (__IA64_UL(1) << 7)	/* send a SIGFPE for fpswa faults */
-#define IA64_THREAD_XSTACK	(__IA64_UL(1) << 8)	/* stack executable by default? */
 
 #define IA64_THREAD_UAC_SHIFT	3
 #define IA64_THREAD_UAC_MASK	(IA64_THREAD_UAC_NOPRINT | IA64_THREAD_UAC_SIGBUS)
diff -urN linux-2.6.8-rc2/include/asm-ia64/sn/sn2/io.h linux-2.6.8-rc3/include/asm-ia64/sn/sn2/io.h
--- linux-2.6.8-rc2/include/asm-ia64/sn/sn2/io.h	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-ia64/sn/sn2/io.h	2004-08-03 15:22:09.240060357 -0700
@@ -8,10 +8,11 @@
 
 #ifndef _ASM_SN_SN2_IO_H
 #define _ASM_SN_SN2_IO_H
+#include <linux/compiler.h>
+#include <asm/intrinsics.h>
 
-extern void * sn_io_addr(unsigned long port); /* Forward definition */
+extern void * sn_io_addr(unsigned long port) __attribute_const__; /* Forward definition */
 extern void sn_mmiob(void); /* Forward definition */
-#include <asm/intrinsics.h>
 
 #define __sn_mf_a()   ia64_mfa()
 
diff -urN linux-2.6.8-rc2/include/asm-ia64/sn/sn_sal.h linux-2.6.8-rc3/include/asm-ia64/sn/sn_sal.h
--- linux-2.6.8-rc2/include/asm-ia64/sn/sn_sal.h	2004-08-03 15:21:13.303765701 -0700
+++ linux-2.6.8-rc3/include/asm-ia64/sn/sn_sal.h	2004-08-03 15:22:09.271061628 -0700
@@ -141,8 +141,8 @@
  * Specify the minimum PROM revsion required for this kernel.
  * Note that they're stored in hex format...
  */
-#define SN_SAL_MIN_MAJOR	0x1  /* SN2 kernels need at least PROM 1.0 */
-#define SN_SAL_MIN_MINOR	0x0
+#define SN_SAL_MIN_MAJOR	0x3  /* SN2 kernels need at least PROM 3.40 */
+#define SN_SAL_MIN_MINOR	0x40
 
 u64 ia64_sn_probe_io_slot(long paddr, long size, void *data_ptr);
 
diff -urN linux-2.6.8-rc2/include/asm-m68k/bitops.h linux-2.6.8-rc3/include/asm-m68k/bitops.h
--- linux-2.6.8-rc2/include/asm-m68k/bitops.h	2004-08-03 15:21:13.307765865 -0700
+++ linux-2.6.8-rc3/include/asm-m68k/bitops.h	2004-08-03 15:22:09.300062818 -0700
@@ -52,14 +52,14 @@
 
 #define __set_bit(nr,vaddr) set_bit(nr,vaddr)
 
-static inline void __constant_set_bit(int nr, unsigned long *vaddr)
+static inline void __constant_set_bit(int nr, volatile unsigned long *vaddr)
 {
 	char *p = (char *)vaddr + (nr ^ 31) / 8;
 	__asm__ __volatile__ ("bset %1,%0"
 			: "+m" (*p) : "di" (nr & 7));
 }
 
-static inline void __generic_set_bit(int nr, unsigned long *vaddr)
+static inline void __generic_set_bit(int nr, volatile unsigned long *vaddr)
 {
 	__asm__ __volatile__ ("bfset %1{%0:#1}"
 			: : "d" (nr^31), "o" (*vaddr) : "memory");
@@ -106,14 +106,14 @@
    __generic_clear_bit(nr, vaddr))
 #define __clear_bit(nr,vaddr) clear_bit(nr,vaddr)
 
-static inline void __constant_clear_bit(int nr, unsigned long *vaddr)
+static inline void __constant_clear_bit(int nr, volatile unsigned long *vaddr)
 {
 	char *p = (char *)vaddr + (nr ^ 31) / 8;
 	__asm__ __volatile__ ("bclr %1,%0"
 			: "+m" (*p) : "di" (nr & 7));
 }
 
-static inline void __generic_clear_bit(int nr, unsigned long *vaddr)
+static inline void __generic_clear_bit(int nr, volatile unsigned long *vaddr)
 {
 	__asm__ __volatile__ ("bfclr %1{%0:#1}"
 			: : "d" (nr^31), "o" (*vaddr) : "memory");
diff -urN linux-2.6.8-rc2/include/asm-m68k/hardirq.h linux-2.6.8-rc3/include/asm-m68k/hardirq.h
--- linux-2.6.8-rc2/include/asm-m68k/hardirq.h	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-m68k/hardirq.h	2004-08-03 15:22:09.305063023 -0700
@@ -1,6 +1,7 @@
 #ifndef __M68K_HARDIRQ_H
 #define __M68K_HARDIRQ_H
 
+#include <linux/config.h>
 #include <linux/threads.h>
 #include <linux/cache.h>
 
diff -urN linux-2.6.8-rc2/include/asm-m68k/math-emu.h linux-2.6.8-rc3/include/asm-m68k/math-emu.h
--- linux-2.6.8-rc2/include/asm-m68k/math-emu.h	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-m68k/math-emu.h	2004-08-03 15:22:09.309063187 -0700
@@ -102,7 +102,7 @@
 	struct fp_ext temp[2];
 };
 
-#if FPU_EMU_DEBUG
+#ifdef FPU_EMU_DEBUG
 extern unsigned int fp_debugprint;
 
 #define dprint(bit, fmt, args...) ({			\
diff -urN linux-2.6.8-rc2/include/asm-m68k/motorola_pgalloc.h linux-2.6.8-rc3/include/asm-m68k/motorola_pgalloc.h
--- linux-2.6.8-rc2/include/asm-m68k/motorola_pgalloc.h	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-m68k/motorola_pgalloc.h	2004-08-03 15:22:09.309063187 -0700
@@ -2,6 +2,7 @@
 #define _MOTOROLA_PGALLOC_H
 
 #include <asm/tlb.h>
+#include <asm/tlbflush.h>
 
 extern pmd_t *get_pointer_table(void);
 extern int free_pointer_table(pmd_t *);
diff -urN linux-2.6.8-rc2/include/asm-m68k/semaphore.h linux-2.6.8-rc3/include/asm-m68k/semaphore.h
--- linux-2.6.8-rc2/include/asm-m68k/semaphore.h	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-m68k/semaphore.h	2004-08-03 15:22:09.311063269 -0700
@@ -27,12 +27,12 @@
 	atomic_t count;
 	atomic_t waking;
 	wait_queue_head_t wait;
-#if WAITQUEUE_DEBUG
+#ifdef WAITQUEUE_DEBUG
 	long __magic;
 #endif
 };
 
-#if WAITQUEUE_DEBUG
+#ifdef WAITQUEUE_DEBUG
 # define __SEM_DEBUG_INIT(name) \
 		, (long)&(name).__magic
 #else
@@ -86,7 +86,7 @@
 {
 	register struct semaphore *sem1 __asm__ ("%a1") = sem;
 
-#if WAITQUEUE_DEBUG
+#ifdef WAITQUEUE_DEBUG
 	CHECK_MAGIC(sem->__magic);
 #endif
 	might_sleep();
@@ -109,7 +109,7 @@
 	register struct semaphore *sem1 __asm__ ("%a1") = sem;
 	register int result __asm__ ("%d0");
 
-#if WAITQUEUE_DEBUG
+#ifdef WAITQUEUE_DEBUG
 	CHECK_MAGIC(sem->__magic);
 #endif
 	might_sleep();
@@ -134,7 +134,7 @@
 	register struct semaphore *sem1 __asm__ ("%a1") = sem;
 	register int result __asm__ ("%d0");
 
-#if WAITQUEUE_DEBUG
+#ifdef WAITQUEUE_DEBUG
 	CHECK_MAGIC(sem->__magic);
 #endif
 
@@ -164,7 +164,7 @@
 {
 	register struct semaphore *sem1 __asm__ ("%a1") = sem;
 
-#if WAITQUEUE_DEBUG
+#ifdef WAITQUEUE_DEBUG
 	CHECK_MAGIC(sem->__magic);
 #endif
 
diff -urN linux-2.6.8-rc2/include/asm-m68k/sun3_pgalloc.h linux-2.6.8-rc3/include/asm-m68k/sun3_pgalloc.h
--- linux-2.6.8-rc2/include/asm-m68k/sun3_pgalloc.h	2004-06-15 22:19:17.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-m68k/sun3_pgalloc.h	2004-08-03 15:22:09.321063680 -0700
@@ -31,10 +31,7 @@
         __free_page(page);
 }
 
-static inline void __pte_free_tlb(struct mmu_gather *tlb, struct page *page)
-{
-	tlb_remove_page(tlb, page);
-}
+#define __pte_free_tlb(tlb,pte) tlb_remove_page((tlb),(pte))
 
 static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
 					  unsigned long address)
diff -urN linux-2.6.8-rc2/include/asm-ppc/checksum.h linux-2.6.8-rc3/include/asm-ppc/checksum.h
--- linux-2.6.8-rc2/include/asm-ppc/checksum.h	2004-06-15 22:19:03.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-ppc/checksum.h	2004-08-03 15:22:09.549073033 -0700
@@ -33,11 +33,11 @@
 					      int *src_err, int *dst_err);
 
 #define csum_partial_copy_from_user(src, dst, len, sum, errp)	\
-	csum_partial_copy_generic((src), (dst), (len), (sum), (errp), 0)
+	csum_partial_copy_generic((src), (dst), (len), (sum), (errp), NULL)
 
 /* FIXME: this needs to be written to really do no check -- Cort */
 #define csum_partial_copy_nocheck(src, dst, len, sum)	\
-	csum_partial_copy_generic((src), (dst), (len), (sum), 0, 0)
+	csum_partial_copy_generic((src), (dst), (len), (sum), NULL, NULL)
 
 /*
  * turns a 32-bit partial checksum (e.g. from csum_partial) into a
diff -urN linux-2.6.8-rc2/include/asm-ppc/commproc.h linux-2.6.8-rc3/include/asm-ppc/commproc.h
--- linux-2.6.8-rc2/include/asm-ppc/commproc.h	2004-08-03 15:21:13.430770911 -0700
+++ linux-2.6.8-rc3/include/asm-ppc/commproc.h	2004-08-03 15:22:09.550073074 -0700
@@ -62,18 +62,23 @@
 #define CPM_DATAONLY_SIZE	((uint)0x0700)
 #define CPM_DP_NOSPACE		((uint)0x7fffffff)
 
+static inline long IS_DPERR(const uint offset)
+{
+	return (uint)offset > (uint)-1000L;
+}
+
 /* Export the base address of the communication processor registers
  * and dual port ram.
  */
 extern	cpm8xx_t	*cpmp;		/* Pointer to comm processor */
-extern void *m8xx_cpm_dpalloc(int size);
-extern int m8xx_cpm_dpfree(void *addr);
-extern void *m8xx_cpm_dpalloc_fixed(void *addr, int size);
-extern void m8xx_cpm_dpdump(void);
-extern int m8xx_cpm_dpram_offset(void *addr);
-extern void *m8xx_cpm_dpram_addr(int offset);
+extern uint cpm_dpalloc(uint size, uint align);
+extern int cpm_dpfree(uint offset);
+extern uint cpm_dpalloc_fixed(uint offset, uint size, uint align);
+extern void cpm_dpdump(void);
+extern void *cpm_dpram_addr(uint offset);
+extern void cpm_setbrg(uint brg, uint rate);
+
 uint		m8xx_cpm_hostalloc(uint size);
-void		m8xx_cpm_setbrg(uint brg, uint rate);
 
 /* Buffer descriptors used by many of the CPM protocols.
 */
diff -urN linux-2.6.8-rc2/include/asm-ppc/cpm2.h linux-2.6.8-rc3/include/asm-ppc/cpm2.h
--- linux-2.6.8-rc2/include/asm-ppc/cpm2.h	2004-08-03 15:21:13.433771034 -0700
+++ linux-2.6.8-rc3/include/asm-ppc/cpm2.h	2004-08-03 15:22:09.553073197 -0700
@@ -99,18 +99,21 @@
  */
 #define NUM_CPM_HOST_PAGES	2
 
+static inline long IS_DPERR(const uint offset)
+{
+	return (uint)offset > (uint)-1000L;
+}
 
 /* Export the base address of the communication processor registers
  * and dual port ram.
  */
 extern		cpm_cpm2_t	*cpmp;	 /* Pointer to comm processor */
-extern void *cpm2_dpalloc(uint size, uint align);
-extern int cpm2_dpfree(void *addr);
-extern void *cpm2_dpalloc_fixed(void *addr, uint size, uint allign);
-extern void cpm2_dpdump(void);
-extern unsigned int cpm2_dpram_offset(void *addr);
-extern void *cpm2_dpram_addr(int offset);
-extern void cpm2_setbrg(uint brg, uint rate);
+extern uint cpm_dpalloc(uint size, uint align);
+extern int cpm_dpfree(uint offset);
+extern uint cpm_dpalloc_fixed(uint offset, uint size, uint align);
+extern void cpm_dpdump(void);
+extern void *cpm_dpram_addr(uint offset);
+extern void cpm_setbrg(uint brg, uint rate);
 extern void cpm2_fastbrg(uint brg, uint rate, int div16);
 
 /* Buffer descriptors used by many of the CPM protocols.
diff -urN linux-2.6.8-rc2/include/asm-ppc/cputable.h linux-2.6.8-rc3/include/asm-ppc/cputable.h
--- linux-2.6.8-rc2/include/asm-ppc/cputable.h	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-ppc/cputable.h	2004-08-03 15:22:09.579074264 -0700
@@ -76,6 +76,7 @@
 #define CPU_FTR_NO_DPM			0x00008000
 #define CPU_FTR_HAS_HIGH_BATS		0x00010000
 #define CPU_FTR_NEED_COHERENT           0x00020000
+#define CPU_FTR_NO_BTIC			0x00040000
 
 #ifdef __ASSEMBLY__
 
diff -urN linux-2.6.8-rc2/include/asm-ppc/highmem.h linux-2.6.8-rc3/include/asm-ppc/highmem.h
--- linux-2.6.8-rc2/include/asm-ppc/highmem.h	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-ppc/highmem.h	2004-08-03 15:22:09.591074756 -0700
@@ -91,7 +91,7 @@
 	BUG_ON(!pte_none(*(kmap_pte+idx)));
 #endif
 	set_pte(kmap_pte+idx, mk_pte(page, kmap_prot));
-	flush_tlb_page(0, vaddr);
+	flush_tlb_page(NULL, vaddr);
 
 	return (void*) vaddr;
 }
@@ -115,7 +115,7 @@
 	 * this pte without first remap it
 	 */
 	pte_clear(kmap_pte+idx);
-	flush_tlb_page(0, vaddr);
+	flush_tlb_page(NULL, vaddr);
 #endif
 	dec_preempt_count();
 	preempt_check_resched();
diff -urN linux-2.6.8-rc2/include/asm-ppc/io.h linux-2.6.8-rc3/include/asm-ppc/io.h
--- linux-2.6.8-rc2/include/asm-ppc/io.h	2004-08-03 15:21:13.496773618 -0700
+++ linux-2.6.8-rc3/include/asm-ppc/io.h	2004-08-03 15:22:09.612075617 -0700
@@ -237,7 +237,7 @@
 {
 #ifndef CONFIG_APUS
         if (address == 0)
-		return 0;
+		return NULL;
         return (void *)(address - PCI_DRAM_OFFSET + KERNELBASE);
 #else
 	return (void*) mm_ptov (address);
diff -urN linux-2.6.8-rc2/include/asm-ppc/irq.h linux-2.6.8-rc3/include/asm-ppc/irq.h
--- linux-2.6.8-rc2/include/asm-ppc/irq.h	2004-08-03 15:21:13.497773659 -0700
+++ linux-2.6.8-rc3/include/asm-ppc/irq.h	2004-08-03 15:22:09.613075658 -0700
@@ -153,6 +153,79 @@
 	return irq;
 }
 
+#elif defined(CONFIG_CPM2) && defined(CONFIG_85xx)
+/* Now include the board configuration specific associations.
+*/
+#include <asm/mpc85xx.h>
+
+/* The MPC8560 openpic has  32 internal interrupts and 12 external
+ * interrupts.
+ *
+ * We are "flattening" the interrupt vectors of the cascaded CPM
+ * so that we can uniquely identify any interrupt source with a
+ * single integer.
+ */
+#define NR_CPM_INTS	64
+#define NR_EPIC_INTS	44
+#ifndef NR_8259_INTS
+#define NR_8259_INTS 0
+#endif
+#define NUM_8259_INTERRUPTS NR_8259_INTS
+
+#ifndef CPM_IRQ_OFFSET
+#define CPM_IRQ_OFFSET	0
+#endif
+
+#define NR_IRQS	(NR_EPIC_INTS + NR_CPM_INTS + NR_8259_INTS)
+
+/* These values must be zero-based and map 1:1 with the EPIC configuration.
+ * They are used throughout the 8560 I/O subsystem to generate
+ * interrupt masks, flags, and other control patterns.  This is why the
+ * current kernel assumption of the 8259 as the base controller is such
+ * a pain in the butt.
+ */
+
+#define	SIU_INT_ERROR		((uint)0x00+CPM_IRQ_OFFSET)
+#define	SIU_INT_I2C		((uint)0x01+CPM_IRQ_OFFSET)
+#define	SIU_INT_SPI		((uint)0x02+CPM_IRQ_OFFSET)
+#define	SIU_INT_RISC		((uint)0x03+CPM_IRQ_OFFSET)
+#define	SIU_INT_SMC1		((uint)0x04+CPM_IRQ_OFFSET)
+#define	SIU_INT_SMC2		((uint)0x05+CPM_IRQ_OFFSET)
+#define	SIU_INT_TIMER1		((uint)0x0c+CPM_IRQ_OFFSET)
+#define	SIU_INT_TIMER2		((uint)0x0d+CPM_IRQ_OFFSET)
+#define	SIU_INT_TIMER3		((uint)0x0e+CPM_IRQ_OFFSET)
+#define	SIU_INT_TIMER4		((uint)0x0f+CPM_IRQ_OFFSET)
+#define	SIU_INT_FCC1		((uint)0x20+CPM_IRQ_OFFSET)
+#define	SIU_INT_FCC2		((uint)0x21+CPM_IRQ_OFFSET)
+#define	SIU_INT_FCC3		((uint)0x22+CPM_IRQ_OFFSET)
+#define	SIU_INT_MCC1		((uint)0x24+CPM_IRQ_OFFSET)
+#define	SIU_INT_MCC2		((uint)0x25+CPM_IRQ_OFFSET)
+#define	SIU_INT_SCC1		((uint)0x28+CPM_IRQ_OFFSET)
+#define	SIU_INT_SCC2		((uint)0x29+CPM_IRQ_OFFSET)
+#define	SIU_INT_SCC3		((uint)0x2a+CPM_IRQ_OFFSET)
+#define	SIU_INT_SCC4		((uint)0x2b+CPM_IRQ_OFFSET)
+#define	SIU_INT_PC15		((uint)0x30+CPM_IRQ_OFFSET)
+#define	SIU_INT_PC14		((uint)0x31+CPM_IRQ_OFFSET)
+#define	SIU_INT_PC13		((uint)0x32+CPM_IRQ_OFFSET)
+#define	SIU_INT_PC12		((uint)0x33+CPM_IRQ_OFFSET)
+#define	SIU_INT_PC11		((uint)0x34+CPM_IRQ_OFFSET)
+#define	SIU_INT_PC10		((uint)0x35+CPM_IRQ_OFFSET)
+#define	SIU_INT_PC9		((uint)0x36+CPM_IRQ_OFFSET)
+#define	SIU_INT_PC8		((uint)0x37+CPM_IRQ_OFFSET)
+#define	SIU_INT_PC7		((uint)0x38+CPM_IRQ_OFFSET)
+#define	SIU_INT_PC6		((uint)0x39+CPM_IRQ_OFFSET)
+#define	SIU_INT_PC5		((uint)0x3a+CPM_IRQ_OFFSET)
+#define	SIU_INT_PC4		((uint)0x3b+CPM_IRQ_OFFSET)
+#define	SIU_INT_PC3		((uint)0x3c+CPM_IRQ_OFFSET)
+#define	SIU_INT_PC2		((uint)0x3d+CPM_IRQ_OFFSET)
+#define	SIU_INT_PC1		((uint)0x3e+CPM_IRQ_OFFSET)
+#define	SIU_INT_PC0		((uint)0x3f+CPM_IRQ_OFFSET)
+
+static __inline__ int irq_canonicalize(int irq)
+{
+	return irq;
+}
+
 #else /* CONFIG_40x + CONFIG_8xx */
 /*
  * this is the # irq's for all ppc arch's (pmac/chrp/prep)
diff -urN linux-2.6.8-rc2/include/asm-ppc/mmu_context.h linux-2.6.8-rc3/include/asm-ppc/mmu_context.h
--- linux-2.6.8-rc2/include/asm-ppc/mmu_context.h	2004-08-03 15:21:13.501773824 -0700
+++ linux-2.6.8-rc3/include/asm-ppc/mmu_context.h	2004-08-03 15:22:09.643076889 -0700
@@ -63,7 +63,7 @@
 #define LAST_CONTEXT    	255
 #define FIRST_CONTEXT    	1
 
-#elif CONFIG_E500
+#elif defined(CONFIG_E500)
 #define NO_CONTEXT      	256
 #define LAST_CONTEXT    	255
 #define FIRST_CONTEXT    	1
diff -urN linux-2.6.8-rc2/include/asm-ppc/mpc52xx.h linux-2.6.8-rc3/include/asm-ppc/mpc52xx.h
--- linux-2.6.8-rc2/include/asm-ppc/mpc52xx.h	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/include/asm-ppc/mpc52xx.h	2004-08-03 15:22:09.644076930 -0700
@@ -0,0 +1,380 @@
+/*
+ * include/asm-ppc/mpc52xx.h
+ * 
+ * Prototypes, etc. for the Freescale MPC52xx embedded cpu chips
+ * May need to be cleaned as the port goes on ...
+ *
+ *
+ * Maintainer : Sylvain Munaut <tnt@246tNt.com>
+ *
+ * Originally written by Dale Farnsworth <dfarnsworth@mvista.com> 
+ * for the 2.4 kernel.
+ *
+ * Copyright (C) 2004 Sylvain Munaut <tnt@246tNt.com>
+ * Copyright (C) 2003 MontaVista, Software, Inc.
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2. This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+
+#ifndef __ASM_MPC52xx_H__
+#define __ASM_MPC52xx_H__
+
+#ifndef __ASSEMBLY__
+#include <asm/ppcboot.h>
+#include <asm/types.h>
+
+struct pt_regs;
+struct ocp_def;
+#endif /* __ASSEMBLY__ */
+
+
+/* ======================================================================== */
+/* Main registers/struct addresses                                          */
+/* ======================================================================== */
+/* Theses are PHYSICAL addresses !                                          */
+/* TODO : There should be no static mapping, but it's not yet the case, so  */
+/*        we require a 1:1 mapping                                          */
+
+#define MPC52xx_MBAR		0xf0000000	/* Phys address */
+#define MPC52xx_MBAR_SIZE	0x00010000
+#define MPC52xx_MBAR_VIRT	0xf0000000	/* Virt address */
+
+#define MPC52xx_MMAP_CTL	(MPC52xx_MBAR + 0x0000)
+#define MPC52xx_CDM		(MPC52xx_MBAR + 0x0200)
+#define MPC52xx_SFTRST		(MPC52xx_MBAR + 0x0220)
+#define MPC52xx_SFTRST_BIT	0x01000000
+#define MPC52xx_INTR		(MPC52xx_MBAR + 0x0500)
+#define MPC52xx_GPTx(x)		(MPC52xx_MBAR + 0x0600 + ((x)<<4))
+#define MPC52xx_RTC		(MPC52xx_MBAR + 0x0800)
+#define MPC52xx_MSCAN1		(MPC52xx_MBAR + 0x0900)
+#define MPC52xx_MSCAN2		(MPC52xx_MBAR + 0x0980)
+#define MPC52xx_GPIO		(MPC52xx_MBAR + 0x0b00)
+#define MPC52xx_PCI		(MPC52xx_MBAR + 0x0d00)
+#define MPC52xx_USB_OHCI	(MPC52xx_MBAR + 0x1000)
+#define MPC52xx_SDMA		(MPC52xx_MBAR + 0x1200)
+#define MPC52xx_XLB		(MPC52xx_MBAR + 0x1f00)
+#define MPC52xx_PSCx(x)		(MPC52xx_MBAR + 0x2000 + ((x)<<9))
+#define MPC52xx_PSC1		(MPC52xx_MBAR + 0x2000)
+#define MPC52xx_PSC2		(MPC52xx_MBAR + 0x2200)
+#define MPC52xx_PSC3		(MPC52xx_MBAR + 0x2400)
+#define MPC52xx_PSC4		(MPC52xx_MBAR + 0x2600)
+#define MPC52xx_PSC5		(MPC52xx_MBAR + 0x2800)
+#define MPC52xx_PSC6		(MPC52xx_MBAR + 0x2C00)
+#define MPC52xx_FEC		(MPC52xx_MBAR + 0x3000)
+#define MPC52xx_ATA		(MPC52xx_MBAR + 0x3a00)
+#define MPC52xx_I2C1		(MPC52xx_MBAR + 0x3d00)
+#define MPC52xx_I2C_MICR	(MPC52xx_MBAR + 0x3d20)
+#define MPC52xx_I2C2		(MPC52xx_MBAR + 0x3d40)
+
+/* SRAM used for SDMA */
+#define MPC52xx_SRAM		(MPC52xx_MBAR + 0x8000)
+#define MPC52xx_SRAM_SIZE	(16*1024)
+#define MPC52xx_SDMA_MAX_TASKS	16
+
+	/* Memory allocation block size */
+#define MPC52xx_SDRAM_UNIT	0x8000		/* 32K byte */
+
+
+/* ======================================================================== */
+/* IRQ mapping                                                              */
+/* ======================================================================== */
+/* Be sure to look at mpc52xx_pic.h if you wish for whatever reason to change
+ * this
+ */
+
+#define MPC52xx_CRIT_IRQ_NUM	4
+#define MPC52xx_MAIN_IRQ_NUM	17
+#define MPC52xx_SDMA_IRQ_NUM	17
+#define MPC52xx_PERP_IRQ_NUM	23
+
+#define MPC52xx_CRIT_IRQ_BASE	0
+#define MPC52xx_MAIN_IRQ_BASE	(MPC52xx_CRIT_IRQ_BASE + MPC52xx_CRIT_IRQ_NUM)
+#define MPC52xx_SDMA_IRQ_BASE	(MPC52xx_MAIN_IRQ_BASE + MPC52xx_MAIN_IRQ_NUM)
+#define MPC52xx_PERP_IRQ_BASE	(MPC52xx_SDMA_IRQ_BASE + MPC52xx_SDMA_IRQ_NUM)
+
+#define MPC52xx_IRQ0			(MPC52xx_CRIT_IRQ_BASE + 0)
+#define MPC52xx_SLICE_TIMER_0_IRQ	(MPC52xx_CRIT_IRQ_BASE + 1)
+#define MPC52xx_HI_INT_IRQ		(MPC52xx_CRIT_IRQ_BASE + 2)
+#define MPC52xx_CCS_IRQ			(MPC52xx_CRIT_IRQ_BASE + 3)
+
+#define MPC52xx_IRQ1			(MPC52xx_MAIN_IRQ_BASE + 1)
+#define MPC52xx_IRQ2			(MPC52xx_MAIN_IRQ_BASE + 2)
+#define MPC52xx_IRQ3			(MPC52xx_MAIN_IRQ_BASE + 3)
+
+#define MPC52xx_SDMA_IRQ		(MPC52xx_PERP_IRQ_BASE + 0)
+#define MPC52xx_PSC1_IRQ		(MPC52xx_PERP_IRQ_BASE + 1)
+#define MPC52xx_PSC2_IRQ		(MPC52xx_PERP_IRQ_BASE + 2)
+#define MPC52xx_PSC3_IRQ		(MPC52xx_PERP_IRQ_BASE + 3)
+#define MPC52xx_PSC6_IRQ		(MPC52xx_PERP_IRQ_BASE + 4)
+#define MPC52xx_IRDA_IRQ		(MPC52xx_PERP_IRQ_BASE + 4)
+#define MPC52xx_FEC_IRQ			(MPC52xx_PERP_IRQ_BASE + 5)
+#define MPC52xx_USB_IRQ			(MPC52xx_PERP_IRQ_BASE + 6)
+#define MPC52xx_ATA_IRQ			(MPC52xx_PERP_IRQ_BASE + 7)
+#define MPC52xx_PCI_CNTRL_IRQ		(MPC52xx_PERP_IRQ_BASE + 8)
+#define MPC52xx_PCI_SCIRX_IRQ		(MPC52xx_PERP_IRQ_BASE + 9)
+#define MPC52xx_PCI_SCITX_IRQ		(MPC52xx_PERP_IRQ_BASE + 10)
+#define MPC52xx_PSC4_IRQ		(MPC52xx_PERP_IRQ_BASE + 11)
+#define MPC52xx_PSC5_IRQ		(MPC52xx_PERP_IRQ_BASE + 12)
+#define MPC52xx_SPI_MODF_IRQ		(MPC52xx_PERP_IRQ_BASE + 13)
+#define MPC52xx_SPI_SPIF_IRQ		(MPC52xx_PERP_IRQ_BASE + 14)
+#define MPC52xx_I2C1_IRQ		(MPC52xx_PERP_IRQ_BASE + 15)
+#define MPC52xx_I2C2_IRQ		(MPC52xx_PERP_IRQ_BASE + 16)
+#define MPC52xx_CAN1_IRQ		(MPC52xx_PERP_IRQ_BASE + 17)
+#define MPC52xx_CAN2_IRQ		(MPC52xx_PERP_IRQ_BASE + 18)
+#define MPC52xx_IR_RX_IRQ		(MPC52xx_PERP_IRQ_BASE + 19)
+#define MPC52xx_IR_TX_IRQ		(MPC52xx_PERP_IRQ_BASE + 20)
+#define MPC52xx_XLB_ARB_IRQ		(MPC52xx_PERP_IRQ_BASE + 21)
+
+
+
+/* ======================================================================== */
+/* Structures mapping of some unit register set                             */
+/* ======================================================================== */
+
+#ifndef __ASSEMBLY__
+
+/* Memory Mapping Control */
+struct mpc52xx_mmap_ctl {
+	volatile u32	mbar;		/* MMAP_CTRL + 0x00 */
+
+	volatile u32	cs0_start;	/* MMAP_CTRL + 0x04 */
+	volatile u32	cs0_stop;	/* MMAP_CTRL + 0x08 */
+	volatile u32	cs1_start;	/* MMAP_CTRL + 0x0c */
+	volatile u32	cs1_stop;	/* MMAP_CTRL + 0x10 */
+	volatile u32	cs2_start;	/* MMAP_CTRL + 0x14 */
+	volatile u32	cs2_stop;	/* MMAP_CTRL + 0x18 */
+	volatile u32	cs3_start;	/* MMAP_CTRL + 0x1c */
+	volatile u32	cs3_stop;	/* MMAP_CTRL + 0x20 */
+	volatile u32	cs4_start;	/* MMAP_CTRL + 0x24 */
+	volatile u32	cs4_stop;	/* MMAP_CTRL + 0x28 */
+	volatile u32	cs5_start;	/* MMAP_CTRL + 0x2c */
+	volatile u32	cs5_stop;	/* MMAP_CTRL + 0x30 */
+
+	volatile u32	sdram0;		/* MMAP_CTRL + 0x34 */
+	volatile u32	sdram1;		/* MMAP_CTRL + 0X38 */
+
+	volatile u32	reserved[4];	/* MMAP_CTRL + 0x3c .. 0x48 */
+
+	volatile u32	boot_start;	/* MMAP_CTRL + 0x4c */
+	volatile u32	boot_stop;	/* MMAP_CTRL + 0x50 */
+	
+	volatile u32	ipbi_ws_ctrl;	/* MMAP_CTRL + 0x54 */
+	
+	volatile u32	cs6_start;	/* MMAP_CTRL + 0x58 */
+	volatile u32	cs6_stop;	/* MMAP_CTRL + 0x5c */
+	volatile u32	cs7_start;	/* MMAP_CTRL + 0x60 */
+	volatile u32	cs7_stop;	/* MMAP_CTRL + 0x60 */
+};
+
+/* Interrupt controller */
+struct mpc52xx_intr {
+	volatile u32	per_mask;	/* INTR + 0x00 */
+	volatile u32	per_pri1;	/* INTR + 0x04 */
+	volatile u32	per_pri2;	/* INTR + 0x08 */
+	volatile u32	per_pri3;	/* INTR + 0x0c */
+	volatile u32	ctrl;		/* INTR + 0x10 */
+	volatile u32	main_mask;	/* INTR + 0x14 */
+	volatile u32	main_pri1;	/* INTR + 0x18 */
+	volatile u32	main_pri2;	/* INTR + 0x1c */
+	volatile u32	reserved1;	/* INTR + 0x20 */
+	volatile u32	enc_status;	/* INTR + 0x24 */
+	volatile u32	crit_status;	/* INTR + 0x28 */
+	volatile u32	main_status;	/* INTR + 0x2c */
+	volatile u32	per_status;	/* INTR + 0x30 */
+	volatile u32	reserved2;	/* INTR + 0x34 */
+	volatile u32	per_error;	/* INTR + 0x38 */
+};
+
+/* SDMA */
+struct mpc52xx_sdma {
+	volatile u32	taskBar;	/* SDMA + 0x00 */
+	volatile u32	currentPointer;	/* SDMA + 0x04 */
+	volatile u32	endPointer;	/* SDMA + 0x08 */
+	volatile u32	variablePointer;/* SDMA + 0x0c */
+
+	volatile u8	IntVect1;	/* SDMA + 0x10 */
+	volatile u8	IntVect2;	/* SDMA + 0x11 */
+	volatile u16	PtdCntrl;	/* SDMA + 0x12 */
+
+	volatile u32	IntPend;	/* SDMA + 0x14 */
+	volatile u32	IntMask;	/* SDMA + 0x18 */
+	
+	volatile u16	tcr[16];	/* SDMA + 0x1c .. 0x3a */
+
+	volatile u8	ipr[31];	/* SDMA + 0x3c .. 5b */
+
+	volatile u32	res1;		/* SDMA + 0x5c */
+	volatile u32	task_size0;	/* SDMA + 0x60 */
+	volatile u32	task_size1;	/* SDMA + 0x64 */
+	volatile u32	MDEDebug;	/* SDMA + 0x68 */
+	volatile u32	ADSDebug;	/* SDMA + 0x6c */
+	volatile u32	Value1;		/* SDMA + 0x70 */
+	volatile u32	Value2;		/* SDMA + 0x74 */
+	volatile u32	Control;	/* SDMA + 0x78 */
+	volatile u32	Status;		/* SDMA + 0x7c */
+};
+
+/* GPT */
+struct mpc52xx_gpt {
+	volatile u32	mode;		/* GPTx + 0x00 */
+	volatile u32	count;		/* GPTx + 0x04 */
+	volatile u32	pwm;		/* GPTx + 0x08 */
+	volatile u32	status;		/* GPTx + 0X0c */
+};
+
+/* RTC */
+struct mpc52xx_rtc {
+	volatile u32	time_set;	/* RTC + 0x00 */
+	volatile u32	date_set;	/* RTC + 0x04 */
+	volatile u32	stopwatch;	/* RTC + 0x08 */
+	volatile u32	int_enable;	/* RTC + 0x0c */
+	volatile u32	time;		/* RTC + 0x10 */
+	volatile u32	date;		/* RTC + 0x14 */
+	volatile u32	stopwatch_intr;	/* RTC + 0x18 */
+	volatile u32	bus_error;	/* RTC + 0x1c */
+	volatile u32	dividers;	/* RTC + 0x20 */
+};
+
+/* GPIO */
+struct mpc52xx_gpio {
+	volatile u32	port_config;	/* GPIO + 0x00 */
+	volatile u32	simple_gpioe;	/* GPIO + 0x04 */
+	volatile u32	simple_ode;	/* GPIO + 0x08 */
+	volatile u32	simple_ddr;	/* GPIO + 0x0c */
+	volatile u32	simple_dvo;	/* GPIO + 0x10 */
+	volatile u32	simple_ival;	/* GPIO + 0x14 */
+	volatile u8	outo_gpioe;	/* GPIO + 0x18 */
+	volatile u8	reserved1[3];	/* GPIO + 0x19 */
+	volatile u8	outo_dvo;	/* GPIO + 0x1c */
+	volatile u8	reserved2[3];	/* GPIO + 0x1d */
+	volatile u8	sint_gpioe;	/* GPIO + 0x20 */
+	volatile u8	reserved3[3];	/* GPIO + 0x21 */
+	volatile u8	sint_ode;	/* GPIO + 0x24 */
+	volatile u8	reserved4[3];	/* GPIO + 0x25 */
+	volatile u8	sint_ddr;	/* GPIO + 0x28 */
+	volatile u8	reserved5[3];	/* GPIO + 0x29 */
+	volatile u8	sint_dvo;	/* GPIO + 0x2c */
+	volatile u8	reserved6[3];	/* GPIO + 0x2d */
+	volatile u8	sint_inten;	/* GPIO + 0x30 */
+	volatile u8	reserved7[3];	/* GPIO + 0x31 */
+	volatile u16	sint_itype;	/* GPIO + 0x34 */
+	volatile u16	reserved8;	/* GPIO + 0x36 */
+	volatile u8	gpio_control;	/* GPIO + 0x38 */
+	volatile u8	reserved9[3];	/* GPIO + 0x39 */
+	volatile u8	sint_istat;	/* GPIO + 0x3c */
+	volatile u8	sint_ival;	/* GPIO + 0x3d */
+	volatile u8	bus_errs;	/* GPIO + 0x3e */
+	volatile u8	reserved10;	/* GPIO + 0x3f */
+};
+
+#define MPC52xx_GPIO_PSC_CONFIG_UART_WITHOUT_CD	4
+#define MPC52xx_GPIO_PSC_CONFIG_UART_WITH_CD	5
+#define MPC52xx_GPIO_PCI_DIS			(1<<15)
+
+/* XLB Bus control */
+struct mpc52xx_xlb {
+	volatile u8 reserved[0x40];
+	volatile u32 config;		/* XLB + 0x40 */
+	volatile u32 version;		/* XLB + 0x44 */
+	volatile u32 status;		/* XLB + 0x48 */
+	volatile u32 int_enable;	/* XLB + 0x4c */
+	volatile u32 addr_capture;	/* XLB + 0x50 */
+	volatile u32 bus_sig_capture;	/* XLB + 0x54 */
+	volatile u32 addr_timeout;	/* XLB + 0x58 */
+	volatile u32 data_timeout;	/* XLB + 0x5c */
+	volatile u32 bus_act_timeout;	/* XLB + 0x60 */
+	volatile u32 master_pri_enable;	/* XLB + 0x64 */
+	volatile u32 master_priority;	/* XLB + 0x68 */
+	volatile u32 base_address;	/* XLB + 0x6c */
+	volatile u32 snoop_window;	/* XLB + 0x70 */
+};
+
+
+/* Clock Distribution control */
+struct mpc52xx_cdm {
+	volatile u32	jtag_id;	/* MBAR_CDM + 0x00  reg0 read only */
+	volatile u32	rstcfg;		/* MBAR_CDM + 0x04  reg1 read only */
+	volatile u32	breadcrumb;	/* MBAR_CDM + 0x08  reg2 */
+
+	volatile u8	mem_clk_sel;	/* MBAR_CDM + 0x0c  reg3 byte0 */
+	volatile u8	xlb_clk_sel;	/* MBAR_CDM + 0x0d  reg3 byte1 read only */
+	volatile u8	ipb_clk_sel;	/* MBAR_CDM + 0x0e  reg3 byte2 */
+	volatile u8	pci_clk_sel;	/* MBAR_CDM + 0x0f  reg3 byte3 */
+
+	volatile u8	ext_48mhz_en;	/* MBAR_CDM + 0x10  reg4 byte0 */
+	volatile u8	fd_enable;	/* MBAR_CDM + 0x11  reg4 byte1 */
+	volatile u16	fd_counters;	/* MBAR_CDM + 0x12  reg4 byte2,3 */
+
+	volatile u32	clk_enables;	/* MBAR_CDM + 0x14  reg5 */
+
+	volatile u8	osc_disable;	/* MBAR_CDM + 0x18  reg6 byte0 */
+	volatile u8	reserved0[3];	/* MBAR_CDM + 0x19  reg6 byte1,2,3 */
+
+	volatile u8	ccs_sleep_enable;/* MBAR_CDM + 0x1c  reg7 byte0 */
+	volatile u8	osc_sleep_enable;/* MBAR_CDM + 0x1d  reg7 byte1 */
+	volatile u8	reserved1;	/* MBAR_CDM + 0x1e  reg7 byte2 */
+	volatile u8	ccs_qreq_test;	/* MBAR_CDM + 0x1f  reg7 byte3 */
+
+	volatile u8	soft_reset;	/* MBAR_CDM + 0x20  u8 byte0 */
+	volatile u8	no_ckstp;	/* MBAR_CDM + 0x21  u8 byte0 */
+	volatile u8	reserved2[2];	/* MBAR_CDM + 0x22  u8 byte1,2,3 */
+
+	volatile u8	pll_lock;	/* MBAR_CDM + 0x24  reg9 byte0 */
+	volatile u8	pll_looselock;	/* MBAR_CDM + 0x25  reg9 byte1 */
+	volatile u8	pll_sm_lockwin;	/* MBAR_CDM + 0x26  reg9 byte2 */
+	volatile u8	reserved3;	/* MBAR_CDM + 0x27  reg9 byte3 */
+
+	volatile u16	reserved4;	/* MBAR_CDM + 0x28  reg10 byte0,1 */
+	volatile u16	mclken_div_psc1;/* MBAR_CDM + 0x2a  reg10 byte2,3 */
+    
+	volatile u16	reserved5;	/* MBAR_CDM + 0x2c  reg11 byte0,1 */
+	volatile u16	mclken_div_psc2;/* MBAR_CDM + 0x2e  reg11 byte2,3 */
+		
+	volatile u16	reserved6;	/* MBAR_CDM + 0x30  reg12 byte0,1 */
+	volatile u16	mclken_div_psc3;/* MBAR_CDM + 0x32  reg12 byte2,3 */
+    
+	volatile u16	reserved7;	/* MBAR_CDM + 0x34  reg13 byte0,1 */
+	volatile u16	mclken_div_psc6;/* MBAR_CDM + 0x36  reg13 byte2,3 */
+};
+
+#endif /* __ASSEMBLY__ */
+
+
+/* ========================================================================= */
+/* Prototypes for MPC52xx syslib                                             */
+/* ========================================================================= */
+
+#ifndef __ASSEMBLY__
+
+extern void mpc52xx_init_irq(void);
+extern int mpc52xx_get_irq(struct pt_regs *regs);
+
+extern unsigned long mpc52xx_find_end_of_memory(void);
+extern void mpc52xx_set_bat(void);
+extern void mpc52xx_map_io(void);
+extern void mpc52xx_restart(char *cmd);
+extern void mpc52xx_halt(void);
+extern void mpc52xx_power_off(void);
+extern void mpc52xx_progress(char *s, unsigned short hex);
+extern void mpc52xx_calibrate_decr(void);
+extern void mpc52xx_add_board_devices(struct ocp_def board_ocp[]);
+
+#endif /* __ASSEMBLY__ */
+
+
+/* ========================================================================= */
+/* Platform configuration                                                    */
+/* ========================================================================= */
+
+/* The U-Boot platform information struct */
+extern bd_t __res;
+
+/* Platform options */
+#if defined(CONFIG_LITE5200)
+#include <platforms/lite5200.h>
+#endif
+
+
+#endif /* __ASM_MPC52xx_H__ */
diff -urN linux-2.6.8-rc2/include/asm-ppc/mpc52xx_psc.h linux-2.6.8-rc3/include/asm-ppc/mpc52xx_psc.h
--- linux-2.6.8-rc2/include/asm-ppc/mpc52xx_psc.h	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/include/asm-ppc/mpc52xx_psc.h	2004-08-03 15:22:09.645076971 -0700
@@ -0,0 +1,191 @@
+/*
+ * include/asm-ppc/mpc52xx_psc.h
+ * 
+ * Definitions of consts/structs to drive the Freescale MPC52xx OnChip
+ * PSCs. Theses are shared between multiple drivers since a PSC can be
+ * UART, AC97, IR, I2S, ... So this header is in asm-ppc.
+ *
+ *
+ * Maintainer : Sylvain Munaut <tnt@246tNt.com>
+ *
+ * Based/Extracted from some header of the 2.4 originally written by 
+ * Dale Farnsworth <dfarnsworth@mvista.com> 
+ *
+ * Copyright (C) 2004 Sylvain Munaut <tnt@246tNt.com>
+ * Copyright (C) 2003 MontaVista, Software, Inc.
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2. This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ */
+
+#ifndef __MPC52xx_PSC_H__
+#define __MPC52xx_PSC_H__
+
+#include <asm/types.h>
+
+/* Max number of PSCs */
+#define MPC52xx_PSC_MAXNUM	6
+
+/* Programmable Serial Controller (PSC) status register bits */
+#define MPC52xx_PSC_SR_CDE	0x0080
+#define MPC52xx_PSC_SR_RXRDY	0x0100
+#define MPC52xx_PSC_SR_RXFULL	0x0200
+#define MPC52xx_PSC_SR_TXRDY	0x0400
+#define MPC52xx_PSC_SR_TXEMP	0x0800
+#define MPC52xx_PSC_SR_OE	0x1000
+#define MPC52xx_PSC_SR_PE	0x2000
+#define MPC52xx_PSC_SR_FE	0x4000
+#define MPC52xx_PSC_SR_RB	0x8000
+
+/* PSC Command values */
+#define MPC52xx_PSC_RX_ENABLE		0x0001
+#define MPC52xx_PSC_RX_DISABLE		0x0002
+#define MPC52xx_PSC_TX_ENABLE		0x0004
+#define MPC52xx_PSC_TX_DISABLE		0x0008
+#define MPC52xx_PSC_SEL_MODE_REG_1	0x0010
+#define MPC52xx_PSC_RST_RX		0x0020
+#define MPC52xx_PSC_RST_TX		0x0030
+#define MPC52xx_PSC_RST_ERR_STAT	0x0040
+#define MPC52xx_PSC_RST_BRK_CHG_INT	0x0050
+#define MPC52xx_PSC_START_BRK		0x0060
+#define MPC52xx_PSC_STOP_BRK		0x0070
+
+/* PSC TxRx FIFO status bits */
+#define MPC52xx_PSC_RXTX_FIFO_ERR	0x0040
+#define MPC52xx_PSC_RXTX_FIFO_UF	0x0020
+#define MPC52xx_PSC_RXTX_FIFO_OF	0x0010
+#define MPC52xx_PSC_RXTX_FIFO_FR	0x0008
+#define MPC52xx_PSC_RXTX_FIFO_FULL	0x0004
+#define MPC52xx_PSC_RXTX_FIFO_ALARM	0x0002
+#define MPC52xx_PSC_RXTX_FIFO_EMPTY	0x0001
+
+/* PSC interrupt mask bits */
+#define MPC52xx_PSC_IMR_TXRDY		0x0100
+#define MPC52xx_PSC_IMR_RXRDY		0x0200
+#define MPC52xx_PSC_IMR_DB		0x0400
+#define MPC52xx_PSC_IMR_IPC		0x8000
+
+/* PSC input port change bit */
+#define MPC52xx_PSC_CTS			0x01
+#define MPC52xx_PSC_DCD			0x02
+#define MPC52xx_PSC_D_CTS		0x10
+#define MPC52xx_PSC_D_DCD		0x20
+
+/* PSC mode fields */
+#define MPC52xx_PSC_MODE_5_BITS			0x00
+#define MPC52xx_PSC_MODE_6_BITS			0x01
+#define MPC52xx_PSC_MODE_7_BITS			0x02
+#define MPC52xx_PSC_MODE_8_BITS			0x03
+#define MPC52xx_PSC_MODE_BITS_MASK		0x03
+#define MPC52xx_PSC_MODE_PAREVEN		0x00
+#define MPC52xx_PSC_MODE_PARODD			0x04
+#define MPC52xx_PSC_MODE_PARFORCE		0x08
+#define MPC52xx_PSC_MODE_PARNONE		0x10
+#define MPC52xx_PSC_MODE_ERR			0x20
+#define MPC52xx_PSC_MODE_FFULL			0x40
+#define MPC52xx_PSC_MODE_RXRTS			0x80
+
+#define MPC52xx_PSC_MODE_ONE_STOP_5_BITS	0x00
+#define MPC52xx_PSC_MODE_ONE_STOP		0x07
+#define MPC52xx_PSC_MODE_TWO_STOP		0x0f
+
+#define MPC52xx_PSC_RFNUM_MASK	0x01ff
+
+
+/* Structure of the hardware registers */
+struct mpc52xx_psc {
+	volatile u8		mode;		/* PSC + 0x00 */
+	volatile u8		reserved0[3];
+	union {					/* PSC + 0x04 */
+		volatile u16	status;
+		volatile u16	clock_select;
+	} sr_csr;
+#define mpc52xx_psc_status	sr_csr.status
+#define mpc52xx_psc_clock_select	sr_csr.clock_select
+	volatile u16		reserved1;
+	volatile u8		command;	/* PSC + 0x08 */
+volatile u8		reserved2[3];
+	union {					/* PSC + 0x0c */
+		volatile u8	buffer_8;
+		volatile u16	buffer_16;
+		volatile u32	buffer_32;
+	} buffer;
+#define mpc52xx_psc_buffer_8	buffer.buffer_8
+#define mpc52xx_psc_buffer_16	buffer.buffer_16
+#define mpc52xx_psc_buffer_32	buffer.buffer_32
+	union {					/* PSC + 0x10 */
+		volatile u8	ipcr;
+		volatile u8	acr;
+	} ipcr_acr;
+#define mpc52xx_psc_ipcr	ipcr_acr.ipcr
+#define mpc52xx_psc_acr		ipcr_acr.acr
+	volatile u8		reserved3[3];
+	union {					/* PSC + 0x14 */
+		volatile u16	isr;
+		volatile u16	imr;
+	} isr_imr;
+#define mpc52xx_psc_isr		isr_imr.isr
+#define mpc52xx_psc_imr		isr_imr.imr
+	volatile u16		reserved4;
+	volatile u8		ctur;		/* PSC + 0x18 */
+	volatile u8		reserved5[3];
+	volatile u8		ctlr;		/* PSC + 0x1c */
+	volatile u8		reserved6[3];
+	volatile u16		ccr;		/* PSC + 0x20 */
+	volatile u8		reserved7[14];
+	volatile u8		ivr;		/* PSC + 0x30 */
+	volatile u8		reserved8[3];
+	volatile u8		ip;		/* PSC + 0x34 */
+	volatile u8		reserved9[3];
+	volatile u8		op1;		/* PSC + 0x38 */
+	volatile u8		reserved10[3];
+	volatile u8		op0;		/* PSC + 0x3c */
+	volatile u8		reserved11[3];
+	volatile u32		sicr;		/* PSC + 0x40 */
+	volatile u8		ircr1;		/* PSC + 0x44 */
+	volatile u8		reserved13[3];
+	volatile u8		ircr2;		/* PSC + 0x44 */
+	volatile u8		reserved14[3];
+	volatile u8		irsdr;		/* PSC + 0x4c */
+	volatile u8		reserved15[3];
+	volatile u8		irmdr;		/* PSC + 0x50 */
+	volatile u8		reserved16[3];
+	volatile u8		irfdr;		/* PSC + 0x54 */
+	volatile u8		reserved17[3];
+	volatile u16		rfnum;		/* PSC + 0x58 */
+	volatile u16		reserved18;
+	volatile u16		tfnum;		/* PSC + 0x5c */
+	volatile u16		reserved19;
+	volatile u32		rfdata;		/* PSC + 0x60 */
+	volatile u16		rfstat;		/* PSC + 0x64 */
+	volatile u16		reserved20;
+	volatile u8		rfcntl;		/* PSC + 0x68 */
+	volatile u8		reserved21[5];
+	volatile u16		rfalarm;	/* PSC + 0x6e */
+	volatile u16		reserved22;
+	volatile u16		rfrptr;		/* PSC + 0x72 */
+	volatile u16		reserved23;
+	volatile u16		rfwptr;		/* PSC + 0x76 */
+	volatile u16		reserved24;
+	volatile u16		rflrfptr;	/* PSC + 0x7a */
+	volatile u16		reserved25;
+	volatile u16		rflwfptr;	/* PSC + 0x7e */
+	volatile u32		tfdata;		/* PSC + 0x80 */
+	volatile u16		tfstat;		/* PSC + 0x84 */
+	volatile u16		reserved26;
+	volatile u8		tfcntl;		/* PSC + 0x88 */
+	volatile u8		reserved27[5];
+	volatile u16		tfalarm;	/* PSC + 0x8e */
+	volatile u16		reserved28;
+	volatile u16		tfrptr;		/* PSC + 0x92 */
+	volatile u16		reserved29;
+	volatile u16		tfwptr;		/* PSC + 0x96 */
+	volatile u16		reserved30;
+	volatile u16		tflrfptr;	/* PSC + 0x9a */
+	volatile u16		reserved31;
+	volatile u16		tflwfptr;	/* PSC + 0x9e */
+};
+
+
+#endif  /* __MPC52xx_PSC_H__ */
diff -urN linux-2.6.8-rc2/include/asm-ppc/mpc8260.h linux-2.6.8-rc3/include/asm-ppc/mpc8260.h
--- linux-2.6.8-rc2/include/asm-ppc/mpc8260.h	2004-08-03 15:21:13.502773865 -0700
+++ linux-2.6.8-rc3/include/asm-ppc/mpc8260.h	2004-08-03 15:22:09.646077012 -0700
@@ -24,8 +24,8 @@
 #include <platforms/sbs8260.h>
 #endif
 
-#ifdef CONFIG_RPX6
-#include <platforms/rpxsuper.h>
+#ifdef CONFIG_RPX8260
+#include <platforms/rpx8260.h>
 #endif
 
 #ifdef CONFIG_WILLOW
diff -urN linux-2.6.8-rc2/include/asm-ppc/mpc85xx.h linux-2.6.8-rc3/include/asm-ppc/mpc85xx.h
--- linux-2.6.8-rc2/include/asm-ppc/mpc85xx.h	2004-08-03 15:21:13.503773906 -0700
+++ linux-2.6.8-rc3/include/asm-ppc/mpc85xx.h	2004-08-03 15:22:09.647077053 -0700
@@ -25,13 +25,23 @@
 #ifdef CONFIG_MPC8540_ADS
 #include <platforms/85xx/mpc8540_ads.h>
 #endif
+#ifdef CONFIG_MPC8555_CDS
+#include <platforms/85xx/mpc8555_cds.h>
+#endif
+#ifdef CONFIG_MPC8560_ADS
+#include <platforms/85xx/mpc8560_ads.h>
+#endif
 #ifdef CONFIG_SBC8560
 #include <platforms/85xx/sbc8560.h>
 #endif
 
 #define _IO_BASE        isa_io_base
 #define _ISA_MEM_BASE   isa_mem_base
+#ifdef CONFIG_PCI
 #define PCI_DRAM_OFFSET pci_dram_offset
+#else
+#define PCI_DRAM_OFFSET 0
+#endif
 
 /*
  * The "residual" board information structure the boot loader passes
diff -urN linux-2.6.8-rc2/include/asm-ppc/ocp_ids.h linux-2.6.8-rc3/include/asm-ppc/ocp_ids.h
--- linux-2.6.8-rc2/include/asm-ppc/ocp_ids.h	2004-08-03 15:21:13.504773947 -0700
+++ linux-2.6.8-rc3/include/asm-ppc/ocp_ids.h	2004-08-03 15:22:09.652077258 -0700
@@ -42,6 +42,7 @@
 #define OCP_FUNC_16550		0x0031
 #define OCP_FUNC_IIC		0x0032
 #define OCP_FUNC_USB		0x0033
+#define OCP_FUNC_PSC_UART	0x0034
 
 /* Memory devices 0x0090 - 0x009F */
 #define OCP_FUNC_MAL		0x0090
diff -urN linux-2.6.8-rc2/include/asm-ppc/open_pic.h linux-2.6.8-rc3/include/asm-ppc/open_pic.h
--- linux-2.6.8-rc2/include/asm-ppc/open_pic.h	2004-06-15 22:19:12.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-ppc/open_pic.h	2004-08-03 15:22:09.653077299 -0700
@@ -50,7 +50,7 @@
 extern int openpic_get_irq(struct pt_regs *regs);
 extern void openpic_reset_processor_phys(u_int cpumask);
 extern void openpic_setup_ISU(int isu_num, unsigned long addr);
-extern void openpic_cause_IPI(u_int ipi, u_int cpumask);
+extern void openpic_cause_IPI(u_int ipi, cpumask_t cpumask);
 extern void smp_openpic_message_pass(int target, int msg, unsigned long data,
 				     int wait);
 extern void openpic_set_k2_cascade(int irq);
diff -urN linux-2.6.8-rc2/include/asm-ppc/ppcboot.h linux-2.6.8-rc3/include/asm-ppc/ppcboot.h
--- linux-2.6.8-rc2/include/asm-ppc/ppcboot.h	2004-08-03 15:21:13.507774070 -0700
+++ linux-2.6.8-rc3/include/asm-ppc/ppcboot.h	2004-08-03 15:22:09.664077751 -0700
@@ -55,6 +55,9 @@
 #if defined(CONFIG_8xx) || defined(CONFIG_CPM2) || defined(CONFIG_85xx)
 	unsigned long	bi_immr_base;	/* base of IMMR register */
 #endif
+#if defined(CONFIG_PPC_MPC52xx)
+	unsigned long   bi_mbar_base;   /* base of internal registers */
+#endif
 	unsigned long	bi_bootflags;	/* boot / reboot flag (for LynxOS) */
 	unsigned long	bi_ip_addr;	/* IP Address */
 	unsigned char	bi_enetaddr[6];	/* Ethernet address */
@@ -67,6 +70,10 @@
 	unsigned long	bi_sccfreq;	/* SCC_CLK Freq, in MHz */
 	unsigned long	bi_vco;		/* VCO Out from PLL, in MHz */
 #endif
+#if defined(CONFIG_PPC_MPC52xx)
+	unsigned long   bi_ipbfreq;     /* IPB Bus Freq, in MHz */
+	unsigned long   bi_pcifreq;     /* PCI Bus Freq, in MHz */
+#endif
 	unsigned long	bi_baudrate;	/* Console Baudrate */
 #if defined(CONFIG_405GP)
 	unsigned char	bi_s_version[4];	/* Version of this structure */
diff -urN linux-2.6.8-rc2/include/asm-ppc/reg.h linux-2.6.8-rc3/include/asm-ppc/reg.h
--- linux-2.6.8-rc2/include/asm-ppc/reg.h	2004-08-03 15:21:13.509774152 -0700
+++ linux-2.6.8-rc3/include/asm-ppc/reg.h	2004-08-03 15:22:09.675078202 -0700
@@ -350,7 +350,7 @@
 #define DBAT6U	SPRN_DBAT6U	/* Data BAT 6 Upper Register */
 #define DBAT7L	SPRN_DBAT7L	/* Data BAT 7 Lower Register */
 #define DBAT7U	SPRN_DBAT7U	/* Data BAT 7 Upper Register */
-#define DEC	SPRN_DEC	/* Decrement Register */
+//#define DEC	SPRN_DEC	/* Decrement Register */
 #define DMISS	SPRN_DMISS	/* Data TLB Miss Register */
 #define DSISR	SPRN_DSISR	/* Data Storage Interrupt Status Register */
 #define EAR	SPRN_EAR	/* External Address Register */
@@ -380,9 +380,9 @@
 #define IMMR	SPRN_IMMR	/* PPC 860/821 Internal Memory Map Register */
 #define L2CR	SPRN_L2CR	/* Classic PPC L2 cache control register */
 #define L3CR	SPRN_L3CR	/* PPC 745x L3 cache control register */
-#define LR	SPRN_LR
+//#define LR	SPRN_LR
 #define PVR	SPRN_PVR	/* Processor Version */
-#define RPA	SPRN_RPA	/* Required Physical Address Register */
+//#define RPA	SPRN_RPA	/* Required Physical Address Register */
 #define SDR1	SPRN_SDR1	/* MMU hash base register */
 #define SPR0	SPRN_SPRG0	/* Supervisor Private Registers */
 #define SPR1	SPRN_SPRG1
@@ -489,6 +489,7 @@
 #define SVR_8555E	0x80790000
 #define SVR_8560	0x80700000
 
+#if 0
 /* Segment Registers */
 #define SR0	0
 #define SR1	1
@@ -506,6 +507,7 @@
 #define SR13	13
 #define SR14	14
 #define SR15	15
+#endif
 
 /* Macros for setting and retrieving special purpose registers */
 #ifndef __ASSEMBLY__
diff -urN linux-2.6.8-rc2/include/asm-ppc/signal.h linux-2.6.8-rc3/include/asm-ppc/signal.h
--- linux-2.6.8-rc2/include/asm-ppc/signal.h	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-ppc/signal.h	2004-08-03 15:22:09.678078325 -0700
@@ -118,7 +118,11 @@
 #define SIG_SETMASK        2	/* for setting the signal mask */
 
 /* Type of a signal handler.  */
-typedef void (*__sighandler_t)(int);
+typedef void __signalfn_t(int);
+typedef __signalfn_t __user *__sighandler_t;
+
+typedef void __restorefn_t(void);
+typedef __restorefn_t __user *__sigrestore_t;
 
 #define SIG_DFL	((__sighandler_t)0)	/* default signal handling */
 #define SIG_IGN	((__sighandler_t)1)	/* ignore signal */
@@ -128,13 +132,13 @@
 	__sighandler_t sa_handler;
 	old_sigset_t sa_mask;
 	unsigned long sa_flags;
-	void (*sa_restorer)(void);
+	__sigrestore_t sa_restorer;
 };
 
 struct sigaction {
 	__sighandler_t sa_handler;
 	unsigned long sa_flags;
-	void (*sa_restorer)(void);
+	__sigrestore_t sa_restorer;
 	sigset_t sa_mask;		/* mask last for extensibility */
 };
 
@@ -143,7 +147,7 @@
 };
 
 typedef struct sigaltstack {
-	void *ss_sp;
+	void __user *ss_sp;
 	int ss_flags;
 	size_t ss_size;
 } stack_t;
diff -urN linux-2.6.8-rc2/include/asm-ppc/uaccess.h linux-2.6.8-rc3/include/asm-ppc/uaccess.h
--- linux-2.6.8-rc2/include/asm-ppc/uaccess.h	2004-06-15 22:18:52.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-ppc/uaccess.h	2004-08-03 15:22:09.681078448 -0700
@@ -34,7 +34,8 @@
 	((addr) <= current->thread.fs.seg				    \
 	 && ((size) == 0 || (size) - 1 <= current->thread.fs.seg - (addr)))
 
-#define access_ok(type, addr, size) __access_ok((unsigned long)(addr),(size))
+#define access_ok(type, addr, size) \
+	(__chk_user_ptr(addr),__access_ok((unsigned long)(addr),(size)))
 
 extern inline int verify_area(int type, const void __user * addr, unsigned long size)
 {
@@ -105,6 +106,7 @@
 #define __put_user_nocheck(x,ptr,size)			\
 ({							\
 	long __pu_err;					\
+	__chk_user_ptr(ptr);				\
 	__put_user_size((x),(ptr),(size),__pu_err);	\
 	__pu_err;					\
 })
@@ -112,7 +114,7 @@
 #define __put_user_check(x,ptr,size)				\
 ({								\
 	long __pu_err = -EFAULT;				\
-	__typeof__(*(ptr)) *__pu_addr = (ptr);			\
+	__typeof__(*(ptr)) __user *__pu_addr = (ptr);		\
 	if (access_ok(VERIFY_WRITE,__pu_addr,size))		\
 		__put_user_size((x),__pu_addr,(size),__pu_err);	\
 	__pu_err;						\
@@ -179,6 +181,7 @@
 #define __get_user_nocheck(x, ptr, size)			\
 ({								\
 	long __gu_err, __gu_val;				\
+	__chk_user_ptr(ptr);					\
 	__get_user_size(__gu_val, (ptr), (size), __gu_err);	\
 	(x) = (__typeof__(*(ptr)))__gu_val;			\
 	__gu_err;						\
@@ -188,6 +191,7 @@
 ({								\
 	long __gu_err;						\
 	long long __gu_val;					\
+	__chk_user_ptr(ptr);					\
 	__get_user_size64(__gu_val, (ptr), (size), __gu_err);	\
 	(x) = (__typeof__(*(ptr)))__gu_val;			\
 	__gu_err;						\
@@ -196,7 +200,7 @@
 #define __get_user_check(x, ptr, size)					\
 ({									\
 	long __gu_err = -EFAULT, __gu_val = 0;				\
-	const __typeof__(*(ptr)) *__gu_addr = (ptr);			\
+	const __typeof__(*(ptr)) __user *__gu_addr = (ptr);		\
 	if (access_ok(VERIFY_READ, __gu_addr, (size)))			\
 		__get_user_size(__gu_val, __gu_addr, (size), __gu_err);	\
 	(x) = (__typeof__(*(ptr)))__gu_val;				\
@@ -207,7 +211,7 @@
 ({									  \
 	long __gu_err = -EFAULT;					  \
 	long long __gu_val = 0;						  \
-	const __typeof__(*(ptr)) *__gu_addr = (ptr);			  \
+	const __typeof__(*(ptr)) __user *__gu_addr = (ptr);		  \
 	if (access_ok(VERIFY_READ, __gu_addr, (size)))			  \
 		__get_user_size64(__gu_val, __gu_addr, (size), __gu_err); \
 	(x) = (__typeof__(*(ptr)))__gu_val;				  \
diff -urN linux-2.6.8-rc2/include/asm-ppc/ucontext.h linux-2.6.8-rc3/include/asm-ppc/ucontext.h
--- linux-2.6.8-rc2/include/asm-ppc/ucontext.h	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-ppc/ucontext.h	2004-08-03 15:22:09.681078448 -0700
@@ -13,10 +13,10 @@
 
 struct ucontext {
 	unsigned long	 uc_flags;
-	struct ucontext *uc_link;
+	struct ucontext __user *uc_link;
 	stack_t		 uc_stack;
 	int		 uc_pad[7];
-	struct mcontext	*uc_regs;	/* points to uc_mcontext field */
+	struct mcontext	__user *uc_regs;/* points to uc_mcontext field */
 	sigset_t	 uc_sigmask;
 	/* glibc has 1024-bit signal masks, ours are 64-bit */
 	int		 uc_maskext[30];
diff -urN linux-2.6.8-rc2/include/asm-ppc64/eeh.h linux-2.6.8-rc3/include/asm-ppc64/eeh.h
--- linux-2.6.8-rc2/include/asm-ppc64/eeh.h	2004-08-03 15:21:13.526774849 -0700
+++ linux-2.6.8-rc3/include/asm-ppc64/eeh.h	2004-08-03 15:22:09.687078694 -0700
@@ -180,27 +180,96 @@
 	out_be64(vaddr, val);
 }
 
+#define EEH_CHECK_ALIGN(v,a) \
+	((((unsigned long)(v)) & ((a) - 1)) == 0)
+
 static inline void eeh_memset_io(void *addr, int c, unsigned long n) {
 	void *vaddr = (void *)IO_TOKEN_TO_ADDR(addr);
-	memset(vaddr, c, n);
+	u32 lc = c;
+	lc |= lc << 8;
+	lc |= lc << 16;
+
+	while(n && !EEH_CHECK_ALIGN(vaddr, 4)) {
+		*((volatile u8 *)vaddr) = c;
+		vaddr = (void *)((unsigned long)vaddr + 1);
+		n--;
+	}
+	while(n >= 4) {
+		*((volatile u32 *)vaddr) = lc;
+		vaddr = (void *)((unsigned long)vaddr + 4);
+		n -= 4;
+	}
+	while(n) {
+		*((volatile u8 *)vaddr) = c;
+		vaddr = (void *)((unsigned long)vaddr + 1);
+		n--;
+	}
+	__asm__ __volatile__ ("sync" : : : "memory");
 }
 static inline void eeh_memcpy_fromio(void *dest, void *src, unsigned long n) {
 	void *vsrc = (void *)IO_TOKEN_TO_ADDR(src);
-	memcpy(dest, vsrc, n);
+	void *vsrcsave = vsrc, *destsave = dest, *srcsave = src;
+	unsigned long nsave = n;
+
+	while(n && (!EEH_CHECK_ALIGN(vsrc, 4) || !EEH_CHECK_ALIGN(dest, 4))) {
+		*((u8 *)dest) = *((volatile u8 *)vsrc);
+		__asm__ __volatile__ ("eieio" : : : "memory");
+		vsrc = (void *)((unsigned long)vsrc + 1);
+		dest = (void *)((unsigned long)dest + 1);			
+		n--;
+	}
+	while(n > 4) {
+		*((u32 *)dest) = *((volatile u32 *)vsrc);
+		__asm__ __volatile__ ("eieio" : : : "memory");
+		vsrc = (void *)((unsigned long)vsrc + 4);
+		dest = (void *)((unsigned long)dest + 4);			
+		n -= 4;
+	}
+	while(n) {
+		*((u8 *)dest) = *((volatile u8 *)vsrc);
+		__asm__ __volatile__ ("eieio" : : : "memory");
+		vsrc = (void *)((unsigned long)vsrc + 1);
+		dest = (void *)((unsigned long)dest + 1);			
+		n--;
+	}
+	__asm__ __volatile__ ("sync" : : : "memory");
+
 	/* Look for ffff's here at dest[n].  Assume that at least 4 bytes
 	 * were copied. Check all four bytes.
 	 */
-	if ((n >= 4) &&
-		(EEH_POSSIBLE_ERROR(src, vsrc, (*((u32 *) dest+n-4)), u32))) {
-		eeh_check_failure(src, (*((u32 *) dest+n-4)));
+	if ((nsave >= 4) &&
+		(EEH_POSSIBLE_ERROR(srcsave, vsrcsave, (*((u32 *) destsave+nsave-4)),
+				    u32))) {
+		eeh_check_failure(srcsave, (*((u32 *) destsave+nsave-4)));
 	}
 }
 
 static inline void eeh_memcpy_toio(void *dest, void *src, unsigned long n) {
 	void *vdest = (void *)IO_TOKEN_TO_ADDR(dest);
-	memcpy(vdest, src, n);
+
+	while(n && (!EEH_CHECK_ALIGN(vdest, 4) || !EEH_CHECK_ALIGN(src, 4))) {
+		*((volatile u8 *)vdest) = *((u8 *)src);
+		src = (void *)((unsigned long)src + 1);
+		vdest = (void *)((unsigned long)vdest + 1);			
+		n--;
+	}
+	while(n > 4) {
+		*((volatile u32 *)vdest) = *((volatile u32 *)src);
+		src = (void *)((unsigned long)src + 4);
+		vdest = (void *)((unsigned long)vdest + 4);			
+		n-=4;
+	}
+	while(n) {
+		*((volatile u8 *)vdest) = *((u8 *)src);
+		src = (void *)((unsigned long)src + 1);
+		vdest = (void *)((unsigned long)vdest + 1);			
+		n--;
+	}
+	__asm__ __volatile__ ("sync" : : : "memory");
 }
 
+#undef EEH_CHECK_ALIGN
+
 #define MAX_ISA_PORT 0x10000
 extern unsigned long io_page_mask;
 #define _IO_IS_VALID(port) ((port) >= MAX_ISA_PORT || (1 << (port>>PAGE_SHIFT)) & io_page_mask)
diff -urN linux-2.6.8-rc2/include/asm-ppc64/hvcserver.h linux-2.6.8-rc3/include/asm-ppc64/hvcserver.h
--- linux-2.6.8-rc2/include/asm-ppc64/hvcserver.h	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/include/asm-ppc64/hvcserver.h	2004-08-03 15:22:09.689078776 -0700
@@ -0,0 +1,44 @@
+/*
+ * hvcserver.h
+ * Copyright (C) 2004 Ryan S Arnold, IBM Corporation
+ *
+ * PPC64 virtual I/O console server support.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
+ */
+
+#ifndef _PPC64_HVCSERVER_H
+#define _PPC64_HVCSERVER_H
+
+#include <linux/list.h>
+
+/* Converged Location Code length */
+#define HVCS_CLC_LENGTH	79
+
+struct hvcs_partner_info {
+	struct list_head node;
+	unsigned int unit_address;
+	unsigned int partition_ID;
+	char location_code[HVCS_CLC_LENGTH + 1]; /* CLC + 1 null-term char */
+};
+
+extern int hvcs_free_partner_info(struct list_head *head);
+extern int hvcs_get_partner_info(unsigned int unit_address,
+		struct list_head *head, unsigned long *pi_buff);
+extern int hvcs_register_connection(unsigned int unit_address,
+		unsigned int p_partition_ID, unsigned int p_unit_address);
+extern int hvcs_free_connection(unsigned int unit_address);
+
+#endif /* _PPC64_HVCSERVER_H */
diff -urN linux-2.6.8-rc2/include/asm-ppc64/mmu.h linux-2.6.8-rc3/include/asm-ppc64/mmu.h
--- linux-2.6.8-rc2/include/asm-ppc64/mmu.h	2004-08-03 15:21:13.585777270 -0700
+++ linux-2.6.8-rc3/include/asm-ppc64/mmu.h	2004-08-03 15:22:09.693078940 -0700
@@ -37,12 +37,6 @@
 		mm_context_t ctx = { .id = REGION_ID(ea), KERNEL_LOW_HPAGES}; \
 		ctx; })
 
-/*
- * Hardware Segment Lookaside Buffer Entry
- * This structure has been padded out to two 64b doublewords (actual SLBE's are
- * 94 bits).  This padding facilites use by the segment management
- * instructions.
- */
 typedef struct {
 	unsigned long esid: 36; /* Effective segment ID */
 	unsigned long resv0:20; /* Reserved */
@@ -71,35 +65,6 @@
 	} dw1;
 } STE;
 
-typedef struct {
-	unsigned long esid: 36; /* Effective segment ID */
-	unsigned long v:     1; /* Entry valid (v=1) or invalid */
-	unsigned long null1:15; /* padding to a 64b boundary */
-	unsigned long index:12; /* Index to select SLB entry. Used by slbmte */
-} slb_dword0;
-
-typedef struct {
-	unsigned long vsid: 52; /* Virtual segment ID */
-	unsigned long ks:    1; /* Supervisor (privileged) state storage key */
-	unsigned long kp:    1; /* Problem state storage key */
-	unsigned long n:     1; /* No-execute if n=1 */
-	unsigned long l:     1; /* Virt pages are large (l=1) or 4KB (l=0) */
-	unsigned long c:     1; /* Class */
-	unsigned long resv0: 7; /* Padding to a 64b boundary */
-} slb_dword1;
-
-typedef struct {
-	union {
-		unsigned long dword0;
-		slb_dword0    dw0;
-	} dw0;
-
-	union {
-		unsigned long dword1;
-		slb_dword1    dw1;
-	} dw1;
-} SLBE;
-
 /* Hardware Page Table Entry */
 
 #define HPTES_PER_GROUP 8
@@ -259,6 +224,30 @@
 #define STAB0_PHYS_ADDR	(STAB0_PAGE<<PAGE_SHIFT)
 #define STAB0_VIRT_ADDR	(KERNELBASE+STAB0_PHYS_ADDR)
 
+#define SLB_NUM_BOLTED		2
+#define SLB_CACHE_ENTRIES	8
+
+/* Bits in the SLB ESID word */
+#define SLB_ESID_V		0x0000000008000000	/* entry is valid */
+
+/* Bits in the SLB VSID word */
+#define SLB_VSID_SHIFT		12
+#define SLB_VSID_KS		0x0000000000000800
+#define SLB_VSID_KP		0x0000000000000400
+#define SLB_VSID_N		0x0000000000000200	/* no-execute */
+#define SLB_VSID_L		0x0000000000000100	/* largepage (4M) */
+#define SLB_VSID_C		0x0000000000000080	/* class */
+
+#define SLB_VSID_KERNEL		(SLB_VSID_KP|SLB_VSID_C)
+#define SLB_VSID_USER		(SLB_VSID_KP|SLB_VSID_KS)
+
+#define VSID_RANDOMIZER ASM_CONST(42470972311)
+#define VSID_MASK	0xfffffffffUL
+/* Because we never access addresses below KERNELBASE as kernel
+ * addresses, this VSID is never used for anything real, and will
+ * never have pages hashed into it */
+#define BAD_VSID	ASM_CONST(0)
+
 /* Block size masks */
 #define BL_128K	0x000
 #define BL_256K 0x001
diff -urN linux-2.6.8-rc2/include/asm-ppc64/mmu_context.h linux-2.6.8-rc3/include/asm-ppc64/mmu_context.h
--- linux-2.6.8-rc2/include/asm-ppc64/mmu_context.h	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-ppc64/mmu_context.h	2004-08-03 15:22:09.693078940 -0700
@@ -136,7 +136,7 @@
 }
 
 extern void flush_stab(struct task_struct *tsk, struct mm_struct *mm);
-extern void flush_slb(struct task_struct *tsk, struct mm_struct *mm);
+extern void switch_slb(struct task_struct *tsk, struct mm_struct *mm);
 
 /*
  * switch_mm is the entry point called from the architecture independent
@@ -161,7 +161,7 @@
 		return;
 
 	if (cur_cpu_spec->cpu_features & CPU_FTR_SLB)
-		flush_slb(tsk, next);
+		switch_slb(tsk, next);
 	else
 		flush_stab(tsk, next);
 }
@@ -181,10 +181,6 @@
 	local_irq_restore(flags);
 }
 
-#define VSID_RANDOMIZER 42470972311UL
-#define VSID_MASK	0xfffffffffUL
-
-
 /* This is only valid for kernel (including vmalloc, imalloc and bolted) EA's
  */
 static inline unsigned long
diff -urN linux-2.6.8-rc2/include/asm-ppc64/paca.h linux-2.6.8-rc3/include/asm-ppc64/paca.h
--- linux-2.6.8-rc2/include/asm-ppc64/paca.h	2004-08-03 15:21:13.586777311 -0700
+++ linux-2.6.8-rc3/include/asm-ppc64/paca.h	2004-08-03 15:22:09.694078981 -0700
@@ -78,20 +78,26 @@
 	u64 exmc[8];		/* used for machine checks */
 	u64 exslb[8];		/* used for SLB/segment table misses
 				 * on the linear mapping */
-	u64 exdsi[8];		/* used for linear mapping hash table misses */
+	u64 slb_r3;		/* spot to save R3 on SLB miss */
+	mm_context_t context;
+	u16 slb_cache[SLB_CACHE_ENTRIES];
+	u16 slb_cache_ptr;
 
 	/*
 	 * then miscellaneous read-write fields
 	 */
 	struct task_struct *__current;	/* Pointer to current */
 	u64 kstack;			/* Saved Kernel stack addr */
-	u64 stab_next_rr;		/* stab/slb round-robin counter */
+	u64 stab_rr;			/* stab/slb round-robin counter */
 	u64 next_jiffy_update_tb;	/* TB value for next jiffy update */
 	u64 saved_r1;			/* r1 save for RTAS calls */
 	u64 saved_msr;			/* MSR saved here by enter_rtas */
 	u32 lpevent_count;		/* lpevents processed  */
 	u8 proc_enabled;		/* irq soft-enable flag */
 
+	/* not yet used */
+	u64 exdsi[8];		/* used for linear mapping hash table misses */
+
 	/*
 	 * iSeries structues which the hypervisor knows about - Not
 	 * sure if these particularly need to be cacheline aligned.
diff -urN linux-2.6.8-rc2/include/asm-ppc64/page.h linux-2.6.8-rc3/include/asm-ppc64/page.h
--- linux-2.6.8-rc2/include/asm-ppc64/page.h	2004-06-15 22:18:47.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-ppc64/page.h	2004-08-03 15:22:09.695079022 -0700
@@ -27,6 +27,7 @@
 
 #define SID_SHIFT       28
 #define SID_MASK        0xfffffffffUL
+#define ESID_MASK	0xfffffffff0000000UL
 #define GET_ESID(x)     (((x) >> SID_SHIFT) & SID_MASK)
 
 #ifdef CONFIG_HUGETLB_PAGE
@@ -37,8 +38,8 @@
 #define HUGETLB_PAGE_ORDER	(HPAGE_SHIFT - PAGE_SHIFT)
 
 /* For 64-bit processes the hugepage range is 1T-1.5T */
-#define TASK_HPAGE_BASE 	(0x0000010000000000UL)
-#define TASK_HPAGE_END 	(0x0000018000000000UL)
+#define TASK_HPAGE_BASE ASM_CONST(0x0000010000000000)
+#define TASK_HPAGE_END 	ASM_CONST(0x0000018000000000)
 
 #define LOW_ESID_MASK(addr, len)	(((1U << (GET_ESID(addr+len-1)+1)) \
 	   	                	- (1U << GET_ESID(addr))) & 0xffff)
diff -urN linux-2.6.8-rc2/include/asm-ppc64/pci-bridge.h linux-2.6.8-rc3/include/asm-ppc64/pci-bridge.h
--- linux-2.6.8-rc2/include/asm-ppc64/pci-bridge.h	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-ppc64/pci-bridge.h	2004-08-03 15:22:09.695079022 -0700
@@ -47,7 +47,6 @@
 	 * the PCI memory space in the CPU bus space
 	 */
 	unsigned long pci_mem_offset;
-	unsigned long pci_io_offset;
 
 	struct pci_ops *ops;
 	volatile unsigned int *cfg_addr;
diff -urN linux-2.6.8-rc2/include/asm-ppc64/processor.h linux-2.6.8-rc3/include/asm-ppc64/processor.h
--- linux-2.6.8-rc2/include/asm-ppc64/processor.h	2004-08-03 15:21:13.588777393 -0700
+++ linux-2.6.8-rc3/include/asm-ppc64/processor.h	2004-08-03 15:22:09.698079145 -0700
@@ -348,7 +348,7 @@
 #define	PVR	SPRN_PVR	/* Processor Version */
 #define	PIR	SPRN_PIR	/* Processor ID */
 #define	PURR	SPRN_PURR	/* Processor Utilization of Resource Register */
-#define	RPA	SPRN_RPA	/* Required Physical Address Register */
+//#define	RPA	SPRN_RPA	/* Required Physical Address Register */
 #define	SDR1	SPRN_SDR1      	/* MMU hash base register */
 #define	SPR0	SPRN_SPRG0	/* Supervisor Private Registers */
 #define	SPR1	SPRN_SPRG1
diff -urN linux-2.6.8-rc2/include/asm-ppc64/prom.h linux-2.6.8-rc3/include/asm-ppc64/prom.h
--- linux-2.6.8-rc2/include/asm-ppc64/prom.h	2004-08-03 15:21:13.589777434 -0700
+++ linux-2.6.8-rc3/include/asm-ppc64/prom.h	2004-08-03 15:22:09.698079145 -0700
@@ -269,6 +269,7 @@
 extern void print_properties(struct device_node *node);
 extern int prom_n_addr_cells(struct device_node* np);
 extern int prom_n_size_cells(struct device_node* np);
+extern int prom_n_intr_cells(struct device_node* np);
 extern void prom_get_irq_senses(unsigned char *senses, int off, int max);
 extern void prom_add_property(struct device_node* np, struct property* prop);
 
diff -urN linux-2.6.8-rc2/include/asm-ppc64/uaccess.h linux-2.6.8-rc3/include/asm-ppc64/uaccess.h
--- linux-2.6.8-rc2/include/asm-ppc64/uaccess.h	2004-08-03 15:21:13.595777680 -0700
+++ linux-2.6.8-rc3/include/asm-ppc64/uaccess.h	2004-08-03 15:22:09.704079392 -0700
@@ -175,7 +175,7 @@
 #define __get_user_check(x,ptr,size)					\
 ({									\
 	long __gu_err = -EFAULT, __gu_val = 0;				\
-	const __typeof__(*(ptr)) *__gu_addr = (ptr);			\
+	const __typeof__(*(ptr)) __user *__gu_addr = (ptr);		\
 	if (access_ok(VERIFY_READ,__gu_addr,size))			\
 		__get_user_size(__gu_val,__gu_addr,(size),__gu_err,-EFAULT);\
 	(x) = (__typeof__(*(ptr)))__gu_val;				\
diff -urN linux-2.6.8-rc2/include/asm-ppc64/xics.h linux-2.6.8-rc3/include/asm-ppc64/xics.h
--- linux-2.6.8-rc2/include/asm-ppc64/xics.h	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-ppc64/xics.h	2004-08-03 15:22:09.706079474 -0700
@@ -19,6 +19,9 @@
 void xics_setup_cpu(void);
 void xics_cause_IPI(int cpu);
 
+/* first argument is ignored for now*/
+void pSeriesLP_cppr_info(int n_cpu, u8 value);
+
 struct xics_ipi_struct {
 	volatile unsigned long value;
 } ____cacheline_aligned;
diff -urN linux-2.6.8-rc2/include/asm-sparc/openpromio.h linux-2.6.8-rc3/include/asm-sparc/openpromio.h
--- linux-2.6.8-rc2/include/asm-sparc/openpromio.h	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-sparc/openpromio.h	2004-08-03 15:22:10.410108354 -0700
@@ -1,6 +1,7 @@
 #ifndef	_SPARC_OPENPROMIO_H
 #define	_SPARC_OPENPROMIO_H
 
+#include <linux/compiler.h>
 #include <linux/ioctl.h>
 #include <linux/types.h>
 
@@ -52,9 +53,9 @@
 {
 	int	op_nodeid;		/* PROM Node ID (value-result) */
 	int	op_namelen;		/* Length of op_name. */
-	char	*op_name;		/* Pointer to the property name. */
+	char	__user *op_name;	/* Pointer to the property name. */
 	int	op_buflen;		/* Length of op_buf (value-result) */
-	char	*op_buf;		/* Pointer to buffer. */
+	char	__user *op_buf;		/* Pointer to buffer. */
 };
 
 #define	OPIOCGET	_IOWR('O', 1, struct opiocdesc)
diff -urN linux-2.6.8-rc2/include/asm-sparc/pci.h linux-2.6.8-rc3/include/asm-sparc/pci.h
--- linux-2.6.8-rc2/include/asm-sparc/pci.h	2004-08-03 15:21:13.739783587 -0700
+++ linux-2.6.8-rc3/include/asm-sparc/pci.h	2004-08-03 15:22:10.411108395 -0700
@@ -87,12 +87,6 @@
 extern void pci_unmap_page(struct pci_dev *hwdev,
 			dma_addr_t dma_address, size_t size, int direction);
 
-/* map_page and map_single cannot fail */
-static inline int pci_dma_mapping_error(dma_addr_t dma_addr)
-{
-	return 0;
-}
-
 /* Map a set of buffers described by scatterlist in streaming
  * mode for DMA.  This is the scather-gather version of the
  * above pci_map_single interface.  Here the scatter gather list
@@ -154,6 +148,13 @@
 {
 }
 
+#define PCI_DMA_ERROR_CODE      (~(dma_addr_t)0x0)
+
+static inline int pci_dma_mapping_error(dma_addr_t dma_addr)
+{
+        return (dma_addr == PCI_DMA_ERROR_CODE);
+}
+
 #endif /* __KERNEL__ */
 
 /* generic pci stuff */
diff -urN linux-2.6.8-rc2/include/asm-sparc64/fbio.h linux-2.6.8-rc3/include/asm-sparc64/fbio.h
--- linux-2.6.8-rc2/include/asm-sparc64/fbio.h	2004-06-15 22:18:37.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-sparc64/fbio.h	2004-08-03 15:22:10.884127800 -0700
@@ -1,6 +1,8 @@
 #ifndef __LINUX_FBIO_H
 #define __LINUX_FBIO_H
 
+#include <linux/compiler.h>
+
 /* Constants used for fbio SunOS compatibility */
 /* (C) 1996 Miguel de Icaza */
 
@@ -56,9 +58,9 @@
 struct  fbcmap {
         int             index;          /* first element (0 origin) */
         int             count;
-        unsigned char   *red;
-        unsigned char   *green;
-        unsigned char   *blue;
+        unsigned char   __user *red;
+        unsigned char   __user *green;
+        unsigned char   __user *blue;
 };
 
 #ifdef __KERNEL__
diff -urN linux-2.6.8-rc2/include/asm-sparc64/floppy.h linux-2.6.8-rc3/include/asm-sparc64/floppy.h
--- linux-2.6.8-rc2/include/asm-sparc64/floppy.h	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-sparc64/floppy.h	2004-08-03 15:22:10.890128046 -0700
@@ -164,7 +164,7 @@
 volatile int doing_pdma = 0;
 
 /* This is software state */
-char *pdma_base = 0;
+char *pdma_base = NULL;
 unsigned long pdma_areasize;
 
 /* Common routines to all controller types on the Sparc. */
@@ -173,7 +173,7 @@
 	doing_pdma = 0;
 	if (pdma_base) {
 		mmu_unlockarea(pdma_base, pdma_areasize);
-		pdma_base = 0;
+		pdma_base = NULL;
 	}
 }
 
@@ -613,7 +613,7 @@
 	} else {
 #ifdef CONFIG_PCI
 		struct linux_ebus *ebus;
-		struct linux_ebus_device *edev = 0;
+		struct linux_ebus_device *edev = NULL;
 		unsigned long config = 0;
 		unsigned long auxio_reg;
 
diff -urN linux-2.6.8-rc2/include/asm-sparc64/openpromio.h linux-2.6.8-rc3/include/asm-sparc64/openpromio.h
--- linux-2.6.8-rc2/include/asm-sparc64/openpromio.h	2004-08-03 15:21:13.753784162 -0700
+++ linux-2.6.8-rc3/include/asm-sparc64/openpromio.h	2004-08-03 15:22:10.894128210 -0700
@@ -1,6 +1,7 @@
 #ifndef	_SPARC64_OPENPROMIO_H
 #define	_SPARC64_OPENPROMIO_H
 
+#include <linux/compiler.h>
 #include <linux/ioctl.h>
 #include <linux/types.h>
 
diff -urN linux-2.6.8-rc2/include/asm-sparc64/page.h linux-2.6.8-rc3/include/asm-sparc64/page.h
--- linux-2.6.8-rc2/include/asm-sparc64/page.h	2004-08-03 15:21:13.754784203 -0700
+++ linux-2.6.8-rc3/include/asm-sparc64/page.h	2004-08-03 15:22:10.895128251 -0700
@@ -18,7 +18,7 @@
 #define clear_page(X)	_clear_page((void *)(X))
 struct page;
 extern void clear_user_page(void *addr, unsigned long vaddr, struct page *page);
-#define copy_page(X,Y)	__memcpy((void *)(X), (void *)(Y), PAGE_SIZE)
+#define copy_page(X,Y)	memcpy((void *)(X), (void *)(Y), PAGE_SIZE)
 extern void copy_user_page(void *to, void *from, unsigned long vaddr, struct page *topage);
 
 /* GROSS, defining this makes gcc pass these types as aggregates,
diff -urN linux-2.6.8-rc2/include/asm-sparc64/siginfo.h linux-2.6.8-rc3/include/asm-sparc64/siginfo.h
--- linux-2.6.8-rc2/include/asm-sparc64/siginfo.h	2004-06-15 22:19:43.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-sparc64/siginfo.h	2004-08-03 15:22:10.914129030 -0700
@@ -14,8 +14,11 @@
 
 #ifdef __KERNEL__
 
+#include <linux/config.h>
 #include <linux/compat.h>
 
+#ifdef CONFIG_COMPAT
+
 typedef union sigval32 {
 	int sival_int;
 	u32 sival_ptr;
@@ -72,6 +75,7 @@
 		} _sigpoll;
 	} _sifields;
 } siginfo_t32;
+#endif /* CONFIG_COMPAT */
 
 #endif /* __KERNEL__ */
 
@@ -85,6 +89,8 @@
 
 #ifdef __KERNEL__
 
+#ifdef CONFIG_COMPAT
+
 typedef struct sigevent32 {
 	sigval_t32 sigev_value;
 	int sigev_signo;
@@ -101,6 +107,8 @@
 
 extern int copy_siginfo_to_user32(siginfo_t32 __user *to, siginfo_t *from);
 
+#endif /* CONFIG_COMPAT */
+
 #endif /* __KERNEL__ */
 
 #endif
diff -urN linux-2.6.8-rc2/include/asm-sparc64/signal.h linux-2.6.8-rc3/include/asm-sparc64/signal.h
--- linux-2.6.8-rc2/include/asm-sparc64/signal.h	2004-08-03 15:21:13.757784326 -0700
+++ linux-2.6.8-rc3/include/asm-sparc64/signal.h	2004-08-03 15:22:10.916129112 -0700
@@ -6,6 +6,7 @@
 
 #ifdef __KERNEL__
 #ifndef __ASSEMBLY__
+#include <linux/config.h>
 #include <linux/personality.h>
 #include <linux/types.h>
 #include <linux/compat.h>
@@ -208,12 +209,15 @@
 };
 
 #ifdef __KERNEL__
+
+#ifdef CONFIG_COMPAT
 struct __new_sigaction32 {
 	unsigned		sa_handler;
 	unsigned int    	sa_flags;
 	unsigned		sa_restorer;     /* not used by Linux/SPARC yet */
 	compat_sigset_t 	sa_mask;
 };
+#endif
 
 struct k_sigaction {
 	struct __new_sigaction 	sa;
@@ -229,6 +233,8 @@
 };
 
 #ifdef __KERNEL__
+
+#ifdef CONFIG_COMPAT
 struct __old_sigaction32 {
 	unsigned		sa_handler;
 	compat_old_sigset_t  	sa_mask;
@@ -237,6 +243,8 @@
 };
 #endif
 
+#endif
+
 typedef struct sigaltstack {
 	void			__user *ss_sp;
 	int			ss_flags;
@@ -244,11 +252,14 @@
 } stack_t;
 
 #ifdef __KERNEL__
+
+#ifdef CONFIG_COMPAT
 typedef struct sigaltstack32 {
 	u32			ss_sp;
 	int			ss_flags;
 	compat_size_t		ss_size;
 } stack_t32;
+#endif
 
 struct signal_deliver_cookie {
 	int restart_syscall;
diff -urN linux-2.6.8-rc2/include/asm-sparc64/spinlock.h linux-2.6.8-rc3/include/asm-sparc64/spinlock.h
--- linux-2.6.8-rc2/include/asm-sparc64/spinlock.h	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-sparc64/spinlock.h	2004-08-03 15:22:10.917129153 -0700
@@ -41,22 +41,8 @@
 do {	membar("#LoadLoad");	\
 } while(*((volatile unsigned char *)lock))
 
-static __inline__ void _raw_spin_lock(spinlock_t *lock)
-{
-	__asm__ __volatile__(
-"1:	ldstub		[%0], %%g7\n"
-"	brnz,pn		%%g7, 2f\n"
-"	 membar		#StoreLoad | #StoreStore\n"
-"	.subsection	2\n"
-"2:	ldub		[%0], %%g7\n"
-"	brnz,pt		%%g7, 2b\n"
-"	 membar		#LoadLoad\n"
-"	b,a,pt		%%xcc, 1b\n"
-"	.previous\n"
-	: /* no outputs */
-	: "r" (lock)
-	: "g7", "memory");
-}
+/* arch/sparc64/lib/spinlock.S */
+extern void _raw_spin_lock(spinlock_t *lock);
 
 static __inline__ int _raw_spin_trylock(spinlock_t *lock)
 {
diff -urN linux-2.6.8-rc2/include/asm-sparc64/string.h linux-2.6.8-rc3/include/asm-sparc64/string.h
--- linux-2.6.8-rc2/include/asm-sparc64/string.h	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-sparc64/string.h	2004-08-03 15:22:10.918129194 -0700
@@ -16,9 +16,7 @@
 #include <asm/asi.h>
 
 extern void __memmove(void *,const void *,__kernel_size_t);
-extern __kernel_size_t __memcpy(void *,const void *,__kernel_size_t);
 extern void *__memset(void *,int,__kernel_size_t);
-extern void *__builtin_memcpy(void *,const void *,__kernel_size_t);
 extern void *__builtin_memset(void *,int,__kernel_size_t);
 
 #ifndef EXPORT_SYMTAB_STROPS
@@ -37,29 +35,7 @@
 
 #define __HAVE_ARCH_MEMCPY
 
-static inline void *__constant_memcpy(void *to, const void *from, __kernel_size_t n)
-{
-	if(n) {
-		if(n <= 32) {
-			__builtin_memcpy(to, from, n);
-		} else {
-			__memcpy(to, from, n);
-		}
-	}
-	return to;
-}
-
-static inline void *__nonconstant_memcpy(void *to, const void *from, __kernel_size_t n)
-{
-	__memcpy(to, from, n);
-	return to;
-}
-
-#undef memcpy
-#define memcpy(t, f, n) \
-(__builtin_constant_p(n) ? \
- __constant_memcpy((t),(f),(n)) : \
- __nonconstant_memcpy((t),(f),(n)))
+extern void * memcpy(void *,const void *,__kernel_size_t);
 
 #define __HAVE_ARCH_MEMSET
 
diff -urN linux-2.6.8-rc2/include/asm-sparc64/ttable.h linux-2.6.8-rc3/include/asm-sparc64/ttable.h
--- linux-2.6.8-rc2/include/asm-sparc64/ttable.h	2004-06-15 22:18:56.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-sparc64/ttable.h	2004-08-03 15:22:10.918129194 -0700
@@ -123,7 +123,11 @@
 #else
 #define SUNOS_SYSCALL_TRAP TRAP(sunos_syscall)
 #endif
+#ifdef CONFIG_COMPAT
 #define	LINUX_32BIT_SYSCALL_TRAP SYSCALL_TRAP(linux_sparc_syscall32, sys_call_table32)
+#else
+#define	LINUX_32BIT_SYSCALL_TRAP BTRAP(0x110)
+#endif
 #define LINUX_64BIT_SYSCALL_TRAP SYSCALL_TRAP(linux_sparc_syscall, sys_call_table64)
 #define GETCC_TRAP TRAP(getcc)
 #define SETCC_TRAP TRAP(setcc)
diff -urN linux-2.6.8-rc2/include/asm-v850/bitops.h linux-2.6.8-rc3/include/asm-v850/bitops.h
--- linux-2.6.8-rc2/include/asm-v850/bitops.h	2004-08-03 15:21:13.761784490 -0700
+++ linux-2.6.8-rc3/include/asm-v850/bitops.h	2004-08-03 15:22:11.029133748 -0700
@@ -267,6 +267,12 @@
 	return result + generic_ffs_for_find_next_bit(tmp);
 }
 
+/*
+ * find_first_bit - find the first set bit in a memory region
+ */
+#define find_first_bit(addr, size) \
+	find_next_bit((addr), (size), 0)
+
 
 #define ffs(x) generic_ffs (x)
 #define fls(x) generic_fls (x)
diff -urN linux-2.6.8-rc2/include/asm-x86_64/compat.h linux-2.6.8-rc3/include/asm-x86_64/compat.h
--- linux-2.6.8-rc2/include/asm-x86_64/compat.h	2004-06-15 22:19:43.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-x86_64/compat.h	2004-08-03 15:22:11.193140476 -0700
@@ -118,7 +118,7 @@
 typedef u32               compat_sigset_word;
 
 #define COMPAT_OFF_T_MAX	0x7fffffff
-#define COMPAT_LOFF_T_MAX	0x7fffffffffffffff
+#define COMPAT_LOFF_T_MAX	0x7fffffffffffffffL
 
 struct compat_ipc64_perm {
 	compat_key_t key;
diff -urN linux-2.6.8-rc2/include/asm-x86_64/io_apic.h linux-2.6.8-rc3/include/asm-x86_64/io_apic.h
--- linux-2.6.8-rc2/include/asm-x86_64/io_apic.h	2004-06-15 22:18:58.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-x86_64/io_apic.h	2004-08-03 15:22:11.231142035 -0700
@@ -13,7 +13,7 @@
 
 #ifdef CONFIG_X86_IO_APIC
 
-#ifdef CONFIG_PCI_USE_VECTOR
+#ifdef CONFIG_PCI_MSI
 static inline int use_pci_vector(void)	{return 1;}
 static inline void disable_edge_ioapic_vector(unsigned int vector) { }
 static inline void mask_and_ack_level_ioapic_vector(unsigned int vector) { }
diff -urN linux-2.6.8-rc2/include/asm-x86_64/irq.h linux-2.6.8-rc3/include/asm-x86_64/irq.h
--- linux-2.6.8-rc2/include/asm-x86_64/irq.h	2004-06-15 22:18:37.000000000 -0700
+++ linux-2.6.8-rc3/include/asm-x86_64/irq.h	2004-08-03 15:22:11.273143758 -0700
@@ -31,7 +31,7 @@
 
 #define FIRST_SYSTEM_VECTOR	0xef   /* duplicated in hw_irq.h */
 
-#ifdef CONFIG_PCI_USE_VECTOR
+#ifdef CONFIG_PCI_MSI
 #define NR_IRQS FIRST_SYSTEM_VECTOR
 #define NR_IRQ_VECTORS NR_IRQS
 #else
diff -urN linux-2.6.8-rc2/include/asm-x86_64/mpspec.h linux-2.6.8-rc3/include/asm-x86_64/mpspec.h
--- linux-2.6.8-rc2/include/asm-x86_64/mpspec.h	2004-08-03 15:21:13.885789577 -0700
+++ linux-2.6.8-rc3/include/asm-x86_64/mpspec.h	2004-08-03 15:22:11.273143758 -0700
@@ -166,7 +166,7 @@
 };
 extern unsigned char mp_bus_id_to_type [MAX_MP_BUSSES];
 extern int mp_bus_id_to_pci_bus [MAX_MP_BUSSES];
-extern cpumask_t mp_bus_to_cpumask [MAX_MP_BUSSES];
+extern cpumask_t pci_bus_to_cpumask [256];
 
 extern unsigned int boot_cpu_physical_apicid;
 extern int smp_found_config;
diff -urN linux-2.6.8-rc2/include/asm-x86_64/topology.h linux-2.6.8-rc3/include/asm-x86_64/topology.h
--- linux-2.6.8-rc2/include/asm-x86_64/topology.h	2004-08-03 15:21:13.961792695 -0700
+++ linux-2.6.8-rc3/include/asm-x86_64/topology.h	2004-08-03 15:22:11.326145932 -0700
@@ -22,9 +22,9 @@
 
 static inline cpumask_t pcibus_to_cpumask(int bus)
 {
-	cpumask_t tmp;
-	cpus_and(tmp, mp_bus_to_cpumask[bus], cpu_online_map);
-	return tmp;
+	cpumask_t res;
+	cpus_and(res,  pci_bus_to_cpumask[bus], cpu_online_map);
+	return res;
 }
 
 #define NODE_BALANCE_RATE 30	/* CHECKME */ 
diff -urN linux-2.6.8-rc2/include/asm-x86_64/uaccess.h linux-2.6.8-rc3/include/asm-x86_64/uaccess.h
--- linux-2.6.8-rc2/include/asm-x86_64/uaccess.h	2004-08-03 15:21:13.962792736 -0700
+++ linux-2.6.8-rc3/include/asm-x86_64/uaccess.h	2004-08-03 15:22:11.327145973 -0700
@@ -148,7 +148,7 @@
 #define __put_user_check(x,ptr,size)			\
 ({							\
 	int __pu_err = -EFAULT;				\
-	__typeof__(*(ptr)) *__pu_addr = (ptr);		\
+	__typeof__(*(ptr)) __user *__pu_addr = (ptr);	\
 	if (likely(access_ok(VERIFY_WRITE,__pu_addr,size)))	\
 		__put_user_size((x),__pu_addr,(size),__pu_err);	\
 	__pu_err;					\
diff -urN linux-2.6.8-rc2/include/linux/acct.h linux-2.6.8-rc3/include/linux/acct.h
--- linux-2.6.8-rc2/include/linux/acct.h	2004-08-03 15:21:13.965792859 -0700
+++ linux-2.6.8-rc3/include/linux/acct.h	2004-08-03 15:22:11.400148968 -0700
@@ -17,6 +17,7 @@
 
 #include <linux/types.h>
 #include <asm/param.h>
+#include <asm/byteorder.h>
 
 /* 
  *  comp_t is a 16-bit "floating" point number with a 3-bit base 8
@@ -104,7 +105,12 @@
 #define ACOMPAT		0x04	/* ... used compatibility mode (VAX only not used) */
 #define ACORE		0x08	/* ... dumped core */
 #define AXSIG		0x10	/* ... was killed by a signal */
-#define ABYTESEX	0x80	/* always set, allows to detect byteorder */
+
+#ifdef __BIG_ENDIAN
+#define ACCT_BYTEORDER	0x80	/* accounting file is big endian */
+#else
+#define ACCT_BYTEORDER	0x00	/* accounting file is little endian */
+#endif
 
 #ifdef __KERNEL__
 
diff -urN linux-2.6.8-rc2/include/linux/ata.h linux-2.6.8-rc3/include/linux/ata.h
--- linux-2.6.8-rc2/include/linux/ata.h	2004-08-03 15:21:13.998794213 -0700
+++ linux-2.6.8-rc3/include/linux/ata.h	2004-08-03 15:22:11.572156024 -0700
@@ -209,8 +209,8 @@
 #define ata_id_has_lba48(dev)	((dev)->id[83] & (1 << 10))
 #define ata_id_has_wcache(dev)	((dev)->id[82] & (1 << 5))
 #define ata_id_has_pm(dev)	((dev)->id[82] & (1 << 3))
-#define ata_id_has_lba(dev)	((dev)->id[49] & (1 << 8))
-#define ata_id_has_dma(dev)	((dev)->id[49] & (1 << 9))
+#define ata_id_has_lba(dev)	((dev)->id[49] & (1 << 9))
+#define ata_id_has_dma(dev)	((dev)->id[49] & (1 << 8))
 #define ata_id_removeable(dev)	((dev)->id[0] & (1 << 7))
 #define ata_id_u32(dev,n)	\
 	(((u32) (dev)->id[(n) + 1] << 16) | ((u32) (dev)->id[(n)]))
diff -urN linux-2.6.8-rc2/include/linux/atmdev.h linux-2.6.8-rc3/include/linux/atmdev.h
--- linux-2.6.8-rc2/include/linux/atmdev.h	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/include/linux/atmdev.h	2004-08-03 15:22:11.674160208 -0700
@@ -147,7 +147,7 @@
 
 struct atm_iobuf {
 	int length;
-	void *buffer;
+	void __user *buffer;
 };
 
 /* for ATM_GETCIRANGE / ATM_SETCIRANGE */
@@ -155,8 +155,8 @@
 #define ATM_CI_MAX      -1              /* use maximum range of VPI/VCI */
  
 struct atm_cirange {
-	char	vpi_bits;		/* 1..8, ATM_CI_MAX (-1) for maximum */
-	char	vci_bits;		/* 1..16, ATM_CI_MAX (-1) for maximum */
+	signed char	vpi_bits;	/* 1..8, ATM_CI_MAX (-1) for maximum */
+	signed char	vci_bits;	/* 1..16, ATM_CI_MAX (-1) for maximum */
 };
 
 /* for ATM_SETSC; actually taken from the ATM_VF number space */
diff -urN linux-2.6.8-rc2/include/linux/atmlec.h linux-2.6.8-rc3/include/linux/atmlec.h
--- linux-2.6.8-rc2/include/linux/atmlec.h	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/include/linux/atmlec.h	2004-08-03 15:22:11.708161603 -0700
@@ -2,7 +2,7 @@
  * 
  * ATM Lan Emulation Daemon vs. driver interface
  *
- * carnil@cs.tut.fi
+ * mkiiskila@yahoo.com
  *
  */
 
diff -urN linux-2.6.8-rc2/include/linux/bio.h linux-2.6.8-rc3/include/linux/bio.h
--- linux-2.6.8-rc2/include/linux/bio.h	2004-08-03 15:21:14.037795813 -0700
+++ linux-2.6.8-rc3/include/linux/bio.h	2004-08-03 15:22:11.720162095 -0700
@@ -120,6 +120,7 @@
 #define BIO_SEG_VALID	3	/* nr_hw_seg valid */
 #define BIO_CLONED	4	/* doesn't own data */
 #define BIO_BOUNCED	5	/* bio is a bounce bio */
+#define BIO_USER_MAPPED 6	/* contains user pages */
 #define bio_flagged(bio, flag)	((bio)->bi_flags & (1 << (flag)))
 
 /*
@@ -264,9 +265,11 @@
 extern int bio_get_nr_vecs(struct block_device *);
 extern struct bio *bio_map_user(struct request_queue *, struct block_device *,
 				unsigned long, unsigned int, int);
-extern void bio_unmap_user(struct bio *, int);
+extern void bio_unmap_user(struct bio *);
 extern void bio_set_pages_dirty(struct bio *bio);
 extern void bio_check_pages_dirty(struct bio *bio);
+extern struct bio *bio_copy_user(struct request_queue *, unsigned long, unsigned int, int);
+extern int bio_uncopy_user(struct bio *);
 
 #ifdef CONFIG_HIGHMEM
 /*
diff -urN linux-2.6.8-rc2/include/linux/blkdev.h linux-2.6.8-rc3/include/linux/blkdev.h
--- linux-2.6.8-rc2/include/linux/blkdev.h	2004-08-03 15:21:14.085797782 -0700
+++ linux-2.6.8-rc3/include/linux/blkdev.h	2004-08-03 15:22:11.798165295 -0700
@@ -524,7 +524,7 @@
 extern void blk_run_queue(request_queue_t *);
 extern void blk_queue_activity_fn(request_queue_t *, activity_fn *, void *);
 extern struct request *blk_rq_map_user(request_queue_t *, int, void __user *, unsigned int);
-extern int blk_rq_unmap_user(struct request *, void __user *, struct bio *, unsigned int);
+extern int blk_rq_unmap_user(struct request *, struct bio *, unsigned int);
 extern int blk_execute_rq(request_queue_t *, struct gendisk *, struct request *);
 
 static inline request_queue_t *bdev_get_queue(struct block_device *bdev)
diff -urN linux-2.6.8-rc2/include/linux/console.h linux-2.6.8-rc3/include/linux/console.h
--- linux-2.6.8-rc2/include/linux/console.h	2004-08-03 15:21:14.091798028 -0700
+++ linux-2.6.8-rc3/include/linux/console.h	2004-08-03 15:22:12.003173705 -0700
@@ -19,6 +19,7 @@
 
 struct vc_data;
 struct console_font_op;
+struct console_font;
 struct module;
 
 /*
@@ -40,7 +41,10 @@
 	void	(*con_bmove)(struct vc_data *, int, int, int, int, int, int);
 	int	(*con_switch)(struct vc_data *);
 	int	(*con_blank)(struct vc_data *, int, int);
-	int	(*con_font_op)(struct vc_data *, struct console_font_op *);
+	int	(*con_font_set)(struct vc_data *, struct console_font *, unsigned);
+	int	(*con_font_get)(struct vc_data *, struct console_font *);
+	int	(*con_font_default)(struct vc_data *, struct console_font *, char *);
+	int	(*con_font_copy)(struct vc_data *, int);
 	int	(*con_resize)(struct vc_data *, unsigned int, unsigned int);
 	int	(*con_set_palette)(struct vc_data *, unsigned char *);
 	int	(*con_scrolldelta)(struct vc_data *, int);
diff -urN linux-2.6.8-rc2/include/linux/console_struct.h linux-2.6.8-rc3/include/linux/console_struct.h
--- linux-2.6.8-rc2/include/linux/console_struct.h	2004-06-15 22:18:38.000000000 -0700
+++ linux-2.6.8-rc3/include/linux/console_struct.h	2004-08-03 15:22:12.004173746 -0700
@@ -40,7 +40,7 @@
 	unsigned long	vc_pos;			/* Cursor address */
 	/* fonts */	
 	unsigned short	vc_hi_font_mask;	/* [#] Attribute set for upper 256 chars of font or 0 if not supported */
-	struct console_font_op vc_font;		/* Current VC font set */
+	struct console_font vc_font;		/* Current VC font set */
 	unsigned short	vc_video_erase_char;	/* Background erase character */
 	/* VT terminal data */
 	unsigned int	vc_state;		/* Escape sequence parser state */
diff -urN linux-2.6.8-rc2/include/linux/elf.h linux-2.6.8-rc3/include/linux/elf.h
--- linux-2.6.8-rc2/include/linux/elf.h	2004-06-15 22:18:59.000000000 -0700
+++ linux-2.6.8-rc3/include/linux/elf.h	2004-08-03 15:22:12.243183551 -0700
@@ -4,6 +4,13 @@
 #include <linux/types.h>
 #include <asm/elf.h>
 
+#ifndef elf_read_implies_exec
+  /* Executables for which elf_read_implies_exec() returns TRUE will
+     have the READ_IMPLIES_EXEC personality flag set automatically.
+     Override in asm/elf.h as needed.  */
+# define elf_read_implies_exec(ex, have_pt_gnu_stack)	0
+#endif
+
 /* 32-bit ELF base types. */
 typedef __u32	Elf32_Addr;
 typedef __u16	Elf32_Half;
diff -urN linux-2.6.8-rc2/include/linux/fb.h linux-2.6.8-rc3/include/linux/fb.h
--- linux-2.6.8-rc2/include/linux/fb.h	2004-08-03 15:21:14.122799300 -0700
+++ linux-2.6.8-rc3/include/linux/fb.h	2004-08-03 15:22:12.263184371 -0700
@@ -16,7 +16,11 @@
 #define FBIOGETCMAP		0x4604
 #define FBIOPUTCMAP		0x4605
 #define FBIOPAN_DISPLAY		0x4606
+#ifdef __KERNEL__
+#define FBIO_CURSOR            _IOWR('F', 0x08, struct fb_cursor_user)
+#else
 #define FBIO_CURSOR            _IOWR('F', 0x08, struct fb_cursor)
+#endif
 /* 0x4607-0x460B are defined below */
 /* #define FBIOGET_MONITORSPEC	0x460C */
 /* #define FBIOPUT_MONITORSPEC	0x460D */
@@ -397,6 +401,36 @@
 struct device;
 struct file;
 
+struct fb_cmap_user {
+	__u32 start;			/* First entry	*/
+	__u32 len;			/* Number of entries */
+	__u16 __user *red;		/* Red values	*/
+	__u16 __user *green;
+	__u16 __user *blue;
+	__u16 __user *transp;		/* transparency, can be NULL */
+};
+
+struct fb_image_user {
+	__u32 dx;			/* Where to place image */
+	__u32 dy;
+	__u32 width;			/* Size of image */
+	__u32 height;
+	__u32 fg_color;			/* Only used when a mono bitmap */
+	__u32 bg_color;
+	__u8  depth;			/* Depth of the image */
+	const char __user *data;	/* Pointer to image data */
+	struct fb_cmap_user cmap;	/* color map info */
+};
+
+struct fb_cursor_user {
+	__u16 set;			/* what to set */
+	__u16 enable;			/* cursor on/off */
+	__u16 rop;			/* bitop operation */
+	const char __user *mask;	/* cursor mask bits */
+	struct fbcurpos hot;		/* cursor hot spot */
+	struct fb_image_user image;	/* Cursor image */
+};
+
 /*
  * Register/unregister for framebuffer events
  */
@@ -696,8 +730,10 @@
 /* drivers/video/fbcmap.c */
 extern int fb_alloc_cmap(struct fb_cmap *cmap, int len, int transp);
 extern void fb_dealloc_cmap(struct fb_cmap *cmap);
-extern int fb_copy_cmap(struct fb_cmap *from, struct fb_cmap *to, int fsfromto);
-extern int fb_set_cmap(struct fb_cmap *cmap, int kspc, struct fb_info *fb_info);
+extern int fb_copy_cmap(struct fb_cmap *from, struct fb_cmap *to);
+extern int fb_cmap_to_user(struct fb_cmap *from, struct fb_cmap_user *to);
+extern int fb_set_cmap(struct fb_cmap *cmap, struct fb_info *fb_info);
+extern int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *fb_info);
 extern struct fb_cmap *fb_default_cmap(int len);
 extern void fb_invert_cmaps(void);
 
diff -urN linux-2.6.8-rc2/include/linux/fs.h linux-2.6.8-rc3/include/linux/fs.h
--- linux-2.6.8-rc2/include/linux/fs.h	2004-08-03 15:21:14.125799423 -0700
+++ linux-2.6.8-rc3/include/linux/fs.h	2004-08-03 15:22:12.280185069 -0700
@@ -356,6 +356,7 @@
 	struct block_device *	bd_contains;
 	unsigned		bd_block_size;
 	struct hd_struct *	bd_part;
+	/* number of times partitions within this device have been opened. */
 	unsigned		bd_part_count;
 	int			bd_invalidated;
 	struct gendisk *	bd_disk;
diff -urN linux-2.6.8-rc2/include/linux/generic_serial.h linux-2.6.8-rc3/include/linux/generic_serial.h
--- linux-2.6.8-rc2/include/linux/generic_serial.h	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/include/linux/generic_serial.h	2004-08-03 15:22:12.284185233 -0700
@@ -88,8 +88,8 @@
 void gs_set_termios (struct tty_struct * tty, 
                      struct termios * old_termios);
 int  gs_init_port(struct gs_port *port);
-int  gs_setserial(struct gs_port *port, struct serial_struct *sp);
-int  gs_getserial(struct gs_port *port, struct serial_struct *sp);
+int  gs_setserial(struct gs_port *port, struct serial_struct __user *sp);
+int  gs_getserial(struct gs_port *port, struct serial_struct __user *sp);
 void gs_got_break(struct gs_port *port);
 
 extern int gs_debug;
diff -urN linux-2.6.8-rc2/include/linux/genhd.h linux-2.6.8-rc3/include/linux/genhd.h
--- linux-2.6.8-rc2/include/linux/genhd.h	2004-06-15 22:18:59.000000000 -0700
+++ linux-2.6.8-rc3/include/linux/genhd.h	2004-08-03 15:22:12.285185274 -0700
@@ -82,7 +82,8 @@
 struct gendisk {
 	int major;			/* major number of driver */
 	int first_minor;
-	int minors;
+	int minors;                     /* maximum number of minors, =1 for
+                                         * disks that can't be partitioned. */
 	char disk_name[32];		/* name of major driver */
 	struct hd_struct **part;	/* [indexed by minor] */
 	struct block_device_operations *fops;
diff -urN linux-2.6.8-rc2/include/linux/icmpv6.h linux-2.6.8-rc3/include/linux/icmpv6.h
--- linux-2.6.8-rc2/include/linux/icmpv6.h	2004-06-15 22:19:02.000000000 -0700
+++ linux-2.6.8-rc3/include/linux/icmpv6.h	2004-08-03 15:22:12.438191550 -0700
@@ -86,17 +86,15 @@
 #define ICMPV6_MGM_REPORT       	131
 #define ICMPV6_MGM_REDUCTION    	132
 
-/* definitions for MLDv2 */
-
-#define MLD2_MODE_IS_INCLUDE	1
-#define MLD2_MODE_IS_EXCLUDE	2
-#define MLD2_CHANGE_TO_INCLUDE	3
-#define MLD2_CHANGE_TO_EXCLUDE	4
-#define MLD2_ALLOW_NEW_SOURCES	5
-#define MLD2_BLOCK_OLD_SOURCES	6
+#define ICMPV6_NI_QUERY			139
+#define ICMPV6_NI_REPLY			140
 
 #define ICMPV6_MLD2_REPORT		143
-#define MLD2_ALL_MCR_INIT { { { 0xff,0x02,0,0,0,0,0,0,0,0,0,0,0,0,0,0x16 } } }
+
+#define ICMPV6_DHAAD_REQUEST		144
+#define ICMPV6_DHAAD_REPLY		145
+#define ICMPV6_MOBILE_PREFIX_SOL	146
+#define ICMPV6_MOBILE_PREFIX_ADV	147
 
 /*
  *	Codes for Destination Unreachable
@@ -139,6 +137,18 @@
 	__u32		data[8];
 };
 
+/*
+ *	Definitions for MLDv2
+ */
+#define MLD2_MODE_IS_INCLUDE	1
+#define MLD2_MODE_IS_EXCLUDE	2
+#define MLD2_CHANGE_TO_INCLUDE	3
+#define MLD2_CHANGE_TO_EXCLUDE	4
+#define MLD2_ALLOW_NEW_SOURCES	5
+#define MLD2_BLOCK_OLD_SOURCES	6
+
+#define MLD2_ALL_MCR_INIT { { { 0xff,0x02,0,0,0,0,0,0,0,0,0,0,0,0,0,0x16 } } }
+
 #ifdef __KERNEL__
 
 #include <linux/netdevice.h>
diff -urN linux-2.6.8-rc2/include/linux/ipmi.h linux-2.6.8-rc3/include/linux/ipmi.h
--- linux-2.6.8-rc2/include/linux/ipmi.h	2004-08-03 15:21:14.165801064 -0700
+++ linux-2.6.8-rc3/include/linux/ipmi.h	2004-08-03 15:22:12.522194996 -0700
@@ -159,6 +159,14 @@
 	unsigned char  netfn;
 	unsigned char  cmd;
 	unsigned short data_len;
+	unsigned char  __user *data;
+};
+
+struct kernel_ipmi_msg
+{
+	unsigned char  netfn;
+	unsigned char  cmd;
+	unsigned short data_len;
 	unsigned char  *data;
 };
 
@@ -223,7 +231,7 @@
 	ipmi_user_t      user;
 	struct ipmi_addr addr;
 	long             msgid;
-	struct ipmi_msg  msg;
+	struct kernel_ipmi_msg  msg;
 
 	/* The user_msg_data is the data supplied when a message was
 	   sent, if this is a response to a sent message.  If this is
@@ -316,7 +324,7 @@
 int ipmi_request(ipmi_user_t      user,
 		 struct ipmi_addr *addr,
 		 long             msgid,
-		 struct ipmi_msg  *msg,
+		 struct kernel_ipmi_msg *msg,
 		 void             *user_msg_data,
 		 int              priority);
 
@@ -336,7 +344,7 @@
 int ipmi_request_settime(ipmi_user_t      user,
 			 struct ipmi_addr *addr,
 			 long             msgid,
-			 struct ipmi_msg  *msg,
+			 struct kernel_ipmi_msg  *msg,
 			 void             *user_msg_data,
 			 int              priority,
 			 int              max_retries,
@@ -348,7 +356,7 @@
 int ipmi_request_with_source(ipmi_user_t      user,
 			     struct ipmi_addr *addr,
 			     long             msgid,
-			     struct ipmi_msg  *msg,
+			     struct kernel_ipmi_msg  *msg,
 			     void             *user_msg_data,
 			     int              priority,
 			     unsigned char    source_address,
@@ -366,7 +374,7 @@
 int ipmi_request_supply_msgs(ipmi_user_t          user,
 			     struct ipmi_addr     *addr,
 			     long                 msgid,
-			     struct ipmi_msg      *msg,
+			     struct kernel_ipmi_msg *msg,
 			     void                 *user_msg_data,
 			     void                 *supplied_smi,
 			     struct ipmi_recv_msg *supplied_recv,
diff -urN linux-2.6.8-rc2/include/linux/kd.h linux-2.6.8-rc3/include/linux/kd.h
--- linux-2.6.8-rc2/include/linux/kd.h	2004-06-15 22:19:44.000000000 -0700
+++ linux-2.6.8-rc3/include/linux/kd.h	2004-08-03 15:22:12.654200412 -0700
@@ -149,6 +149,12 @@
 	unsigned int flags;	/* KD_FONT_FLAG_* */
 	unsigned int width, height;	/* font size */
 	unsigned int charcount;
+	unsigned char __user *data;	/* font data with height fixed to 32 */
+};
+
+struct console_font {
+	unsigned int width, height;	/* font size */
+	unsigned int charcount;
 	unsigned char *data;	/* font data with height fixed to 32 */
 };
 
diff -urN linux-2.6.8-rc2/include/linux/list.h linux-2.6.8-rc3/include/linux/list.h
--- linux-2.6.8-rc2/include/linux/list.h	2004-08-03 15:21:14.305806808 -0700
+++ linux-2.6.8-rc3/include/linux/list.h	2004-08-03 15:22:12.750204350 -0700
@@ -620,13 +620,12 @@
 
 #define hlist_entry(ptr, type, member) container_of(ptr,type,member)
 
-/* Cannot easily do prefetch unfortunately */
 #define hlist_for_each(pos, head) \
 	for (pos = (head)->first; pos && ({ prefetch(pos->next); 1; }); \
 	     pos = pos->next)
 
 #define hlist_for_each_safe(pos, n, head) \
-	for (pos = (head)->first; n = pos ? pos->next : NULL, pos; \
+	for (pos = (head)->first; pos && ({ n = pos->next; 1; }); \
 	     pos = n)
 
 /**
@@ -678,6 +677,24 @@
 	     pos && ({ n = pos->next; 1; }) && 				 \
 		({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \
 	     pos = n)
+
+/**
+ * hlist_for_each_entry_rcu - iterate over rcu list of given type
+ * @pos:	the type * to use as a loop counter.
+ * @pos:	the &struct hlist_node to use as a loop counter.
+ * @head:	the head for your list.
+ * @member:	the name of the hlist_node within the struct.
+ *
+ * This list-traversal primitive may safely run concurrently with
+ * the _rcu list-mutation primitives such as hlist_add_rcu()
+ * as long as the traversal is guarded by rcu_read_lock().
+ */
+#define hlist_for_each_entry_rcu(tpos, pos, head, member)		 \
+	for (pos = (head)->first;					 \
+	     pos && ({ prefetch(pos->next); 1;}) &&			 \
+		({ tpos = hlist_entry(pos, typeof(*tpos), member); 1;}); \
+	     pos = pos->next, ({ smp_read_barrier_depends(); 0; }) )
+
 #else
 #warning "don't include kernel headers in userspace"
 #endif /* __KERNEL__ */
diff -urN linux-2.6.8-rc2/include/linux/mm.h linux-2.6.8-rc3/include/linux/mm.h
--- linux-2.6.8-rc2/include/linux/mm.h	2004-08-03 15:21:14.308806931 -0700
+++ linux-2.6.8-rc3/include/linux/mm.h	2004-08-03 15:22:12.805206606 -0700
@@ -706,8 +706,6 @@
 
 extern struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr);
 
-extern unsigned int nr_used_zone_pages(void);
-
 extern struct page * vmalloc_to_page(void *addr);
 extern struct page * follow_page(struct mm_struct *mm, unsigned long address,
 		int write);
diff -urN linux-2.6.8-rc2/include/linux/mmzone.h linux-2.6.8-rc3/include/linux/mmzone.h
--- linux-2.6.8-rc2/include/linux/mmzone.h	2004-08-03 15:21:14.309806972 -0700
+++ linux-2.6.8-rc3/include/linux/mmzone.h	2004-08-03 15:22:12.878209601 -0700
@@ -345,6 +345,15 @@
 #define for_each_zone(zone) \
 	for (zone = pgdat_list->node_zones; zone; zone = next_zone(zone))
 
+static inline int is_highmem_idx(int idx)
+{
+	return (idx == ZONE_HIGHMEM);
+}
+
+static inline int is_normal_idx(int idx)
+{
+	return (idx == ZONE_NORMAL);
+}
 /**
  * is_highmem - helper function to quickly check if a struct zone is a 
  *              highmem zone or not.  This is an attempt to keep references
@@ -353,12 +362,12 @@
  */
 static inline int is_highmem(struct zone *zone)
 {
-	return (zone - zone->zone_pgdat->node_zones == ZONE_HIGHMEM);
+	return (is_highmem_idx(zone - zone->zone_pgdat->node_zones));
 }
 
 static inline int is_normal(struct zone *zone)
 {
-	return (zone - zone->zone_pgdat->node_zones == ZONE_NORMAL);
+	return (is_normal_idx(zone - zone->zone_pgdat->node_zones));
 }
 
 /* These two functions are used to setup the per zone pages min values */
diff -urN linux-2.6.8-rc2/include/linux/mtio.h linux-2.6.8-rc3/include/linux/mtio.h
--- linux-2.6.8-rc2/include/linux/mtio.h	2004-06-15 22:18:38.000000000 -0700
+++ linux-2.6.8-rc3/include/linux/mtio.h	2004-08-03 15:22:13.006214852 -0700
@@ -204,7 +204,7 @@
 	unsigned mt_segno;   /* the segment to read or write */
 	unsigned mt_mode;    /* modes for read/write (sync/async etc.) */
 	int      mt_result;  /* result of r/w request, not of the ioctl */
-	void    *mt_data;    /* User space buffer: must be 29kb */
+	void    __user *mt_data;    /* User space buffer: must be 29kb */
 };
 
 /* get tape capacity (ftape/zftape)
diff -urN linux-2.6.8-rc2/include/linux/netdevice.h linux-2.6.8-rc3/include/linux/netdevice.h
--- linux-2.6.8-rc2/include/linux/netdevice.h	2004-08-03 15:21:14.340808243 -0700
+++ linux-2.6.8-rc3/include/linux/netdevice.h	2004-08-03 15:22:13.039216206 -0700
@@ -472,12 +472,6 @@
 	/* bridge stuff */
 	struct net_bridge_port	*br_port;
 
-#ifdef CONFIG_NET_FASTROUTE
-#define NETDEV_FASTROUTE_HMASK 0xF
-	/* Semi-private data. Keep it at the end of device struct. */
-	rwlock_t		fastpath_lock;
-	struct dst_entry	*fastpath[NETDEV_FASTROUTE_HMASK+1];
-#endif
 #ifdef CONFIG_NET_DIVERT
 	/* this will get initialized at each interface type init routine */
 	struct divert_blk	*divert;
@@ -947,11 +941,6 @@
 extern atomic_t netdev_dropping;
 extern int		netdev_set_master(struct net_device *dev, struct net_device *master);
 extern int skb_checksum_help(struct sk_buff **pskb, int inward);
-#ifdef CONFIG_NET_FASTROUTE
-extern int		netdev_fastroute;
-extern int		netdev_fastroute_obstacles;
-extern void		dev_clear_fastroute(struct net_device *dev);
-#endif
 
 #ifdef CONFIG_SYSCTL
 extern char *net_sysctl_strdup(const char *s);
diff -urN linux-2.6.8-rc2/include/linux/pci.h linux-2.6.8-rc3/include/linux/pci.h
--- linux-2.6.8-rc2/include/linux/pci.h	2004-08-03 15:21:14.357808941 -0700
+++ linux-2.6.8-rc3/include/linux/pci.h	2004-08-03 15:22:13.191222441 -0700
@@ -831,16 +831,27 @@
 extern struct pci_dev *isa_bridge;
 #endif
 
-#ifndef CONFIG_PCI_USE_VECTOR
+struct msix_entry {
+	u16 	vector;	/* kernel uses to write allocated vector */
+	u16	entry;	/* driver uses to specify entry, OS writes */
+};
+
+#ifndef CONFIG_PCI_MSI
 static inline void pci_scan_msi_device(struct pci_dev *dev) {}
 static inline int pci_enable_msi(struct pci_dev *dev) {return -1;}
+static inline void pci_disable_msi(struct pci_dev *dev) {}
+static inline int pci_enable_msix(struct pci_dev* dev,
+	struct msix_entry *entries, int nvec) {return -1;}
+static inline void pci_disable_msix(struct pci_dev *dev) {}
 static inline void msi_remove_pci_irq_vectors(struct pci_dev *dev) {}
 #else
 extern void pci_scan_msi_device(struct pci_dev *dev);
 extern int pci_enable_msi(struct pci_dev *dev);
+extern void pci_disable_msi(struct pci_dev *dev);
+extern int pci_enable_msix(struct pci_dev* dev,
+	struct msix_entry *entries, int nvec);
+extern void pci_disable_msix(struct pci_dev *dev);
 extern void msi_remove_pci_irq_vectors(struct pci_dev *dev);
-extern int msi_alloc_vectors(struct pci_dev* dev, int *vector, int nvec);
-extern int msi_free_vectors(struct pci_dev* dev, int *vector, int nvec);
 #endif
 
 #endif /* CONFIG_PCI */
diff -urN linux-2.6.8-rc2/include/linux/pci_ids.h linux-2.6.8-rc3/include/linux/pci_ids.h
--- linux-2.6.8-rc2/include/linux/pci_ids.h	2004-08-03 15:21:14.359809023 -0700
+++ linux-2.6.8-rc3/include/linux/pci_ids.h	2004-08-03 15:22:13.195222605 -0700
@@ -1184,11 +1184,14 @@
 #define PCI_DEVICE_ID_TTI_HPT302	0x0006
 #define PCI_DEVICE_ID_TTI_HPT371	0x0007
 #define PCI_DEVICE_ID_TTI_HPT374	0x0008
+#define PCI_DEVICE_ID_TTI_HPT372N	0x0009	// apparently a 372N variant?
 
 #define PCI_VENDOR_ID_VIA		0x1106
 #define PCI_DEVICE_ID_VIA_8763_0	0x0198
 #define PCI_DEVICE_ID_VIA_8380_0	0x0204
+#define PCI_DEVICE_ID_VIA_3238_0	0x0238
 #define PCI_DEVICE_ID_VIA_PX8X0_0	0x0259
+#define PCI_DEVICE_ID_VIA_3269_0	0x0269
 #define PCI_DEVICE_ID_VIA_K8T800PRO_0	0x0282
 #define PCI_DEVICE_ID_VIA_8363_0	0x0305
 #define PCI_DEVICE_ID_VIA_8371_0	0x0391
@@ -1225,9 +1228,9 @@
 #define PCI_DEVICE_ID_VIA_82C686_6	0x3068
 #define PCI_DEVICE_ID_VIA_8233_0	0x3074
 #define PCI_DEVICE_ID_VIA_8633_0	0x3091
-#define PCI_DEVICE_ID_VIA_8367_0	0x3099 
+#define PCI_DEVICE_ID_VIA_8367_0	0x3099
 #define PCI_DEVICE_ID_VIA_8653_0	0x3101
-#define PCI_DEVICE_ID_VIA_8622		0x3102 
+#define PCI_DEVICE_ID_VIA_8622		0x3102
 #define PCI_DEVICE_ID_VIA_8233C_0	0x3109
 #define PCI_DEVICE_ID_VIA_8361		0x3112
 #define PCI_DEVICE_ID_VIA_XM266		0x3116
@@ -1247,6 +1250,7 @@
 #define PCI_DEVICE_ID_VIA_PT880		0x3258
 #define PCI_DEVICE_ID_VIA_P4M400	0x3209
 #define PCI_DEVICE_ID_VIA_8237		0x3227
+#define PCI_DEVICE_ID_VIA_3296_0	0x0296
 #define PCI_DEVICE_ID_VIA_86C100A	0x6100
 #define PCI_DEVICE_ID_VIA_8231		0x8231
 #define PCI_DEVICE_ID_VIA_8231_4	0x8235
@@ -2158,6 +2162,8 @@
 #define PCI_DEVICE_ID_INTEL_82865_IG	0x2572
 #define PCI_DEVICE_ID_INTEL_82875_HB	0x2578
 #define PCI_DEVICE_ID_INTEL_82875_IG	0x257b
+#define PCI_DEVICE_ID_INTEL_82915G_HB	0x2580
+#define PCI_DEVICE_ID_INTEL_82915G_IG	0x2582
 #define PCI_DEVICE_ID_INTEL_ICH6_0	0x2640
 #define PCI_DEVICE_ID_INTEL_ICH6_1	0x2641
 #define PCI_DEVICE_ID_INTEL_ICH6_2	0x2642
diff -urN linux-2.6.8-rc2/include/linux/personality.h linux-2.6.8-rc3/include/linux/personality.h
--- linux-2.6.8-rc2/include/linux/personality.h	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/include/linux/personality.h	2004-08-03 15:22:13.197222687 -0700
@@ -30,6 +30,7 @@
  */
 enum {
 	MMAP_PAGE_ZERO =	0x0100000,
+	READ_IMPLIES_EXEC =	0x0400000,
 	ADDR_LIMIT_32BIT =	0x0800000,
 	SHORT_INODE =		0x1000000,
 	WHOLE_SECONDS =		0x2000000,
@@ -38,6 +39,12 @@
 };
 
 /*
+ * Security-relevant compatibility flags that must be
+ * cleared upon setuid or setgid exec:
+ */
+#define PER_CLEAR_ON_SETID (READ_IMPLIES_EXEC)
+
+/*
  * Personality types.
  *
  * These go in the low byte.  Avoid using the top bit, it will
diff -urN linux-2.6.8-rc2/include/linux/pkt_cls.h linux-2.6.8-rc3/include/linux/pkt_cls.h
--- linux-2.6.8-rc2/include/linux/pkt_cls.h	2004-08-03 15:21:14.360809064 -0700
+++ linux-2.6.8-rc3/include/linux/pkt_cls.h	2004-08-03 15:22:13.197222687 -0700
@@ -117,17 +117,6 @@
 struct tc_police
 {
 	__u32			index;
-#ifdef CONFIG_NET_CLS_ACT
-	int 			refcnt;
-	int 			bindcnt;
-#endif
-/* Turned off because it requires new tc
- * to work (for now maintain ABI)
- *
-#ifdef CONFIG_NET_CLS_ACT
-	__u32			capab;
-#endif
-*/
 	int			action;
 #define TC_POLICE_UNSPEC	TC_ACT_UNSPEC
 #define TC_POLICE_OK		TC_ACT_OK
@@ -140,6 +129,9 @@
 	__u32			mtu;
 	struct tc_ratespec	rate;
 	struct tc_ratespec	peakrate;
+	int 			refcnt;
+	int 			bindcnt;
+	__u32			capab;
 };
 
 struct tcf_t
@@ -195,12 +187,9 @@
 	TCA_U32_DIVISOR,
 	TCA_U32_SEL,
 	TCA_U32_POLICE,
-#ifdef CONFIG_NET_CLS_ACT
 	TCA_U32_ACT,   
-#endif
-#ifdef CONFIG_NET_CLS_IND
 	TCA_U32_INDEV,
-#endif
+	TCA_U32_PCNT,
 	__TCA_U32_MAX
 };
 
@@ -212,9 +201,6 @@
 	__u32		val;
 	int		off;
 	int		offmask;
-#ifdef CONFIG_CLS_U32_PERF
-	unsigned long	kcnt;
-#endif
 };
 
 struct tc_u32_sel
@@ -229,13 +215,17 @@
 
 	short			hoff;
 	__u32			hmask;
-#ifdef CONFIG_CLS_U32_PERF
-	unsigned long		rcnt;
-	unsigned long		rhit;
-#endif
 	struct tc_u32_key	keys[0];
 };
 
+#ifdef CONFIG_CLS_U32_PERF
+struct tc_u32_pcnt
+{
+	__u64 rcnt;
+	__u64 rhit;
+	__u64 kcnts[0];
+};
+#endif
 /* Flags */
 
 #define TC_U32_TERMINAL		1
@@ -300,12 +290,8 @@
 	TCA_FW_UNSPEC,
 	TCA_FW_CLASSID,
 	TCA_FW_POLICE,
-#ifdef CONFIG_NET_CLS_IND
-	TCA_FW_INDEV,
-#endif
-#ifdef CONFIG_NET_CLS_ACT
-	TCA_FW_ACT,
-#endif
+	TCA_FW_INDEV, /*  used by CONFIG_NET_CLS_IND */
+	TCA_FW_ACT, /* used by CONFIG_NET_CLS_ACT */
 	__TCA_FW_MAX
 };
 
diff -urN linux-2.6.8-rc2/include/linux/reiserfs_fs.h linux-2.6.8-rc3/include/linux/reiserfs_fs.h
--- linux-2.6.8-rc2/include/linux/reiserfs_fs.h	2004-08-03 15:21:14.367809351 -0700
+++ linux-2.6.8-rc3/include/linux/reiserfs_fs.h	2004-08-03 15:22:13.274225846 -0700
@@ -630,8 +630,8 @@
 static inline void set_le_key_k_offset (int version, struct key * key, loff_t offset)
 {
     (version == KEY_FORMAT_3_5) ?
-        (key->u.k_offset_v1.k_offset = cpu_to_le32 (offset)) : /* jdm check */
-	(set_offset_v2_k_offset( &(key->u.k_offset_v2), offset ));
+        (void)(key->u.k_offset_v1.k_offset = cpu_to_le32 (offset)) : /* jdm check */
+	(void)(set_offset_v2_k_offset( &(key->u.k_offset_v2), offset ));
 }
 
 
@@ -644,8 +644,8 @@
 static inline void set_le_key_k_type (int version, struct key * key, int type)
 {
     (version == KEY_FORMAT_3_5) ?
-        (key->u.k_offset_v1.k_uniqueness = cpu_to_le32(type2uniqueness(type))):
-	(set_offset_v2_k_type( &(key->u.k_offset_v2), type ));
+        (void)(key->u.k_offset_v1.k_uniqueness = cpu_to_le32(type2uniqueness(type))):
+	(void)(set_offset_v2_k_type( &(key->u.k_offset_v2), type ));
 }
 static inline void set_le_ih_k_type (struct item_head * ih, int type)
 {
diff -urN linux-2.6.8-rc2/include/linux/rtnetlink.h linux-2.6.8-rc3/include/linux/rtnetlink.h
--- linux-2.6.8-rc2/include/linux/rtnetlink.h	2004-08-03 15:21:14.403810828 -0700
+++ linux-2.6.8-rc3/include/linux/rtnetlink.h	2004-08-03 15:22:13.276225928 -0700
@@ -746,10 +746,6 @@
 
 extern struct semaphore rtnl_sem;
 
-#define rtnl_exlock()		do { } while(0)
-#define rtnl_exunlock()		do { } while(0)
-#define rtnl_exlock_nowait()	(0)
-
 #define rtnl_shlock()		down(&rtnl_sem)
 #define rtnl_shlock_nowait()	down_trylock(&rtnl_sem)
 
diff -urN linux-2.6.8-rc2/include/linux/sched.h linux-2.6.8-rc3/include/linux/sched.h
--- linux-2.6.8-rc2/include/linux/sched.h	2004-08-03 15:21:14.406810951 -0700
+++ linux-2.6.8-rc3/include/linux/sched.h	2004-08-03 15:22:13.290226503 -0700
@@ -410,6 +410,10 @@
 	unsigned int time_slice, first_time_slice;
 
 	struct list_head tasks;
+	/*
+	 * ptrace_list/ptrace_children forms the list of my children
+	 * that were stolen by a ptracer.
+	 */
 	struct list_head ptrace_children;
 	struct list_head ptrace_list;
 
@@ -431,6 +435,10 @@
 	 */
 	struct task_struct *real_parent; /* real parent process (when being debugged) */
 	struct task_struct *parent;	/* parent process */
+	/*
+	 * children/sibling forms the list of my children plus the
+	 * tasks I'm ptracing.
+	 */
 	struct list_head children;	/* list of my children */
 	struct list_head sibling;	/* linkage in my parent's children list */
 	struct task_struct *group_leader;	/* threadgroup leader */
diff -urN linux-2.6.8-rc2/include/linux/serial_core.h linux-2.6.8-rc3/include/linux/serial_core.h
--- linux-2.6.8-rc2/include/linux/serial_core.h	2004-08-03 15:21:14.409811074 -0700
+++ linux-2.6.8-rc3/include/linux/serial_core.h	2004-08-03 15:22:13.335228349 -0700
@@ -86,6 +86,9 @@
 /* PPC CPM type number */
 #define PORT_CPM        58
 
+/* MPC52xx type numbers */
+#define PORT_MPC52xx	59
+
 #ifdef __KERNEL__
 
 #include <linux/config.h>
diff -urN linux-2.6.8-rc2/include/linux/skbuff.h linux-2.6.8-rc3/include/linux/skbuff.h
--- linux-2.6.8-rc2/include/linux/skbuff.h	2004-08-03 15:21:14.411811156 -0700
+++ linux-2.6.8-rc3/include/linux/skbuff.h	2004-08-03 15:22:13.374229949 -0700
@@ -233,7 +233,7 @@
 	 * want to keep them across layers you have to do a skb_clone()
 	 * first. This is owned by whoever has the skb queued ATM.
 	 */
-	char			cb[48];
+	char			cb[40];
 
 	unsigned int		len,
 				data_len,
diff -urN linux-2.6.8-rc2/include/linux/snmp.h linux-2.6.8-rc3/include/linux/snmp.h
--- linux-2.6.8-rc2/include/linux/snmp.h	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/include/linux/snmp.h	2004-08-03 15:22:13.376230031 -0700
@@ -0,0 +1,266 @@
+/*
+ * Definitions for MIBs
+ *
+ * Author: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
+ */
+
+#ifndef _LINUX_SNMP_H
+#define _LINUX_SNMP_H
+
+/* ipstats mib definitions */
+/*
+ * RFC 1213:  MIB-II
+ * RFC 2011 (updates 1213):  SNMPv2-MIB-IP
+ * RFC 2863:  Interfaces Group MIB
+ * RFC 2465:  IPv6 MIB: General Group
+ * draft-ietf-ipv6-rfc2011-update-10.txt: MIB for IP: IP Statistics Tables
+ */
+enum
+{
+	IPSTATS_MIB_NUM = 0,
+	IPSTATS_MIB_INRECEIVES,			/* InReceives */
+	IPSTATS_MIB_INHDRERRORS,		/* InHdrErrors */
+	IPSTATS_MIB_INTOOBIGERRORS,		/* InTooBigErrors */
+	IPSTATS_MIB_INNOROUTES,			/* InNoRoutes */
+	IPSTATS_MIB_INADDRERRORS,		/* InAddrErrors */
+	IPSTATS_MIB_INUNKNOWNPROTOS,		/* InUnknownProtos */
+	IPSTATS_MIB_INTRUNCATEDPKTS,		/* InTruncatedPkts */
+	IPSTATS_MIB_INDISCARDS,			/* InDiscards */
+	IPSTATS_MIB_INDELIVERS,			/* InDelivers */
+	IPSTATS_MIB_OUTFORWDATAGRAMS,		/* OutForwDatagrams */
+	IPSTATS_MIB_OUTREQUESTS,		/* OutRequests */
+	IPSTATS_MIB_OUTDISCARDS,		/* OutDiscards */
+	IPSTATS_MIB_OUTNOROUTES,		/* OutNoRoutes */
+	IPSTATS_MIB_REASMTIMEOUT,		/* ReasmTimeout */
+	IPSTATS_MIB_REASMREQDS,			/* ReasmReqds */
+	IPSTATS_MIB_REASMOKS,			/* ReasmOKs */
+	IPSTATS_MIB_REASMFAILS,			/* ReasmFails */
+	IPSTATS_MIB_FRAGOKS,			/* FragOKs */
+	IPSTATS_MIB_FRAGFAILS,			/* FragFails */
+	IPSTATS_MIB_FRAGCREATES,		/* FragCreates */
+	IPSTATS_MIB_INMCASTPKTS,		/* InMcastPkts */
+	IPSTATS_MIB_OUTMCASTPKTS,		/* OutMcastPkts */
+	__IPSTATS_MIB_MAX
+};
+
+/* icmp mib definitions */
+/*
+ * RFC 1213:  MIB-II ICMP Group
+ * RFC 2011 (updates 1213):  SNMPv2 MIB for IP: ICMP group
+ */
+enum
+{
+	ICMP_MIB_NUM = 0,
+	ICMP_MIB_INMSGS,			/* InMsgs */
+	ICMP_MIB_INERRORS,			/* InErrors */
+	ICMP_MIB_INDESTUNREACHS,		/* InDestUnreachs */
+	ICMP_MIB_INTIMEEXCDS,			/* InTimeExcds */
+	ICMP_MIB_INPARMPROBS,			/* InParmProbs */
+	ICMP_MIB_INSRCQUENCHS,			/* InSrcQuenchs */
+	ICMP_MIB_INREDIRECTS,			/* InRedirects */
+	ICMP_MIB_INECHOS,			/* InEchos */
+	ICMP_MIB_INECHOREPS,			/* InEchoReps */
+	ICMP_MIB_INTIMESTAMPS,			/* InTimestamps */
+	ICMP_MIB_INTIMESTAMPREPS,		/* InTimestampReps */
+	ICMP_MIB_INADDRMASKS,			/* InAddrMasks */
+	ICMP_MIB_INADDRMASKREPS,		/* InAddrMaskReps */
+	ICMP_MIB_OUTMSGS,			/* OutMsgs */
+	ICMP_MIB_OUTERRORS,			/* OutErrors */
+	ICMP_MIB_OUTDESTUNREACHS,		/* OutDestUnreachs */
+	ICMP_MIB_OUTTIMEEXCDS,			/* OutTimeExcds */
+	ICMP_MIB_OUTPARMPROBS,			/* OutParmProbs */
+	ICMP_MIB_OUTSRCQUENCHS,			/* OutSrcQuenchs */
+	ICMP_MIB_OUTREDIRECTS,			/* OutRedirects */
+	ICMP_MIB_OUTECHOS,			/* OutEchos */
+	ICMP_MIB_OUTECHOREPS,			/* OutEchoReps */
+	ICMP_MIB_OUTTIMESTAMPS,			/* OutTimestamps */
+	ICMP_MIB_OUTTIMESTAMPREPS,		/* OutTimestampReps */
+	ICMP_MIB_OUTADDRMASKS,			/* OutAddrMasks */
+	ICMP_MIB_OUTADDRMASKREPS,		/* OutAddrMaskReps */
+	__ICMP_MIB_MAX
+};
+
+/* icmp6 mib definitions */
+/*
+ * RFC 2466:  ICMPv6-MIB
+ */
+enum
+{
+	ICMP6_MIB_NUM = 0,
+	ICMP6_MIB_INMSGS,			/* InMsgs */
+	ICMP6_MIB_INERRORS,			/* InErrors */
+	ICMP6_MIB_INDESTUNREACHS,		/* InDestUnreachs */
+	ICMP6_MIB_INPKTTOOBIGS,			/* InPktTooBigs */
+	ICMP6_MIB_INTIMEEXCDS,			/* InTimeExcds */
+	ICMP6_MIB_INPARMPROBLEMS,		/* InParmProblems */
+	ICMP6_MIB_INECHOS,			/* InEchos */
+	ICMP6_MIB_INECHOREPLIES,		/* InEchoReplies */
+	ICMP6_MIB_INGROUPMEMBQUERIES,		/* InGroupMembQueries */
+	ICMP6_MIB_INGROUPMEMBRESPONSES,		/* InGroupMembResponses */
+	ICMP6_MIB_INGROUPMEMBREDUCTIONS,	/* InGroupMembReductions */
+	ICMP6_MIB_INROUTERSOLICITS,		/* InRouterSolicits */
+	ICMP6_MIB_INROUTERADVERTISEMENTS,	/* InRouterAdvertisements */
+	ICMP6_MIB_INNEIGHBORSOLICITS,		/* InNeighborSolicits */
+	ICMP6_MIB_INNEIGHBORADVERTISEMENTS,	/* InNeighborAdvertisements */
+	ICMP6_MIB_INREDIRECTS,			/* InRedirects */
+	ICMP6_MIB_OUTMSGS,			/* OutMsgs */
+	ICMP6_MIB_OUTDESTUNREACHS,		/* OutDestUnreachs */
+	ICMP6_MIB_OUTPKTTOOBIGS,		/* OutPktTooBigs */
+	ICMP6_MIB_OUTTIMEEXCDS,			/* OutTimeExcds */
+	ICMP6_MIB_OUTPARMPROBLEMS,		/* OutParmProblems */
+	ICMP6_MIB_OUTECHOREPLIES,		/* OutEchoReplies */
+	ICMP6_MIB_OUTROUTERSOLICITS,		/* OutRouterSolicits */
+	ICMP6_MIB_OUTNEIGHBORSOLICITS,		/* OutNeighborSolicits */
+	ICMP6_MIB_OUTNEIGHBORADVERTISEMENTS,	/* OutNeighborAdvertisements */
+	ICMP6_MIB_OUTREDIRECTS,			/* OutRedirects */
+	ICMP6_MIB_OUTGROUPMEMBRESPONSES,	/* OutGroupMembResponses */
+	ICMP6_MIB_OUTGROUPMEMBREDUCTIONS,	/* OutGroupMembReductions */
+	__ICMP6_MIB_MAX
+};
+
+/* tcp mib definitions */
+/*
+ * RFC 1213:  MIB-II TCP group
+ * RFC 2012 (updates 1213):  SNMPv2-MIB-TCP
+ */
+enum
+{
+	TCP_MIB_NUM = 0,
+	TCP_MIB_RTOALGORITHM,			/* RtoAlgorithm */
+	TCP_MIB_RTOMIN,				/* RtoMin */
+	TCP_MIB_RTOMAX,				/* RtoMax */
+	TCP_MIB_MAXCONN,			/* MaxConn */
+	TCP_MIB_ACTIVEOPENS,			/* ActiveOpens */
+	TCP_MIB_PASSIVEOPENS,			/* PassiveOpens */
+	TCP_MIB_ATTEMPTFAILS,			/* AttemptFails */
+	TCP_MIB_ESTABRESETS,			/* EstabResets */
+	TCP_MIB_CURRESTAB,			/* CurrEstab */
+	TCP_MIB_INSEGS,				/* InSegs */
+	TCP_MIB_OUTSEGS,			/* OutSegs */
+	TCP_MIB_RETRANSSEGS,			/* RetransSegs */
+	TCP_MIB_INERRS,				/* InErrs */
+	TCP_MIB_OUTRSTS,			/* OutRsts */
+	__TCP_MIB_MAX
+};
+
+/* udp mib definitions */
+/*
+ * RFC 1213:  MIB-II UDP group
+ * RFC 2013 (updates 1213):  SNMPv2-MIB-UDP
+ */
+enum
+{
+	UDP_MIB_NUM = 0,
+	UDP_MIB_INDATAGRAMS,			/* InDatagrams */
+	UDP_MIB_NOPORTS,			/* NoPorts */
+	UDP_MIB_INERRORS,			/* InErrors */
+	UDP_MIB_OUTDATAGRAMS,			/* OutDatagrams */
+	__UDP_MIB_MAX
+};
+
+/* sctp mib definitions */
+/*
+ * draft-ietf-sigtran-sctp-mib-07.txt
+ */
+enum
+{
+	SCTP_MIB_NUM = 0,
+	SCTP_MIB_CURRESTAB,			/* CurrEstab */
+	SCTP_MIB_ACTIVEESTABS,			/* ActiveEstabs */
+	SCTP_MIB_PASSIVEESTABS,			/* PassiveEstabs */
+	SCTP_MIB_ABORTEDS,			/* Aborteds */
+	SCTP_MIB_SHUTDOWNS,			/* Shutdowns */
+	SCTP_MIB_OUTOFBLUES,			/* OutOfBlues */
+	SCTP_MIB_CHECKSUMERRORS,		/* ChecksumErrors */
+	SCTP_MIB_OUTCTRLCHUNKS,			/* OutCtrlChunks */
+	SCTP_MIB_OUTORDERCHUNKS,		/* OutOrderChunks */
+	SCTP_MIB_OUTUNORDERCHUNKS,		/* OutUnorderChunks */
+	SCTP_MIB_INCTRLCHUNKS,			/* InCtrlChunks */
+	SCTP_MIB_INORDERCHUNKS,			/* InOrderChunks */
+	SCTP_MIB_INUNORDERCHUNKS,		/* InUnorderChunks */
+	SCTP_MIB_FRAGUSRMSGS,			/* FragUsrMsgs */
+	SCTP_MIB_REASMUSRMSGS,			/* ReasmUsrMsgs */
+	SCTP_MIB_OUTSCTPPACKS,			/* OutSCTPPacks */
+	SCTP_MIB_INSCTPPACKS,			/* InSCTPPacks */
+	SCTP_MIB_RTOALGORITHM,			/* RtoAlgorithm */
+	SCTP_MIB_RTOMIN,			/* RtoMin */
+	SCTP_MIB_RTOMAX,			/* RtoMax */
+	SCTP_MIB_RTOINITIAL,			/* RtoInitial */
+	SCTP_MIB_VALCOOKIELIFE,			/* ValCookieLife */
+	SCTP_MIB_MAXINITRETR,			/* MaxInitRetr */
+	__SCTP_MIB_MAX
+};
+
+/* linux mib definitions */
+enum
+{
+	LINUX_MIB_NUM = 0,
+	LINUX_MIB_SYNCOOKIESSENT,		/* SyncookiesSent */
+	LINUX_MIB_SYNCOOKIESRECV,		/* SyncookiesRecv */
+	LINUX_MIB_SYNCOOKIESFAILED,		/* SyncookiesFailed */
+	LINUX_MIB_EMBRYONICRSTS,		/* EmbryonicRsts */
+	LINUX_MIB_PRUNECALLED,			/* PruneCalled */
+	LINUX_MIB_RCVPRUNED,			/* RcvPruned */
+	LINUX_MIB_OFOPRUNED,			/* OfoPruned */
+	LINUX_MIB_OUTOFWINDOWICMPS,		/* OutOfWindowIcmps */
+	LINUX_MIB_LOCKDROPPEDICMPS,		/* LockDroppedIcmps */
+	LINUX_MIB_ARPFILTER,			/* ArpFilter */
+	LINUX_MIB_TIMEWAITED,			/* TimeWaited */
+	LINUX_MIB_TIMEWAITRECYCLED,		/* TimeWaitRecycled */
+	LINUX_MIB_TIMEWAITKILLED,		/* TimeWaitKilled */
+	LINUX_MIB_PAWSPASSIVEREJECTED,		/* PAWSPassiveRejected */
+	LINUX_MIB_PAWSACTIVEREJECTED,		/* PAWSActiveRejected */
+	LINUX_MIB_PAWSESTABREJECTED,		/* PAWSEstabRejected */
+	LINUX_MIB_DELAYEDACKS,			/* DelayedACKs */
+	LINUX_MIB_DELAYEDACKLOCKED,		/* DelayedACKLocked */
+	LINUX_MIB_DELAYEDACKLOST,		/* DelayedACKLost */
+	LINUX_MIB_LISTENOVERFLOWS,		/* ListenOverflows */
+	LINUX_MIB_LISTENDROPS,			/* ListenDrops */
+	LINUX_MIB_TCPPREQUEUED,			/* TCPPrequeued */
+	LINUX_MIB_TCPDIRECTCOPYFROMBACKLOG,	/* TCPDirectCopyFromBacklog */
+	LINUX_MIB_TCPDIRECTCOPYFROMPREQUEUE,	/* TCPDirectCopyFromPrequeue */
+	LINUX_MIB_TCPPREQUEUEDROPPED,		/* TCPPrequeueDropped */
+	LINUX_MIB_TCPHPHITS,			/* TCPHPHits */
+	LINUX_MIB_TCPHPHITSTOUSER,		/* TCPHPHitsToUser */
+	LINUX_MIB_TCPPUREACKS,			/* TCPPureAcks */
+	LINUX_MIB_TCPHPACKS,			/* TCPHPAcks */
+	LINUX_MIB_TCPRENORECOVERY,		/* TCPRenoRecovery */
+	LINUX_MIB_TCPSACKRECOVERY,		/* TCPSackRecovery */
+	LINUX_MIB_TCPSACKRENEGING,		/* TCPSACKReneging */
+	LINUX_MIB_TCPFACKREORDER,		/* TCPFACKReorder */
+	LINUX_MIB_TCPSACKREORDER,		/* TCPSACKReorder */
+	LINUX_MIB_TCPRENOREORDER,		/* TCPRenoReorder */
+	LINUX_MIB_TCPTSREORDER,			/* TCPTSReorder */
+	LINUX_MIB_TCPFULLUNDO,			/* TCPFullUndo */
+	LINUX_MIB_TCPPARTIALUNDO,		/* TCPPartialUndo */
+	LINUX_MIB_TCPDSACKUNDO,			/* TCPDSACKUndo */
+	LINUX_MIB_TCPLOSSUNDO,			/* TCPLossUndo */
+	LINUX_MIB_TCPLOSS,			/* TCPLoss */
+	LINUX_MIB_TCPLOSTRETRANSMIT,		/* TCPLostRetransmit */
+	LINUX_MIB_TCPRENOFAILURES,		/* TCPRenoFailures */
+	LINUX_MIB_TCPSACKFAILURES,		/* TCPSackFailures */
+	LINUX_MIB_TCPLOSSFAILURES,		/* TCPLossFailures */
+	LINUX_MIB_TCPFASTRETRANS,		/* TCPFastRetrans */
+	LINUX_MIB_TCPFORWARDRETRANS,		/* TCPForwardRetrans */
+	LINUX_MIB_TCPSLOWSTARTRETRANS,		/* TCPSlowStartRetrans */
+	LINUX_MIB_TCPTIMEOUTS,			/* TCPTimeouts */
+	LINUX_MIB_TCPRENORECOVERYFAIL,		/* TCPRenoRecoveryFail */
+	LINUX_MIB_TCPSACKRECOVERYFAIL,		/* TCPSackRecoveryFail */
+	LINUX_MIB_TCPSCHEDULERFAILED,		/* TCPSchedulerFailed */
+	LINUX_MIB_TCPRCVCOLLAPSED,		/* TCPRcvCollapsed */
+	LINUX_MIB_TCPDSACKOLDSENT,		/* TCPDSACKOldSent */
+	LINUX_MIB_TCPDSACKOFOSENT,		/* TCPDSACKOfoSent */
+	LINUX_MIB_TCPDSACKRECV,			/* TCPDSACKRecv */
+	LINUX_MIB_TCPDSACKOFORECV,		/* TCPDSACKOfoRecv */
+	LINUX_MIB_TCPABORTONSYN,		/* TCPAbortOnSyn */
+	LINUX_MIB_TCPABORTONDATA,		/* TCPAbortOnData */
+	LINUX_MIB_TCPABORTONCLOSE,		/* TCPAbortOnClose */
+	LINUX_MIB_TCPABORTONMEMORY,		/* TCPAbortOnMemory */
+	LINUX_MIB_TCPABORTONTIMEOUT,		/* TCPAbortOnTimeout */
+	LINUX_MIB_TCPABORTONLINGER,		/* TCPAbortOnLinger */
+	LINUX_MIB_TCPABORTFAILED,		/* TCPAbortFailed */
+	LINUX_MIB_TCPMEMORYPRESSURES,		/* TCPMemoryPressures */
+	__LINUX_MIB_MAX
+};
+
+#endif	/* _LINUX_SNMP_H */
diff -urN linux-2.6.8-rc2/include/linux/swap.h linux-2.6.8-rc3/include/linux/swap.h
--- linux-2.6.8-rc2/include/linux/swap.h	2004-08-03 15:21:14.415811320 -0700
+++ linux-2.6.8-rc3/include/linux/swap.h	2004-08-03 15:22:13.417231713 -0700
@@ -148,7 +148,7 @@
 #define vm_swap_full() (nr_swap_pages*2 < total_swap_pages)
 
 /* linux/mm/oom_kill.c */
-extern void out_of_memory(void);
+extern void out_of_memory(int gfp_mask);
 
 /* linux/mm/memory.c */
 extern void swapin_readahead(swp_entry_t, unsigned long, struct vm_area_struct *);
diff -urN linux-2.6.8-rc2/include/linux/tcp.h linux-2.6.8-rc3/include/linux/tcp.h
--- linux-2.6.8-rc2/include/linux/tcp.h	2004-08-03 15:21:14.418811443 -0700
+++ linux-2.6.8-rc3/include/linux/tcp.h	2004-08-03 15:22:13.531236389 -0700
@@ -420,6 +420,7 @@
 		__u32	cnt;		/* increase cwnd by 1 after this number of ACKs */
 		__u32 	last_max_cwnd;	/* last maximium snd_cwnd */
 		__u32	last_cwnd;	/* the last snd_cwnd */
+		__u32   last_stamp;     /* time when updated last_cwnd */
 	} bictcp;
 };
 
diff -urN linux-2.6.8-rc2/include/linux/vt_kern.h linux-2.6.8-rc3/include/linux/vt_kern.h
--- linux-2.6.8-rc2/include/linux/vt_kern.h	2004-08-03 15:21:14.435812141 -0700
+++ linux-2.6.8-rc3/include/linux/vt_kern.h	2004-08-03 15:22:13.646241107 -0700
@@ -50,6 +50,10 @@
 void unblank_screen(void);
 void poke_blanked_console(void);
 int con_font_op(int currcons, struct console_font_op *op);
+int con_font_set(int currcons, struct console_font_op *op);
+int con_font_get(int currcons, struct console_font_op *op);
+int con_font_default(int currcons, struct console_font_op *op);
+int con_font_copy(int currcons, struct console_font_op *op);
 int con_set_cmap(unsigned char __user *cmap);
 int con_get_cmap(unsigned char __user *cmap);
 void scrollback(int);
diff -urN linux-2.6.8-rc2/include/mtd/mtd-abi.h linux-2.6.8-rc3/include/mtd/mtd-abi.h
--- linux-2.6.8-rc2/include/mtd/mtd-abi.h	2004-08-03 15:21:14.440812346 -0700
+++ linux-2.6.8-rc3/include/mtd/mtd-abi.h	2004-08-03 15:22:13.679242461 -0700
@@ -15,7 +15,7 @@
 struct mtd_oob_buf {
 	uint32_t start;
 	uint32_t length;
-	unsigned char *ptr;
+	unsigned char __user *ptr;
 };
 
 #define MTD_ABSENT		0
diff -urN linux-2.6.8-rc2/include/net/addrconf.h linux-2.6.8-rc3/include/net/addrconf.h
--- linux-2.6.8-rc2/include/net/addrconf.h	2004-06-15 22:19:44.000000000 -0700
+++ linux-2.6.8-rc3/include/net/addrconf.h	2004-08-03 15:22:13.699243281 -0700
@@ -160,8 +160,8 @@
 		inet6_ifa_finish_destroy(ifp);
 }
 
-#define __in6_ifa_put(idev)  atomic_dec(&(idev)->refcnt)
-#define in6_ifa_hold(idev)   atomic_inc(&(idev)->refcnt)
+#define __in6_ifa_put(ifp)	atomic_dec(&(ifp)->refcnt)
+#define in6_ifa_hold(ifp)	atomic_inc(&(ifp)->refcnt)
 
 
 extern void			addrconf_forwarding_on(void);
@@ -178,8 +178,8 @@
 	 * This will include the IEEE address token on links that support it.
 	 */
 
-	word = addr->s6_addr[2] ^ addr->s6_addr32[3];
-	word  ^= (word>>16);
+	word = addr->s6_addr32[2] ^ addr->s6_addr32[3];
+	word ^= (word >> 16);
 	word ^= (word >> 8);
 
 	return ((word ^ (word >> 4)) & 0x0f);
diff -urN linux-2.6.8-rc2/include/net/bluetooth/hci.h linux-2.6.8-rc3/include/net/bluetooth/hci.h
--- linux-2.6.8-rc2/include/net/bluetooth/hci.h	2004-06-15 22:20:03.000000000 -0700
+++ linux-2.6.8-rc3/include/net/bluetooth/hci.h	2004-08-03 15:22:13.737244840 -0700
@@ -432,7 +432,7 @@
 	__u8     pscan_period_mode;
 	__u8     dev_class[3];
 	__u16    clock_offset;
-	__u8     rssi;
+	__s8     rssi;
 } __attribute__ ((packed));
 
 #define HCI_EV_CONN_COMPLETE 	0x03
diff -urN linux-2.6.8-rc2/include/net/icmp.h linux-2.6.8-rc3/include/net/icmp.h
--- linux-2.6.8-rc2/include/net/icmp.h	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/include/net/icmp.h	2004-08-03 15:22:13.837248943 -0700
@@ -37,18 +37,6 @@
 #define ICMP_INC_STATS(field)		SNMP_INC_STATS(icmp_statistics, field)
 #define ICMP_INC_STATS_BH(field)	SNMP_INC_STATS_BH(icmp_statistics, field)
 #define ICMP_INC_STATS_USER(field) 	SNMP_INC_STATS_USER(icmp_statistics, field)
-#define ICMP_INC_STATS_FIELD(offt)					\
-	(*((unsigned long *) ((void *)					\
-			     per_cpu_ptr(icmp_statistics[!in_softirq()],\
-					 smp_processor_id()) + offt)))++
-#define ICMP_INC_STATS_BH_FIELD(offt)					\
-	(*((unsigned long *) ((void *)					\
-			     per_cpu_ptr(icmp_statistics[0],		\
-					 smp_processor_id()) + offt)))++
-#define ICMP_INC_STATS_USER_FIELD(offt)					\
-	(*((unsigned long *) ((void *)					\
-			     per_cpu_ptr(icmp_statistics[1],		\
-					 smp_processor_id()) + offt)))++
 
 extern void	icmp_send(struct sk_buff *skb_in,  int type, int code, u32 info);
 extern int	icmp_rcv(struct sk_buff *skb);
diff -urN linux-2.6.8-rc2/include/net/inet_ecn.h linux-2.6.8-rc3/include/net/inet_ecn.h
--- linux-2.6.8-rc2/include/net/inet_ecn.h	2004-06-15 22:19:53.000000000 -0700
+++ linux-2.6.8-rc3/include/net/inet_ecn.h	2004-08-03 15:22:13.838248984 -0700
@@ -3,39 +3,48 @@
 
 #include <linux/ip.h>
 
+enum {
+	INET_ECN_NOT_ECT = 0,
+	INET_ECN_ECT_1 = 1,
+	INET_ECN_ECT_0 = 2,
+	INET_ECN_CE = 3,
+	INET_ECN_MASK = 3,
+};
+
 static inline int INET_ECN_is_ce(__u8 dsfield)
 {
-	return (dsfield&3) == 3;
+	return (dsfield & INET_ECN_MASK) == INET_ECN_CE;
 }
 
 static inline int INET_ECN_is_not_ce(__u8 dsfield)
 {
-	return (dsfield&3) == 2;
+	return (dsfield & INET_ECN_MASK) == INET_ECN_ECT_0;
 }
 
 static inline int INET_ECN_is_capable(__u8 dsfield)
 {
-	return (dsfield&2);
+	return (dsfield & INET_ECN_ECT_0);
 }
 
 static inline __u8 INET_ECN_encapsulate(__u8 outer, __u8 inner)
 {
-	outer &= ~3;
+	outer &= ~INET_ECN_MASK;
 	if (INET_ECN_is_capable(inner))
-		outer |= (inner & 3);
+		outer |= (inner & INET_ECN_MASK);
 	return outer;
 }
 
-#define	INET_ECN_xmit(sk) do { inet_sk(sk)->tos |= 2; } while (0)
-#define	INET_ECN_dontxmit(sk) do { inet_sk(sk)->tos &= ~3; } while (0)
+#define	INET_ECN_xmit(sk) do { inet_sk(sk)->tos |= INET_ECN_ECT_0; } while (0)
+#define	INET_ECN_dontxmit(sk) \
+	do { inet_sk(sk)->tos &= ~INET_ECN_MASK; } while (0)
 
-#define IP6_ECN_flow_init(label) do {	\
-      (label) &= ~htonl(3<<20);		\
+#define IP6_ECN_flow_init(label) do {		\
+      (label) &= ~htonl(INET_ECN_MASK << 20);	\
     } while (0)
 
-#define	IP6_ECN_flow_xmit(sk, label) do {			\
-	if (INET_ECN_is_capable(inet_sk(sk)->tos))		\
-		(label) |= __constant_htons(2 << 4);		\
+#define	IP6_ECN_flow_xmit(sk, label) do {				\
+	if (INET_ECN_is_capable(inet_sk(sk)->tos))			\
+		(label) |= __constant_htons(INET_ECN_ECT_0 << 4);	\
     } while (0)
 
 static inline void IP_ECN_set_ce(struct iphdr *iph)
@@ -43,24 +52,24 @@
 	u32 check = iph->check;
 	check += __constant_htons(0xFFFE);
 	iph->check = check + (check>=0xFFFF);
-	iph->tos |= 1;
+	iph->tos |= INET_ECN_CE;
 }
 
 static inline void IP_ECN_clear(struct iphdr *iph)
 {
-	iph->tos &= ~3;
+	iph->tos &= ~INET_ECN_MASK;
 }
 
 struct ipv6hdr;
 
 static inline void IP6_ECN_set_ce(struct ipv6hdr *iph)
 {
-	*(u32*)iph |= htonl(1<<20);
+	*(u32*)iph |= htonl(INET_ECN_CE << 20);
 }
 
 static inline void IP6_ECN_clear(struct ipv6hdr *iph)
 {
-	*(u32*)iph &= ~htonl(3<<20);
+	*(u32*)iph &= ~htonl(INET_ECN_MASK << 20);
 }
 
 #define ip6_get_dsfield(iph) ((ntohs(*(u16*)(iph)) >> 4) & 0xFF)
diff -urN linux-2.6.8-rc2/include/net/ip.h linux-2.6.8-rc3/include/net/ip.h
--- linux-2.6.8-rc2/include/net/ip.h	2004-08-03 15:21:14.446812592 -0700
+++ linux-2.6.8-rc3/include/net/ip.h	2004-08-03 15:22:13.848249394 -0700
@@ -109,6 +109,9 @@
 extern int		ip_push_pending_frames(struct sock *sk);
 extern void		ip_flush_pending_frames(struct sock *sk);
 
+/* datagram.c */
+extern int		ip4_datagram_connect(struct sock *sk, 
+					     struct sockaddr *uaddr, int addr_len);
 
 /*
  *	Map a multicast IP onto multicast MAC for type Token Ring.
diff -urN linux-2.6.8-rc2/include/net/ip6_route.h linux-2.6.8-rc3/include/net/ip6_route.h
--- linux-2.6.8-rc2/include/net/ip6_route.h	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/include/net/ip6_route.h	2004-08-03 15:22:13.849249435 -0700
@@ -104,9 +104,7 @@
 
 /*
  *	Store a destination cache entry in a socket
- *	For UDP/RAW sockets this is done on udp_connect.
  */
-
 static inline void ip6_dst_store(struct sock *sk, struct dst_entry *dst,
 				     struct in6_addr *daddr)
 {
diff -urN linux-2.6.8-rc2/include/net/ipv6.h linux-2.6.8-rc3/include/net/ipv6.h
--- linux-2.6.8-rc2/include/net/ipv6.h	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/include/net/ipv6.h	2004-08-03 15:22:13.850249476 -0700
@@ -406,6 +406,9 @@
 
 extern void			ipv6_packet_cleanup(void);
 
+extern int			ip6_datagram_connect(struct sock *sk, 
+						     struct sockaddr *addr, int addr_len);
+
 extern int 			ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len);
 extern void			ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, u16 port,
 						u32 info, u8 *payload);
diff -urN linux-2.6.8-rc2/include/net/irda/irttp.h linux-2.6.8-rc3/include/net/irda/irttp.h
--- linux-2.6.8-rc2/include/net/irda/irttp.h	2004-06-15 22:19:02.000000000 -0700
+++ linux-2.6.8-rc3/include/net/irda/irttp.h	2004-08-03 15:22:13.899251486 -0700
@@ -210,6 +210,4 @@
 	return(irlap_is_primary(self->lsap->lap->irlap));
 }
 
-extern struct irttp_cb *irttp;
-
 #endif /* IRTTP_H */
diff -urN linux-2.6.8-rc2/include/net/netrom.h linux-2.6.8-rc3/include/net/netrom.h
--- linux-2.6.8-rc2/include/net/netrom.h	2004-06-15 22:19:31.000000000 -0700
+++ linux-2.6.8-rc3/include/net/netrom.h	2004-08-03 15:22:13.939253127 -0700
@@ -112,9 +112,6 @@
  *	nr_node & nr_neigh lists, refcounting and locking
  *********************************************************************/
 
-extern struct hlist_head nr_node_list;
-extern struct hlist_head nr_neigh_list;
-
 #define nr_node_hold(__nr_node) \
 	atomic_inc(&((__nr_node)->refcount))
 
diff -urN linux-2.6.8-rc2/include/net/pkt_sched.h linux-2.6.8-rc3/include/net/pkt_sched.h
--- linux-2.6.8-rc2/include/net/pkt_sched.h	2004-08-03 15:21:14.461813207 -0700
+++ linux-2.6.8-rc3/include/net/pkt_sched.h	2004-08-03 15:22:13.969254358 -0700
@@ -1,12 +1,6 @@
 #ifndef __NET_PKT_SCHED_H
 #define __NET_PKT_SCHED_H
 
-#define PSCHED_GETTIMEOFDAY	1
-#define PSCHED_JIFFIES 		2
-#define PSCHED_CPU 		3
-
-#define PSCHED_CLOCK_SOURCE	PSCHED_JIFFIES
-
 #include <linux/config.h>
 #include <linux/netdevice.h>
 #include <linux/types.h>
@@ -16,11 +10,6 @@
 #include <linux/module.h>
 #include <linux/rtnetlink.h>
 
-#ifdef CONFIG_X86_TSC
-#include <asm/msr.h>
-#endif
-
-
 struct rtattr;
 struct Qdisc;
 
@@ -116,43 +105,15 @@
 	int		refcnt;
 };
 
-static inline void sch_tree_lock(struct Qdisc *q)
-{
-	write_lock(&qdisc_tree_lock);
-	spin_lock_bh(&q->dev->queue_lock);
-}
-
-static inline void sch_tree_unlock(struct Qdisc *q)
-{
-	spin_unlock_bh(&q->dev->queue_lock);
-	write_unlock(&qdisc_tree_lock);
-}
-
-static inline void tcf_tree_lock(struct tcf_proto *tp)
-{
-	write_lock(&qdisc_tree_lock);
-	spin_lock_bh(&tp->q->dev->queue_lock);
-}
-
-static inline void tcf_tree_unlock(struct tcf_proto *tp)
-{
-	spin_unlock_bh(&tp->q->dev->queue_lock);
-	write_unlock(&qdisc_tree_lock);
-}
-
+extern void qdisc_lock_tree(struct net_device *dev);
+extern void qdisc_unlock_tree(struct net_device *dev);
 
-static inline unsigned long
-cls_set_class(struct tcf_proto *tp, unsigned long *clp, unsigned long cl)
-{
-	unsigned long old_cl;
-
-	tcf_tree_lock(tp);
-	old_cl = *clp;
-	*clp = cl;
-	tcf_tree_unlock(tp);
-	return old_cl;
-}
+#define sch_tree_lock(q)	qdisc_lock_tree((q)->dev)
+#define sch_tree_unlock(q)	qdisc_unlock_tree((q)->dev)
+#define tcf_tree_lock(tp)	qdisc_lock_tree((tp)->q->dev)
+#define tcf_tree_unlock(tp)	qdisc_unlock_tree((tp)->q->dev)
 
+#define cls_set_class(tp, clp, cl) tcf_set_class(tp, clp, cl)
 static inline unsigned long
 __cls_set_class(unsigned long *clp, unsigned long cl)
 {
@@ -184,25 +145,19 @@
    The reason is that, when it is not the same thing as
    gettimeofday, it returns invalid timestamp, which is
    not updated, when net_bh is active.
-
-   So, use PSCHED_CLOCK_SOURCE = PSCHED_CPU on alpha and pentiums
-   with rtdsc. And PSCHED_JIFFIES on all other architectures, including [34]86
-   and pentiums without rtdsc.
-   You can use PSCHED_GETTIMEOFDAY on another architectures,
-   which have fast and precise clock source, but it is too expensive.
  */
 
 /* General note about internal clock.
 
    Any clock source returns time intervals, measured in units
-   close to 1usec. With source PSCHED_GETTIMEOFDAY it is precisely
+   close to 1usec. With source CONFIG_NET_SCH_CLK_GETTIMEOFDAY it is precisely
    microseconds, otherwise something close but different chosen to minimize
    arithmetic cost. Ratio usec/internal untis in form nominator/denominator
    may be read from /proc/net/psched.
  */
 
 
-#if PSCHED_CLOCK_SOURCE == PSCHED_GETTIMEOFDAY
+#ifdef CONFIG_NET_SCH_CLK_GETTIMEOFDAY
 
 typedef struct timeval	psched_time_t;
 typedef long		psched_tdiff_t;
@@ -211,14 +166,12 @@
 #define PSCHED_US2JIFFIE(usecs) (((usecs)+(1000000/HZ-1))/(1000000/HZ))
 #define PSCHED_JIFFIE2US(delay) ((delay)*(1000000/HZ))
 
-#else /* PSCHED_CLOCK_SOURCE != PSCHED_GETTIMEOFDAY */
+#else /* !CONFIG_NET_SCH_CLK_GETTIMEOFDAY */
 
 typedef u64	psched_time_t;
 typedef long	psched_tdiff_t;
 
-extern psched_time_t	psched_time_base;
-
-#if PSCHED_CLOCK_SOURCE == PSCHED_JIFFIES
+#ifdef CONFIG_NET_SCH_CLK_JIFFIES
 
 #if HZ < 96
 #define PSCHED_JSCALE 14
@@ -236,47 +189,35 @@
 #define PSCHED_US2JIFFIE(delay) (((delay)+(1<<PSCHED_JSCALE)-1)>>PSCHED_JSCALE)
 #define PSCHED_JIFFIE2US(delay) ((delay)<<PSCHED_JSCALE)
 
-#elif PSCHED_CLOCK_SOURCE == PSCHED_CPU
+#endif /* CONFIG_NET_SCH_CLK_JIFFIES */
+#ifdef CONFIG_NET_SCH_CLK_CPU
+#include <asm/timex.h>
 
 extern psched_tdiff_t psched_clock_per_hz;
 extern int psched_clock_scale;
+extern psched_time_t psched_time_base;
+extern cycles_t psched_time_mark;
 
+#define PSCHED_GET_TIME(stamp)						\
+do {									\
+	cycles_t cur = get_cycles();					\
+	if (sizeof(cycles_t) == sizeof(u32)) {				\
+		if (cur <= psched_time_mark)				\
+			psched_time_base += 0x100000000ULL;		\
+		psched_time_mark = cur;					\
+		(stamp) = (psched_time_base + cur)>>psched_clock_scale;	\
+	} else {							\
+		(stamp) = cur>>psched_clock_scale;			\
+	}								\
+} while (0)
 #define PSCHED_US2JIFFIE(delay) (((delay)+psched_clock_per_hz-1)/psched_clock_per_hz)
 #define PSCHED_JIFFIE2US(delay) ((delay)*psched_clock_per_hz)
 
-#ifdef CONFIG_X86_TSC
-
-#define PSCHED_GET_TIME(stamp) \
-({ u64 __cur; \
-   rdtscll(__cur); \
-   (stamp) = __cur>>psched_clock_scale; \
-})
-
-#elif defined (__alpha__)
-
-#define PSCHED_WATCHER u32
-
-extern PSCHED_WATCHER psched_time_mark;
-
-#define PSCHED_GET_TIME(stamp) \
-({ u32 __res; \
-   __asm__ __volatile__ ("rpcc %0" : "r="(__res)); \
-   if (__res <= psched_time_mark) psched_time_base += 0x100000000UL; \
-   psched_time_mark = __res; \
-   (stamp) = (psched_time_base + __res)>>psched_clock_scale; \
-})
-
-#else
-
-#error PSCHED_CLOCK_SOURCE=PSCHED_CPU is not supported on this arch.
-
-#endif /* ARCH */
-
-#endif /* PSCHED_CLOCK_SOURCE == PSCHED_JIFFIES */
+#endif /* CONFIG_NET_SCH_CLK_CPU */
 
-#endif /* PSCHED_CLOCK_SOURCE == PSCHED_GETTIMEOFDAY */
+#endif /* !CONFIG_NET_SCH_CLK_GETTIMEOFDAY */
 
-#if PSCHED_CLOCK_SOURCE == PSCHED_GETTIMEOFDAY
+#ifdef CONFIG_NET_SCH_CLK_GETTIMEOFDAY
 #define PSCHED_TDIFF(tv1, tv2) \
 ({ \
 	   int __delta_sec = (tv1).tv_sec - (tv2).tv_sec; \
@@ -340,7 +281,7 @@
 
 #define	PSCHED_AUDIT_TDIFF(t) ({ if ((t) > 2000000) (t) = 2000000; })
 
-#else
+#else /* !CONFIG_NET_SCH_CLK_GETTIMEOFDAY */
 
 #define PSCHED_TDIFF(tv1, tv2) (long)((tv1) - (tv2))
 #define PSCHED_TDIFF_SAFE(tv1, tv2, bound) \
@@ -354,7 +295,7 @@
 #define PSCHED_IS_PASTPERFECT(t)	((t) == 0)
 #define	PSCHED_AUDIT_TDIFF(t)
 
-#endif
+#endif /* !CONFIG_NET_SCH_CLK_GETTIMEOFDAY */
 
 struct tcf_police
 {
@@ -438,6 +379,8 @@
 extern int tcf_act_police(struct sk_buff **skb, struct tc_action *a);
 #endif
 
+extern unsigned long tcf_set_class(struct tcf_proto *tp, unsigned long *clp, 
+				   unsigned long cl);
 extern int tcf_police(struct sk_buff *skb, struct tcf_police *p);
 extern int qdisc_copy_stats(struct sk_buff *skb, struct tc_stats *st, spinlock_t *lock);
 extern void tcf_police_destroy(struct tcf_police *p);
@@ -489,13 +432,6 @@
 
 extern int qdisc_restart(struct net_device *dev);
 
-static inline void qdisc_run(struct net_device *dev)
-{
-	while (!netif_queue_stopped(dev) &&
-	       qdisc_restart(dev)<0)
-		/* NOTHING */;
-}
-
 /* Calculate maximal size of packet seen by hard_start_xmit
    routine of this device.
  */
diff -urN linux-2.6.8-rc2/include/net/sctp/command.h linux-2.6.8-rc3/include/net/sctp/command.h
--- linux-2.6.8-rc2/include/net/sctp/command.h	2004-06-15 22:20:25.000000000 -0700
+++ linux-2.6.8-rc3/include/net/sctp/command.h	2004-08-03 15:22:13.977254686 -0700
@@ -94,6 +94,9 @@
 	SCTP_CMD_REPORT_FWDTSN,	 /* Report new cumulative TSN Ack. */
 	SCTP_CMD_PROCESS_FWDTSN, /* Skips were reported, so process further. */
 	SCTP_CMD_CLEAR_INIT_TAG, /* Clears association peer's inittag. */
+	SCTP_CMD_DEL_NON_PRIMARY, /* Removes non-primary peer transports. */
+	SCTP_CMD_T3_RTX_TIMERS_STOP, /* Stops T3-rtx pending timers */
+	SCTP_CMD_FORCE_PRIM_RETRAN,  /* Forces retrans. over primary path. */
 	SCTP_CMD_LAST
 } sctp_verb_t;
 
diff -urN linux-2.6.8-rc2/include/net/sctp/constants.h linux-2.6.8-rc3/include/net/sctp/constants.h
--- linux-2.6.8-rc2/include/net/sctp/constants.h	2004-06-15 22:19:11.000000000 -0700
+++ linux-2.6.8-rc3/include/net/sctp/constants.h	2004-08-03 15:22:14.036257106 -0700
@@ -175,6 +175,10 @@
 	SCTP_IERROR_BAD_TAG,
 	SCTP_IERROR_BIG_GAP,
 	SCTP_IERROR_DUP_TSN,
+	SCTP_IERROR_HIGH_TSN,
+	SCTP_IERROR_IGNORE_TSN,
+	SCTP_IERROR_NO_DATA,
+	SCTP_IERROR_BAD_STREAM,
 
 } sctp_ierror_t;
 
diff -urN linux-2.6.8-rc2/include/net/sctp/sm.h linux-2.6.8-rc3/include/net/sctp/sm.h
--- linux-2.6.8-rc2/include/net/sctp/sm.h	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/include/net/sctp/sm.h	2004-08-03 15:22:14.037257147 -0700
@@ -322,6 +322,9 @@
 				const struct sctp_chunk *chunk,
 				sctp_cmd_seq_t *commands,
 				struct sctp_chunk *err_chunk);
+int sctp_eat_data(const struct sctp_association *asoc,
+		  struct sctp_chunk *chunk,
+		  sctp_cmd_seq_t *commands);
 
 /* 3rd level prototypes */
 __u32 sctp_generate_tag(const struct sctp_endpoint *);
diff -urN linux-2.6.8-rc2/include/net/snmp.h linux-2.6.8-rc3/include/net/snmp.h
--- linux-2.6.8-rc2/include/net/snmp.h	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/include/net/snmp.h	2004-08-03 15:22:14.038257188 -0700
@@ -22,291 +22,102 @@
 #define _SNMP_H
 
 #include <linux/cache.h>
- 
+#include <linux/snmp.h>
+
 /*
- *	We use all unsigned longs. Linux will soon be so reliable that even these
- *	will rapidly get too small 8-). Seriously consider the IpInReceives count
- *	on the 20Gb/s + networks people expect in a few years time!
+ * Mibs are stored in array of unsigned long.
  */
-
-/* 
- * The rule for padding: 
- * Best is power of two because then the right structure can be found by a simple
- * shift. The structure should be always cache line aligned.
- * gcc needs n=alignto(cachelinesize, popcnt(sizeof(bla_mib))) shift/add instructions
- * to emulate multiply in case it is not power-of-two. Currently n is always <=3 for
- * all sizes so simple cache line alignment is enough. 
- * 
- * The best solution would be a global CPU local area , especially on 64 and 128byte 
- * cacheline machine it makes a *lot* of sense -AK
- */ 
-
-struct snmp_item {
+/*
+ * struct snmp_mib{}
+ *  - list of entries for particular API (such as /proc/net/snmp)
+ *  - name of entries.
+ */
+struct snmp_mib {
 	char *name;
-	int offset;
+	int entry;
 };
 
-#define SNMP_ITEM(mib,entry,procname)	{	\
-	.name = procname,			\
-	.offset = offsetof(mib, entry),		\
+#define SNMP_MIB_ITEM(_name,_entry)	{	\
+	.name = _name,				\
+	.entry = _entry,			\
 }
 
-#define SNMP_ITEM_SENTINEL {			\
-	.name = NULL,				\
-	.offset = 0,				\
+#define SNMP_MIB_SENTINEL {	\
+	.name = NULL,		\
+	.entry = 0,		\
 }
 
 /*
- * RFC 1213:  MIB-II
- * RFC 2011 (updates 1213):  SNMPv2-MIB-IP
- * RFC 2863:  Interfaces Group MIB
- * RFC 2465:  IPv6 MIB: General Group
- * draft-ietf-ipv6-rfc2011-update-10.txt: MIB for IP: IP Statistics Tables
+ * We use all unsigned longs. Linux will soon be so reliable that even 
+ * these will rapidly get too small 8-). Seriously consider the IpInReceives 
+ * count on the 20Gb/s + networks people expect in a few years time!
  */
-struct ipstats_mib
-{
-	unsigned long	InReceives;
- 	unsigned long	InHdrErrors;
- 	unsigned long	InTooBigErrors;
- 	unsigned long	InNoRoutes;
- 	unsigned long	InAddrErrors;
- 	unsigned long	InUnknownProtos;
- 	unsigned long	InTruncatedPkts;
- 	unsigned long	InDiscards;
- 	unsigned long	InDelivers;
- 	unsigned long	OutForwDatagrams;
- 	unsigned long	OutRequests;
- 	unsigned long	OutDiscards;
- 	unsigned long	OutNoRoutes;
- 	unsigned long	ReasmTimeout;
- 	unsigned long	ReasmReqds;
- 	unsigned long	ReasmOKs;
- 	unsigned long	ReasmFails;
- 	unsigned long	FragOKs;
- 	unsigned long	FragFails;
- 	unsigned long	FragCreates;
- 	unsigned long	InMcastPkts;
- 	unsigned long	OutMcastPkts;
-	unsigned long   __pad[0]; 
-};
- 
-/*
- * RFC 1213:  MIB-II ICMP Group
- * RFC 2011 (updates 1213):  SNMPv2 MIB for IP: ICMP group
- */
-struct icmp_mib
-{
- 	unsigned long	IcmpInMsgs;
- 	unsigned long	IcmpInErrors;
-  	unsigned long	IcmpInDestUnreachs;
- 	unsigned long	IcmpInTimeExcds;
- 	unsigned long	IcmpInParmProbs;
- 	unsigned long	IcmpInSrcQuenchs;
- 	unsigned long	IcmpInRedirects;
- 	unsigned long	IcmpInEchos;
- 	unsigned long	IcmpInEchoReps;
- 	unsigned long	IcmpInTimestamps;
- 	unsigned long	IcmpInTimestampReps;
- 	unsigned long	IcmpInAddrMasks;
- 	unsigned long	IcmpInAddrMaskReps;
- 	unsigned long	IcmpOutMsgs;
- 	unsigned long	IcmpOutErrors;
- 	unsigned long	IcmpOutDestUnreachs;
- 	unsigned long	IcmpOutTimeExcds;
- 	unsigned long	IcmpOutParmProbs;
- 	unsigned long	IcmpOutSrcQuenchs;
- 	unsigned long	IcmpOutRedirects;
- 	unsigned long	IcmpOutEchos;
- 	unsigned long	IcmpOutEchoReps;
- 	unsigned long	IcmpOutTimestamps;
- 	unsigned long	IcmpOutTimestampReps;
- 	unsigned long	IcmpOutAddrMasks;
- 	unsigned long	IcmpOutAddrMaskReps;
-	unsigned long	dummy;
-	unsigned long   __pad[0]; 
-};
 
-/*
- * RFC 2466:  ICMPv6-MIB
- */
-struct icmpv6_mib
-{
-	unsigned long	Icmp6InMsgs;
-	unsigned long	Icmp6InErrors;
-
-	unsigned long	Icmp6InDestUnreachs;
-	unsigned long	Icmp6InPktTooBigs;
-	unsigned long	Icmp6InTimeExcds;
-	unsigned long	Icmp6InParmProblems;
-
-	unsigned long	Icmp6InEchos;
-	unsigned long	Icmp6InEchoReplies;
-	unsigned long	Icmp6InGroupMembQueries;
-	unsigned long	Icmp6InGroupMembResponses;
-	unsigned long	Icmp6InGroupMembReductions;
-	unsigned long	Icmp6InRouterSolicits;
-	unsigned long	Icmp6InRouterAdvertisements;
-	unsigned long	Icmp6InNeighborSolicits;
-	unsigned long	Icmp6InNeighborAdvertisements;
-	unsigned long	Icmp6InRedirects;
-
-	unsigned long	Icmp6OutMsgs;
-
-	unsigned long	Icmp6OutDestUnreachs;
-	unsigned long	Icmp6OutPktTooBigs;
-	unsigned long	Icmp6OutTimeExcds;
-	unsigned long	Icmp6OutParmProblems;
-
-	unsigned long	Icmp6OutEchoReplies;
-	unsigned long	Icmp6OutRouterSolicits;
-	unsigned long	Icmp6OutNeighborSolicits;
-	unsigned long	Icmp6OutNeighborAdvertisements;
-	unsigned long	Icmp6OutRedirects;
-	unsigned long	Icmp6OutGroupMembResponses;
-	unsigned long	Icmp6OutGroupMembReductions;
-	unsigned long   __pad[0]; 
-};
- 
-/*
- * RFC 1213:  MIB-II TCP group
- * RFC 2012 (updates 1213):  SNMPv2-MIB-TCP
- */
-struct tcp_mib
-{
- 	unsigned long	TcpRtoAlgorithm;
- 	unsigned long	TcpRtoMin;
- 	unsigned long	TcpRtoMax;
- 	unsigned long	TcpMaxConn;
- 	unsigned long	TcpActiveOpens;
- 	unsigned long	TcpPassiveOpens;
- 	unsigned long	TcpAttemptFails;
- 	unsigned long	TcpEstabResets;
- 	unsigned long	TcpCurrEstab;
- 	unsigned long	TcpInSegs;
- 	unsigned long	TcpOutSegs;
- 	unsigned long	TcpRetransSegs;
- 	unsigned long	TcpInErrs;
- 	unsigned long	TcpOutRsts;
-	unsigned long   __pad[0]; 
-};
- 
-/*
- * RFC 1213:  MIB-II UDP group
- * RFC 2013 (updates 1213):  SNMPv2-MIB-UDP
- */
-struct udp_mib
-{
- 	unsigned long	UdpInDatagrams;
- 	unsigned long	UdpNoPorts;
- 	unsigned long	UdpInErrors;
- 	unsigned long	UdpOutDatagrams;
-	unsigned long   __pad[0];
-}; 
-
-/* draft-ietf-sigtran-sctp-mib-07.txt */
-struct sctp_mib
-{
-	unsigned long   SctpCurrEstab;
-	unsigned long   SctpActiveEstabs;
-	unsigned long   SctpPassiveEstabs;
-	unsigned long   SctpAborteds;
-	unsigned long   SctpShutdowns;
-	unsigned long   SctpOutOfBlues;
-	unsigned long   SctpChecksumErrors;
-	unsigned long   SctpOutCtrlChunks;
-	unsigned long   SctpOutOrderChunks;
-	unsigned long   SctpOutUnorderChunks;
-	unsigned long   SctpInCtrlChunks;
-	unsigned long   SctpInOrderChunks;
-	unsigned long   SctpInUnorderChunks;
-	unsigned long   SctpFragUsrMsgs;
-	unsigned long   SctpReasmUsrMsgs;
-	unsigned long   SctpOutSCTPPacks;
-	unsigned long   SctpInSCTPPacks;
-	unsigned long   SctpRtoAlgorithm;
-	unsigned long   SctpRtoMin;
-	unsigned long   SctpRtoMax;
-	unsigned long   SctpRtoInitial;
-	unsigned long   SctpValCookieLife;
-	unsigned long   SctpMaxInitRetr;
-	unsigned long   __pad[0];
-};
+/* 
+ * The rule for padding: 
+ * Best is power of two because then the right structure can be found by a 
+ * simple shift. The structure should be always cache line aligned.
+ * gcc needs n=alignto(cachelinesize, popcnt(sizeof(bla_mib))) shift/add 
+ * instructions to emulate multiply in case it is not power-of-two. 
+ * Currently n is always <=3 for all sizes so simple cache line alignment 
+ * is enough. 
+ * 
+ * The best solution would be a global CPU local area , especially on 64 
+ * and 128byte cacheline machine it makes a *lot* of sense -AK
+ */ 
+
+#define __SNMP_MIB_ALIGN__	____cacheline_aligned
 
-struct linux_mib 
-{
-	unsigned long	SyncookiesSent;
-	unsigned long	SyncookiesRecv;
-	unsigned long	SyncookiesFailed;
-	unsigned long	EmbryonicRsts;
-	unsigned long	PruneCalled; 
-	unsigned long	RcvPruned;
-	unsigned long	OfoPruned;
-	unsigned long	OutOfWindowIcmps; 
-	unsigned long	LockDroppedIcmps; 
-        unsigned long   ArpFilter;
-	unsigned long	TimeWaited; 
-	unsigned long	TimeWaitRecycled; 
-	unsigned long	TimeWaitKilled; 
-	unsigned long	PAWSPassiveRejected; 
-	unsigned long	PAWSActiveRejected; 
-	unsigned long	PAWSEstabRejected; 
-	unsigned long	DelayedACKs;
-	unsigned long	DelayedACKLocked;
-	unsigned long	DelayedACKLost;
-	unsigned long	ListenOverflows;
-	unsigned long	ListenDrops;
-	unsigned long	TCPPrequeued;
-	unsigned long	TCPDirectCopyFromBacklog;
-	unsigned long	TCPDirectCopyFromPrequeue;
-	unsigned long	TCPPrequeueDropped;
-	unsigned long	TCPHPHits;
-	unsigned long	TCPHPHitsToUser;
-	unsigned long	TCPPureAcks;
-	unsigned long	TCPHPAcks;
-	unsigned long	TCPRenoRecovery;
-	unsigned long	TCPSackRecovery;
-	unsigned long	TCPSACKReneging;
-	unsigned long	TCPFACKReorder;
-	unsigned long	TCPSACKReorder;
-	unsigned long	TCPRenoReorder;
-	unsigned long	TCPTSReorder;
-	unsigned long	TCPFullUndo;
-	unsigned long	TCPPartialUndo;
-	unsigned long	TCPDSACKUndo;
-	unsigned long	TCPLossUndo;
-	unsigned long	TCPLoss;
-	unsigned long	TCPLostRetransmit;
-	unsigned long	TCPRenoFailures;
-	unsigned long	TCPSackFailures;
-	unsigned long	TCPLossFailures;
-	unsigned long	TCPFastRetrans;
-	unsigned long	TCPForwardRetrans;
-	unsigned long	TCPSlowStartRetrans;
-	unsigned long	TCPTimeouts;
-	unsigned long	TCPRenoRecoveryFail;
-	unsigned long	TCPSackRecoveryFail;
-	unsigned long	TCPSchedulerFailed;
-	unsigned long	TCPRcvCollapsed;
-	unsigned long	TCPDSACKOldSent;
-	unsigned long	TCPDSACKOfoSent;
-	unsigned long	TCPDSACKRecv;
-	unsigned long	TCPDSACKOfoRecv;
-	unsigned long	TCPAbortOnSyn;
-	unsigned long	TCPAbortOnData;
-	unsigned long	TCPAbortOnClose;
-	unsigned long	TCPAbortOnMemory;
-	unsigned long	TCPAbortOnTimeout;
-	unsigned long	TCPAbortOnLinger;
-	unsigned long	TCPAbortFailed;
-	unsigned long	TCPMemoryPressures;
-	unsigned long   __pad[0];
+/* IPstats */
+#define IPSTATS_MIB_MAX	__IPSTATS_MIB_MAX
+struct ipstats_mib {
+	unsigned long	mibs[IPSTATS_MIB_MAX];
+} __SNMP_MIB_ALIGN__;
+
+/* ICMP */
+#define ICMP_MIB_DUMMY	__ICMP_MIB_MAX
+#define ICMP_MIB_MAX	(__ICMP_MIB_MAX + 1)
+
+struct icmp_mib {
+	unsigned long	mibs[ICMP_MIB_MAX];
+} __SNMP_MIB_ALIGN__;
+
+/* ICMP6 (IPv6-ICMP) */
+#define ICMP6_MIB_MAX	__ICMP6_MIB_MAX
+struct icmpv6_mib {
+	unsigned long	mibs[ICMP6_MIB_MAX];
+} __SNMP_MIB_ALIGN__;
+
+/* TCP */
+#define TCP_MIB_MAX	__TCP_MIB_MAX
+struct tcp_mib {
+	unsigned long	mibs[TCP_MIB_MAX];
+} __SNMP_MIB_ALIGN__;
+
+/* UDP */
+#define UDP_MIB_MAX	__UDP_MIB_MAX
+struct udp_mib {
+	unsigned long	mibs[UDP_MIB_MAX];
+} __SNMP_MIB_ALIGN__;
+
+/* SCTP */
+#define SCTP_MIB_MAX	__SCTP_MIB_MAX
+struct sctp_mib {
+	unsigned long	mibs[SCTP_MIB_MAX];
+} __SNMP_MIB_ALIGN__;
+
+/* Linux */
+#define LINUX_MIB_MAX	__LINUX_MIB_MAX
+struct linux_mib {
+	unsigned long	mibs[LINUX_MIB_MAX];
 };
 
 
 /* 
- * FIXME: On x86 and some other CPUs the split into user and softirq parts is not needed because 
- * addl $1,memory is atomic against interrupts (but atomic_inc would be overkill because of the lock 
- * cycles). Wants new nonlocked_atomic_inc() primitives -AK
+ * FIXME: On x86 and some other CPUs the split into user and softirq parts
+ * is not needed because addl $1,memory is atomic against interrupts (but 
+ * atomic_inc would be overkill because of the lock cycles). Wants new 
+ * nonlocked_atomic_inc() primitives -AK
  */ 
 #define DEFINE_SNMP_STAT(type, name)	\
 	__typeof__(type) *name[2]
@@ -317,18 +128,18 @@
 #define SNMP_STAT_USRPTR(name)	(name[1])
 
 #define SNMP_INC_STATS_BH(mib, field) 	\
-	(per_cpu_ptr(mib[0], smp_processor_id())->field++)
+	(per_cpu_ptr(mib[0], smp_processor_id())->mibs[field]++)
 #define SNMP_INC_STATS_OFFSET_BH(mib, field, offset)	\
-	((*((&per_cpu_ptr(mib[0], smp_processor_id())->field) + (offset)))++)
+	(per_cpu_ptr(mib[0], smp_processor_id())->mibs[field + (offset)]++)
 #define SNMP_INC_STATS_USER(mib, field) \
-	(per_cpu_ptr(mib[1], smp_processor_id())->field++)
+	(per_cpu_ptr(mib[1], smp_processor_id())->mibs[field]++)
 #define SNMP_INC_STATS(mib, field) 	\
-	(per_cpu_ptr(mib[!in_softirq()], smp_processor_id())->field++)
+	(per_cpu_ptr(mib[!in_softirq()], smp_processor_id())->mibs[field]++)
 #define SNMP_DEC_STATS(mib, field) 	\
-	(per_cpu_ptr(mib[!in_softirq()], smp_processor_id())->field--)
+	(per_cpu_ptr(mib[!in_softirq()], smp_processor_id())->mibs[field]--)
 #define SNMP_ADD_STATS_BH(mib, field, addend) 	\
-	(per_cpu_ptr(mib[0], smp_processor_id())->field += addend)
+	(per_cpu_ptr(mib[0], smp_processor_id())->mibs[field] += addend)
 #define SNMP_ADD_STATS_USER(mib, field, addend) 	\
-	(per_cpu_ptr(mib[1], smp_processor_id())->field += addend)
- 	
+	(per_cpu_ptr(mib[1], smp_processor_id())->mibs[field] += addend)
+
 #endif
diff -urN linux-2.6.8-rc2/include/net/tcp.h linux-2.6.8-rc3/include/net/tcp.h
--- linux-2.6.8-rc2/include/net/tcp.h	2004-08-03 15:21:14.466813413 -0700
+++ linux-2.6.8-rc3/include/net/tcp.h	2004-08-03 15:22:14.122260634 -0700
@@ -1543,7 +1543,7 @@
 
 			while ((skb1 = __skb_dequeue(&tp->ucopy.prequeue)) != NULL) {
 				sk->sk_backlog_rcv(sk, skb1);
-				NET_INC_STATS_BH(TCPPrequeueDropped);
+				NET_INC_STATS_BH(LINUX_MIB_TCPPREQUEUEDROPPED);
 			}
 
 			tp->ucopy.memory = 0;
@@ -1575,12 +1575,12 @@
 	switch (state) {
 	case TCP_ESTABLISHED:
 		if (oldstate != TCP_ESTABLISHED)
-			TCP_INC_STATS(TcpCurrEstab);
+			TCP_INC_STATS(TCP_MIB_CURRESTAB);
 		break;
 
 	case TCP_CLOSE:
 		if (oldstate == TCP_CLOSE_WAIT || oldstate == TCP_ESTABLISHED)
-			TCP_INC_STATS(TcpEstabResets);
+			TCP_INC_STATS(TCP_MIB_ESTABRESETS);
 
 		sk->sk_prot->unhash(sk);
 		if (tcp_sk(sk)->bind_hash &&
@@ -1589,7 +1589,7 @@
 		/* fall through */
 	default:
 		if (oldstate==TCP_ESTABLISHED)
-			TCP_DEC_STATS(TcpCurrEstab);
+			TCP_DEC_STATS(TCP_MIB_CURRESTAB);
 	}
 
 	/* Change state AFTER socket is unhashed to avoid closed
@@ -1961,10 +1961,10 @@
 static inline void tcp_mib_init(void)
 {
 	/* See RFC 2012 */
-	TCP_ADD_STATS_USER(TcpRtoAlgorithm, 1);
-	TCP_ADD_STATS_USER(TcpRtoMin, TCP_RTO_MIN*1000/HZ);
-	TCP_ADD_STATS_USER(TcpRtoMax, TCP_RTO_MAX*1000/HZ);
-	TCP_ADD_STATS_USER(TcpMaxConn, -1);
+	TCP_ADD_STATS_USER(TCP_MIB_RTOALGORITHM, 1);
+	TCP_ADD_STATS_USER(TCP_MIB_RTOMIN, TCP_RTO_MIN*1000/HZ);
+	TCP_ADD_STATS_USER(TCP_MIB_RTOMAX, TCP_RTO_MAX*1000/HZ);
+	TCP_ADD_STATS_USER(TCP_MIB_MAXCONN, -1);
 }
 
 /* /proc */
diff -urN linux-2.6.8-rc2/include/net/udp.h linux-2.6.8-rc3/include/net/udp.h
--- linux-2.6.8-rc2/include/net/udp.h	2004-06-15 22:19:51.000000000 -0700
+++ linux-2.6.8-rc3/include/net/udp.h	2004-08-03 15:22:14.123260675 -0700
@@ -64,8 +64,6 @@
 
 
 extern void	udp_err(struct sk_buff *, u32);
-extern int	udp_connect(struct sock *sk,
-			    struct sockaddr *usin, int addr_len);
 
 extern int	udp_sendmsg(struct kiocb *iocb, struct sock *sk,
 			    struct msghdr *msg, size_t len);
diff -urN linux-2.6.8-rc2/include/net/xfrm.h linux-2.6.8-rc3/include/net/xfrm.h
--- linux-2.6.8-rc2/include/net/xfrm.h	2004-08-03 15:21:14.467813454 -0700
+++ linux-2.6.8-rc3/include/net/xfrm.h	2004-08-03 15:22:14.124260716 -0700
@@ -821,14 +821,13 @@
 extern int xfrm4_output(struct sk_buff **pskb);
 extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler);
 extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler);
-extern int xfrm4_tunnel_check_size(struct sk_buff *skb);
 extern int xfrm6_rcv(struct sk_buff **pskb, unsigned int *nhoffp);
 extern int xfrm6_tunnel_register(struct xfrm6_tunnel *handler);
 extern int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler);
-extern int xfrm6_tunnel_check_size(struct sk_buff *skb);
 extern u32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr);
 extern void xfrm6_tunnel_free_spi(xfrm_address_t *saddr);
 extern u32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr);
+extern int xfrm6_output(struct sk_buff **pskb);
 
 #ifdef CONFIG_XFRM
 extern int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type);
diff -urN linux-2.6.8-rc2/include/scsi/sg.h linux-2.6.8-rc3/include/scsi/sg.h
--- linux-2.6.8-rc2/include/scsi/sg.h	2004-06-15 22:19:17.000000000 -0700
+++ linux-2.6.8-rc3/include/scsi/sg.h	2004-08-03 15:22:14.403272162 -0700
@@ -76,7 +76,7 @@
 	http://www.torque.net/sg/p/scsi-generic_long.txt
  A version of this document (potentially out of date) may also be found in
  the kernel source tree, probably at:
-        /usr/src/linux/Documentation/scsi/scsi-generic.txt .
+        Documentation/scsi/scsi-generic.txt .
 
  Utility and test programs are available at the sg web site. They are 
  bundled as sg_utils (for the lk 2.2 series) and sg3_utils (for the
diff -urN linux-2.6.8-rc2/include/sound/asound.h linux-2.6.8-rc3/include/sound/asound.h
--- linux-2.6.8-rc2/include/sound/asound.h	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/include/sound/asound.h	2004-08-03 15:22:14.542277864 -0700
@@ -33,13 +33,15 @@
 #include <linux/time.h>
 #include <asm/byteorder.h>
 
-#if  __LITTLE_ENDIAN == 1234
+#ifdef  __LITTLE_ENDIAN
 #define SNDRV_LITTLE_ENDIAN
-#elif __BIG_ENDIAN == 4321
+#else
+#ifdef __BIG_ENDIAN
 #define SNDRV_BIG_ENDIAN
 #else
 #error "Unsupported endian..."
 #endif
+#endif
 
 #else /* !__KERNEL__ */
 
diff -urN linux-2.6.8-rc2/include/video/vga.h linux-2.6.8-rc3/include/video/vga.h
--- linux-2.6.8-rc2/include/video/vga.h	2004-06-15 22:19:42.000000000 -0700
+++ linux-2.6.8-rc3/include/video/vga.h	2004-08-03 15:22:14.585279628 -0700
@@ -26,8 +26,15 @@
 /*
  * FIXME
  * Ugh, we don't have PCI space, so map readb() and friends to use Zorro space
- * for MMIO accesses. This should make clgenfb work again on Amiga
+ * for MMIO accesses. This should make cirrusfb work again on Amiga
  */
+#undef inb_p
+#undef inw_p
+#undef outb_p
+#undef outw
+#undef readb
+#undef writeb
+#undef writew
 #define inb_p(port)	0
 #define inw_p(port)	0
 #define outb_p(port, val)	do { } while (0)
diff -urN linux-2.6.8-rc2/init/Kconfig linux-2.6.8-rc3/init/Kconfig
--- linux-2.6.8-rc2/init/Kconfig	2004-08-03 15:21:14.502814889 -0700
+++ linux-2.6.8-rc3/init/Kconfig	2004-08-03 15:22:14.586279669 -0700
@@ -41,15 +41,6 @@
 
 	  If unsure, say Y
 
-config STANDALONE
-	bool "Select only drivers that don't need compile-time external firmware" if EXPERIMENTAL
-	default y
-	help
-	  Select this option if you don't have magic firmware for drivers that
-	  need it.
-
-	  If unsure, say Y.
-
 config BROKEN
 	bool
 	depends on !CLEAN_COMPILE
diff -urN linux-2.6.8-rc2/kernel/acct.c linux-2.6.8-rc3/kernel/acct.c
--- linux-2.6.8-rc2/kernel/acct.c	2004-08-03 15:21:14.656821207 -0700
+++ linux-2.6.8-rc3/kernel/acct.c	2004-08-03 15:22:15.072299607 -0700
@@ -398,7 +398,7 @@
 	 */
 	memset((caddr_t)&ac, 0, sizeof(acct_t));
 
-	ac.ac_version = ACCT_VERSION;
+	ac.ac_version = ACCT_VERSION | ACCT_BYTEORDER;
 	strlcpy(ac.ac_comm, current->comm, sizeof(ac.ac_comm));
 
 	elapsed = jiffies_64_to_AHZ(get_jiffies_64() - current->start_time);
@@ -441,8 +441,7 @@
 		old_encode_dev(tty_devnum(current->signal->tty)) : 0;
 	read_unlock(&tasklist_lock);
 
-	/* ABYTESEX is always set to allow byte order detection */
-	ac.ac_flag = ABYTESEX;
+	ac.ac_flag = 0;
 	if (current->flags & PF_FORKNOEXEC)
 		ac.ac_flag |= AFORK;
 	if (current->flags & PF_SUPERPRIV)
diff -urN linux-2.6.8-rc2/kernel/compat.c linux-2.6.8-rc3/kernel/compat.c
--- linux-2.6.8-rc2/kernel/compat.c	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/kernel/compat.c	2004-08-03 15:22:15.118301494 -0700
@@ -531,7 +531,7 @@
 	err = sys_clock_getres(which_clock,
 			       (struct timespec __user *) &ts);
 	set_fs(oldfs);
-	if (!err && put_compat_timespec(&ts, tp))
+	if (!err && tp && put_compat_timespec(&ts, tp))
 		return -EFAULT; 
 	return err;
 } 
diff -urN linux-2.6.8-rc2/kernel/fork.c linux-2.6.8-rc3/kernel/fork.c
--- linux-2.6.8-rc2/kernel/fork.c	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/kernel/fork.c	2004-08-03 15:22:15.256307155 -0700
@@ -974,7 +974,6 @@
  	}
 #endif
 
-	retval = -ENOMEM;
 	if ((retval = security_task_alloc(p)))
 		goto bad_fork_cleanup_policy;
 	if ((retval = audit_alloc(p)))
diff -urN linux-2.6.8-rc2/kernel/module.c linux-2.6.8-rc3/kernel/module.c
--- linux-2.6.8-rc2/kernel/module.c	2004-08-03 15:21:14.785826499 -0700
+++ linux-2.6.8-rc3/kernel/module.c	2004-08-03 15:22:15.346310847 -0700
@@ -51,9 +51,6 @@
 /* If this is set, the section belongs in the init part of the module */
 #define INIT_OFFSET_MASK (1UL << (BITS_PER_LONG-1))
 
-#define symbol_is(literal, string)				\
-	(strcmp(MODULE_SYMBOL_PREFIX literal, (string)) == 0)
-
 /* Protects module list */
 static spinlock_t modlist_lock = SPIN_LOCK_UNLOCKED;
 
diff -urN linux-2.6.8-rc2/kernel/rcupdate.c linux-2.6.8-rc3/kernel/rcupdate.c
--- linux-2.6.8-rc2/kernel/rcupdate.c	2004-08-03 15:21:14.908831546 -0700
+++ linux-2.6.8-rc3/kernel/rcupdate.c	2004-08-03 15:22:15.434314457 -0700
@@ -210,16 +210,18 @@
  * locking requirements, the list it's pulling from has to belong to a cpu
  * which is dead and hence not processing interrupts.
  */
-static void rcu_move_batch(struct list_head *list)
+static void rcu_move_batch(struct rcu_head *list)
 {
-	struct list_head *entry;
-	int cpu = smp_processor_id();
+	int cpu;
 
 	local_irq_disable();
-	while (!list_empty(list)) {
-		entry = list->next;
-		list_del(entry);
-		list_add_tail(entry, &RCU_nxtlist(cpu));
+
+	cpu = smp_processor_id();
+
+	while (list != NULL) {
+		*RCU_nxttail(cpu) = list;
+		RCU_nxttail(cpu) = &list->next;
+		list = list->next;
 	}
 	local_irq_enable();
 }
@@ -233,11 +235,10 @@
 	spin_lock_bh(&rcu_state.mutex);
 	if (rcu_ctrlblk.cur != rcu_ctrlblk.completed)
 		cpu_quiet(cpu);
-unlock:
 	spin_unlock_bh(&rcu_state.mutex);
 
-	rcu_move_batch(&RCU_curlist(cpu));
-	rcu_move_batch(&RCU_nxtlist(cpu));
+	rcu_move_batch(RCU_curlist(cpu));
+	rcu_move_batch(RCU_nxtlist(cpu));
 
 	tasklet_kill_immediate(&RCU_tasklet(cpu), cpu);
 }
diff -urN linux-2.6.8-rc2/kernel/sched.c linux-2.6.8-rc3/kernel/sched.c
--- linux-2.6.8-rc2/kernel/sched.c	2004-08-03 15:21:14.935832653 -0700
+++ linux-2.6.8-rc3/kernel/sched.c	2004-08-03 15:22:15.527318273 -0700
@@ -1095,7 +1095,7 @@
 {
 	unsigned long i, sum = 0;
 
-	for_each_online_cpu(i)
+	for_each_cpu(i)
 		sum += cpu_rq(i)->nr_uninterruptible;
 
 	return sum;
@@ -1105,7 +1105,7 @@
 {
 	unsigned long long i, sum = 0;
 
-	for_each_online_cpu(i)
+	for_each_cpu(i)
 		sum += cpu_rq(i)->nr_switches;
 
 	return sum;
@@ -1115,7 +1115,7 @@
 {
 	unsigned long i, sum = 0;
 
-	for_each_online_cpu(i)
+	for_each_cpu(i)
 		sum += atomic_read(&cpu_rq(i)->nr_iowait);
 
 	return sum;
@@ -3922,6 +3922,7 @@
 	sched_domain_init.groups = &sched_group_init;
 	sched_domain_init.last_balance = jiffies;
 	sched_domain_init.balance_interval = INT_MAX; /* Don't balance */
+	sched_domain_init.busy_factor = 1;
 
 	memset(&sched_group_init, 0, sizeof(struct sched_group));
 	sched_group_init.cpumask = CPU_MASK_ALL;
diff -urN linux-2.6.8-rc2/kernel/sysctl.c linux-2.6.8-rc3/kernel/sysctl.c
--- linux-2.6.8-rc2/kernel/sysctl.c	2004-08-03 15:21:14.994835074 -0700
+++ linux-2.6.8-rc3/kernel/sysctl.c	2004-08-03 15:22:15.580320447 -0700
@@ -113,7 +113,7 @@
 #if defined(CONFIG_PPC32) && defined(CONFIG_6xx)
 extern unsigned long powersave_nap;
 int proc_dol2crvec(ctl_table *table, int write, struct file *filp,
-		  void *buffer, size_t *lenp);
+		  void __user *buffer, size_t *lenp);
 #endif
 
 #ifdef CONFIG_BSD_PROCESS_ACCT
@@ -1436,7 +1436,7 @@
 			      int write, void *data),
 		  void *data)
 {
-#define TMPBUFLEN 20
+#define TMPBUFLEN 21
 	int *i, vleft, first=1, neg, val;
 	unsigned long lval;
 	size_t left, len;
@@ -1676,7 +1676,7 @@
 				     unsigned long convmul,
 				     unsigned long convdiv)
 {
-#define TMPBUFLEN 20
+#define TMPBUFLEN 21
 	unsigned long *i, *min, *max, val;
 	int vleft, first=1, neg;
 	size_t len, left;
diff -urN linux-2.6.8-rc2/kernel/timer.c linux-2.6.8-rc3/kernel/timer.c
--- linux-2.6.8-rc2/kernel/timer.c	2004-08-03 15:21:14.995835115 -0700
+++ linux-2.6.8-rc3/kernel/timer.c	2004-08-03 15:22:15.602321349 -0700
@@ -792,12 +792,12 @@
 
 	psecs = (p->utime += user);
 	psecs += (p->stime += system);
-	if (psecs / HZ > p->rlim[RLIMIT_CPU].rlim_cur) {
+	if (psecs / HZ >= p->rlim[RLIMIT_CPU].rlim_cur) {
 		/* Send SIGXCPU every second.. */
 		if (!(psecs % HZ))
 			send_sig(SIGXCPU, p, 1);
 		/* and SIGKILL when we go over max.. */
-		if (psecs / HZ > p->rlim[RLIMIT_CPU].rlim_max)
+		if (psecs / HZ >= p->rlim[RLIMIT_CPU].rlim_max)
 			send_sig(SIGKILL, p, 1);
 	}
 }
diff -urN linux-2.6.8-rc2/lib/string.c linux-2.6.8-rc3/lib/string.c
--- linux-2.6.8-rc2/lib/string.c	2004-08-03 15:21:15.267846273 -0700
+++ linux-2.6.8-rc3/lib/string.c	2004-08-03 15:22:15.799329431 -0700
@@ -75,6 +75,7 @@
 		/* nothing */;
 	return tmp;
 }
+EXPORT_SYMBOL(strcpy);
 #endif
 
 #ifndef __HAVE_ARCH_STRNCPY
@@ -98,6 +99,7 @@
 	}
 	return dest;
 }
+EXPORT_SYMBOL(strncpy);
 #endif
 
 #ifndef __HAVE_ARCH_STRLCPY
@@ -143,6 +145,7 @@
 
 	return tmp;
 }
+EXPORT_SYMBOL(strcat);
 #endif
 
 #ifndef __HAVE_ARCH_STRNCAT
@@ -172,6 +175,7 @@
 
 	return tmp;
 }
+EXPORT_SYMBOL(strncat);
 #endif
 
 #ifndef __HAVE_ARCH_STRLCAT
@@ -218,6 +222,7 @@
 
 	return __res;
 }
+EXPORT_SYMBOL(strcmp);
 #endif
 
 #ifndef __HAVE_ARCH_STRNCMP
@@ -239,6 +244,7 @@
 
 	return __res;
 }
+EXPORT_SYMBOL(strncmp);
 #endif
 
 #ifndef __HAVE_ARCH_STRCHR
@@ -254,6 +260,7 @@
 			return NULL;
 	return (char *) s;
 }
+EXPORT_SYMBOL(strchr);
 #endif
 
 #ifndef __HAVE_ARCH_STRRCHR
@@ -271,6 +278,7 @@
        } while (--p >= s);
        return NULL;
 }
+EXPORT_SYMBOL(strrchr);
 #endif
 
 #ifndef __HAVE_ARCH_STRNCHR
@@ -287,6 +295,7 @@
 			return (char *) s;
 	return NULL;
 }
+EXPORT_SYMBOL(strnchr);
 #endif
 
 #ifndef __HAVE_ARCH_STRLEN
@@ -302,6 +311,7 @@
 		/* nothing */;
 	return sc - s;
 }
+EXPORT_SYMBOL(strlen);
 #endif
 
 #ifndef __HAVE_ARCH_STRNLEN
@@ -318,6 +328,7 @@
 		/* nothing */;
 	return sc - s;
 }
+EXPORT_SYMBOL(strnlen);
 #endif
 
 #ifndef __HAVE_ARCH_STRSPN
@@ -371,6 +382,7 @@
 
 	return count;
 }	
+EXPORT_SYMBOL(strcspn);
 
 #ifndef __HAVE_ARCH_STRPBRK
 /**
@@ -390,6 +402,7 @@
 	}
 	return NULL;
 }
+EXPORT_SYMBOL(strpbrk);
 #endif
 
 #ifndef __HAVE_ARCH_STRSEP
@@ -440,6 +453,7 @@
 
 	return s;
 }
+EXPORT_SYMBOL(memset);
 #endif
 
 #ifndef __HAVE_ARCH_BCOPY
@@ -463,6 +477,7 @@
 	while (count--)
 		*dest++ = *src++;
 }
+EXPORT_SYMBOL(bcopy);
 #endif
 
 #ifndef __HAVE_ARCH_MEMCPY
@@ -484,6 +499,7 @@
 
 	return dest;
 }
+EXPORT_SYMBOL(memcpy);
 #endif
 
 #ifndef __HAVE_ARCH_MEMMOVE
@@ -514,6 +530,7 @@
 
 	return dest;
 }
+EXPORT_SYMBOL(memmove);
 #endif
 
 #ifndef __HAVE_ARCH_MEMCMP
@@ -533,6 +550,7 @@
 			break;
 	return res;
 }
+EXPORT_SYMBOL(memcmp);
 #endif
 
 #ifndef __HAVE_ARCH_MEMSCAN
@@ -557,6 +575,7 @@
 	}
   	return (void *) p;
 }
+EXPORT_SYMBOL(memscan);
 #endif
 
 #ifndef __HAVE_ARCH_STRSTR
@@ -581,6 +600,7 @@
 	}
 	return NULL;
 }
+EXPORT_SYMBOL(strstr);
 #endif
 
 #ifndef __HAVE_ARCH_MEMCHR
@@ -603,5 +623,5 @@
 	}
 	return NULL;
 }
-
+EXPORT_SYMBOL(memchr);
 #endif
diff -urN linux-2.6.8-rc2/mm/filemap.c linux-2.6.8-rc3/mm/filemap.c
--- linux-2.6.8-rc2/mm/filemap.c	2004-08-03 15:21:15.331848899 -0700
+++ linux-2.6.8-rc3/mm/filemap.c	2004-08-03 15:22:15.908333903 -0700
@@ -440,10 +440,6 @@
 {
 	struct page *page;
 
-	/*
-	 * We scan the hash list read-only. Addition to and removal from
-	 * the hash-list needs a held write-lock.
-	 */
 	spin_lock_irq(&mapping->tree_lock);
 	page = radix_tree_lookup(&mapping->page_tree, offset);
 	if (page)
@@ -1421,15 +1417,9 @@
 			return err;
 		}
 	} else {
-	    	/*
-		 * If a nonlinear mapping then store the file page offset
-		 * in the pte.
-		 */
-		if (pgoff != linear_page_index(vma, addr)) {
-	    		err = install_file_pte(mm, vma, addr, pgoff, prot);
-			if (err)
-		    		return err;
-		}
+		err = install_file_pte(mm, vma, addr, pgoff, prot);
+		if (err)
+			return err;
 	}
 
 	len -= PAGE_SIZE;
diff -urN linux-2.6.8-rc2/mm/fremap.c linux-2.6.8-rc3/mm/fremap.c
--- linux-2.6.8-rc2/mm/fremap.c	2004-08-03 15:21:15.367850376 -0700
+++ linux-2.6.8-rc3/mm/fremap.c	2004-08-03 15:22:15.909333944 -0700
@@ -55,18 +55,14 @@
 int install_page(struct mm_struct *mm, struct vm_area_struct *vma,
 		unsigned long addr, struct page *page, pgprot_t prot)
 {
+	struct inode *inode;
+	pgoff_t size;
 	int err = -ENOMEM;
 	pte_t *pte;
 	pgd_t *pgd;
 	pmd_t *pmd;
 	pte_t pte_val;
 
-	/*
-	 * We use page_add_file_rmap below: if install_page is
-	 * ever extended to anonymous pages, this will warn us.
-	 */
-	BUG_ON(!page_mapping(page));
-
 	pgd = pgd_offset(mm, addr);
 	spin_lock(&mm->page_table_lock);
 
@@ -78,6 +74,16 @@
 	if (!pte)
 		goto err_unlock;
 
+	/*
+	 * This page may have been truncated. Tell the
+	 * caller about it.
+	 */
+	err = -EINVAL;
+	inode = vma->vm_file->f_mapping->host;
+	size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
+	if (!page->mapping || page->index >= size)
+		goto err_unlock;
+
 	zap_pte(mm, vma, addr, pte);
 
 	mm->rss++;
diff -urN linux-2.6.8-rc2/mm/highmem.c linux-2.6.8-rc3/mm/highmem.c
--- linux-2.6.8-rc2/mm/highmem.c	2004-08-03 15:21:15.369850458 -0700
+++ linux-2.6.8-rc3/mm/highmem.c	2004-08-03 15:22:15.999337636 -0700
@@ -308,12 +308,10 @@
 {
 	struct bio *bio_orig = bio->bi_private;
 	struct bio_vec *bvec, *org_vec;
-	int i;
+	int i, err = 0;
 
 	if (!test_bit(BIO_UPTODATE, &bio->bi_flags))
-		goto out_eio;
-
-	set_bit(BIO_UPTODATE, &bio_orig->bi_flags);
+		err = -EIO;
 
 	/*
 	 * free up bounce indirect pages used
@@ -326,8 +324,7 @@
 		mempool_free(bvec->bv_page, pool);	
 	}
 
-out_eio:
-	bio_endio(bio_orig, bio_orig->bi_size, 0);
+	bio_endio(bio_orig, bio_orig->bi_size, err);
 	bio_put(bio);
 }
 
diff -urN linux-2.6.8-rc2/mm/memory.c linux-2.6.8-rc3/mm/memory.c
--- linux-2.6.8-rc2/mm/memory.c	2004-08-03 15:21:15.463854314 -0700
+++ linux-2.6.8-rc3/mm/memory.c	2004-08-03 15:22:16.033339031 -0700
@@ -727,7 +727,7 @@
 			pte_t *pte;
 			if (write) /* user gate pages are read-only */
 				return i ? : -EFAULT;
-			pgd = pgd_offset(mm, pg);
+			pgd = pgd_offset_gate(mm, pg);
 			if (!pgd)
 				return i ? : -EFAULT;
 			pmd = pmd_offset(pgd, pg);
diff -urN linux-2.6.8-rc2/mm/mmap.c linux-2.6.8-rc3/mm/mmap.c
--- linux-2.6.8-rc2/mm/mmap.c	2004-08-03 15:21:15.516856489 -0700
+++ linux-2.6.8-rc3/mm/mmap.c	2004-08-03 15:22:16.118342518 -0700
@@ -750,6 +750,13 @@
 	int accountable = 1;
 	unsigned long charged = 0;
 
+	/*
+	 * Does the application expect PROT_READ to imply PROT_EXEC:
+	 */
+	if (unlikely((prot & PROT_READ) &&
+			(current->personality & READ_IMPLIES_EXEC)))
+		prot |= PROT_EXEC;
+
 	if (file) {
 		if (is_file_hugepages(file))
 			accountable = 0;
@@ -792,12 +799,6 @@
 	vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
 			mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
 
-	/*
-	 * mm->def_flags might have VM_EXEC set, which PROT_NONE does NOT want.
-	 */
-	if (prot == PROT_NONE)
-		vm_flags &= ~VM_EXEC;
-
 	if (flags & MAP_LOCKED) {
 		if (!capable(CAP_IPC_LOCK))
 			return -EPERM;
diff -urN linux-2.6.8-rc2/mm/mprotect.c linux-2.6.8-rc3/mm/mprotect.c
--- linux-2.6.8-rc2/mm/mprotect.c	2004-08-03 15:21:15.516856489 -0700
+++ linux-2.6.8-rc3/mm/mprotect.c	2004-08-03 15:22:16.134343174 -0700
@@ -17,6 +17,7 @@
 #include <linux/highmem.h>
 #include <linux/security.h>
 #include <linux/mempolicy.h>
+#include <linux/personality.h>
 
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -205,6 +206,12 @@
 		return -EINVAL;
 	if (end == start)
 		return 0;
+	/*
+	 * Does the application expect PROT_READ to imply PROT_EXEC:
+	 */
+	if (unlikely((prot & PROT_READ) &&
+			(current->personality & READ_IMPLIES_EXEC)))
+		prot |= PROT_EXEC;
 
 	vm_flags = calc_vm_prot_bits(prot);
 
diff -urN linux-2.6.8-rc2/mm/oom_kill.c linux-2.6.8-rc3/mm/oom_kill.c
--- linux-2.6.8-rc2/mm/oom_kill.c	2004-08-03 15:21:15.580859114 -0700
+++ linux-2.6.8-rc3/mm/oom_kill.c	2004-08-03 15:22:16.173344774 -0700
@@ -220,7 +220,7 @@
 /**
  * out_of_memory - is the system out of memory?
  */
-void out_of_memory(void)
+void out_of_memory(int gfp_mask)
 {
 	/*
 	 * oom_lock protects out_of_memory()'s static variables.
@@ -271,6 +271,9 @@
 	 */
 	lastkill = now;
 
+	printk("oom-killer: gfp_mask=0x%x\n", gfp_mask);
+	show_free_areas();
+
 	/* oom_kill() sleeps */
 	spin_unlock(&oom_lock);
 	oom_kill();
diff -urN linux-2.6.8-rc2/mm/page_alloc.c linux-2.6.8-rc3/mm/page_alloc.c
--- linux-2.6.8-rc2/mm/page_alloc.c	2004-08-03 15:21:15.625860960 -0700
+++ linux-2.6.8-rc3/mm/page_alloc.c	2004-08-03 15:22:16.211346333 -0700
@@ -825,17 +825,6 @@
 
 EXPORT_SYMBOL(nr_free_pages);
 
-unsigned int nr_used_zone_pages(void)
-{
-	unsigned int pages = 0;
-	struct zone *zone;
-
-	for_each_zone(zone)
-		pages += zone->nr_active + zone->nr_inactive;
-
-	return pages;
-}
-
 #ifdef CONFIG_NUMA
 unsigned int nr_free_pages_pgdat(pg_data_t *pgdat)
 {
@@ -1381,7 +1370,7 @@
 		for (i = 0; i < MAX_NR_ZONES; i++)
 			realtotalpages -= zholes_size[i];
 	pgdat->node_present_pages = realtotalpages;
-	printk("On node %d totalpages: %lu\n", pgdat->node_id, realtotalpages);
+	printk(KERN_DEBUG "On node %d totalpages: %lu\n", pgdat->node_id, realtotalpages);
 }
 
 
@@ -1402,7 +1391,7 @@
 		INIT_LIST_HEAD(&page->lru);
 #ifdef WANT_PAGE_VIRTUAL
 		/* The shift won't overflow because ZONE_NORMAL is below 4G. */
-		if (!is_highmem(zone))
+		if (!is_highmem_idx(zone))
 			set_page_address(page, __va(start_pfn << PAGE_SHIFT));
 #endif
 		start_pfn++;
@@ -1487,7 +1476,7 @@
 			pcp->batch = 1 * batch;
 			INIT_LIST_HEAD(&pcp->list);
 		}
-		printk("  %s zone: %lu pages, LIFO batch:%lu\n",
+		printk(KERN_DEBUG "  %s zone: %lu pages, LIFO batch:%lu\n",
 				zone_names[j], realsize, batch);
 		INIT_LIST_HEAD(&zone->active_list);
 		INIT_LIST_HEAD(&zone->inactive_list);
diff -urN linux-2.6.8-rc2/mm/readahead.c linux-2.6.8-rc3/mm/readahead.c
--- linux-2.6.8-rc2/mm/readahead.c	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/mm/readahead.c	2004-08-03 15:22:16.212346374 -0700
@@ -349,7 +349,6 @@
 			struct file *filp, unsigned long offset)
 {
 	unsigned max;
-	unsigned min;
 	unsigned orig_next_size;
 	unsigned actual;
 	int first_access=0;
@@ -374,7 +373,6 @@
 	if (max == 0)
 		goto out;	/* No readahead */
 
-	min = get_min_readahead(ra);
 	orig_next_size = ra->next_size;
 
 	if (ra->next_size == 0) {
@@ -470,7 +468,11 @@
 			  * pages shall be accessed in the next
 			  * current window.
 			  */
-			ra->next_size = min(ra->average , (unsigned long)max);
+			average = ra->average;
+			if (ra->serial_cnt > average)
+				average = (ra->serial_cnt + ra->average + 1) / 2;
+
+			ra->next_size = min(average , (unsigned long)max);
 		}
 		ra->start = offset;
 		ra->size = ra->next_size;
@@ -552,6 +554,7 @@
 				ra->size = max;
 				ra->ahead_start = 0;
 				ra->ahead_size = 0;
+				ra->average = max / 2;
 			}
 		}
 		ra->prev_page = offset;
diff -urN linux-2.6.8-rc2/mm/rmap.c linux-2.6.8-rc3/mm/rmap.c
--- linux-2.6.8-rc2/mm/rmap.c	2004-08-03 15:21:15.645861781 -0700
+++ linux-2.6.8-rc3/mm/rmap.c	2004-08-03 15:22:16.213346415 -0700
@@ -481,6 +481,10 @@
 	 * an exclusive swap page, do_wp_page will replace it by a copy
 	 * page, and the user never get to see the data GUP was holding
 	 * the original page for.
+	 *
+	 * This test is also useful for when swapoff (unuse_process) has
+	 * to drop page lock: its reference to the page stops existing
+	 * ptes from being unmapped, so swapoff can make progress.
 	 */
 	if (PageSwapCache(page) &&
 	    page_count(page) != page->mapcount + 2) {
diff -urN linux-2.6.8-rc2/mm/shmem.c linux-2.6.8-rc3/mm/shmem.c
--- linux-2.6.8-rc2/mm/shmem.c	2004-08-03 15:21:15.685863422 -0700
+++ linux-2.6.8-rc3/mm/shmem.c	2004-08-03 15:22:16.215346497 -0700
@@ -1121,15 +1121,9 @@
 				return err;
 			}
 		} else if (nonblock) {
-	    		/*
-		 	 * If a nonlinear mapping then store the file page
-			 * offset in the pte.
-			 */
-			if (pgoff != linear_page_index(vma, addr)) {
-	    			err = install_file_pte(mm, vma, addr, pgoff, prot);
-				if (err)
-		    			return err;
-			}
+    			err = install_file_pte(mm, vma, addr, pgoff, prot);
+			if (err)
+	    			return err;
 		}
 
 		len -= PAGE_SIZE;
diff -urN linux-2.6.8-rc2/mm/swap.c linux-2.6.8-rc3/mm/swap.c
--- linux-2.6.8-rc2/mm/swap.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/mm/swap.c	2004-08-03 15:22:16.226346948 -0700
@@ -7,7 +7,7 @@
 /*
  * This file contains the default values for the opereation of the
  * Linux VM subsystem. Fine-tuning documentation can be found in
- * linux/Documentation/sysctl/vm.txt.
+ * Documentation/sysctl/vm.txt.
  * Started 18.12.91
  * Swap aging added 23.2.95, Stephen Tweedie.
  * Buffermem limits added 12.3.98, Rik van Riel.
diff -urN linux-2.6.8-rc2/mm/swapfile.c linux-2.6.8-rc3/mm/swapfile.c
--- linux-2.6.8-rc2/mm/swapfile.c	2004-08-03 15:21:15.714864612 -0700
+++ linux-2.6.8-rc3/mm/swapfile.c	2004-08-03 15:22:16.233347235 -0700
@@ -110,7 +110,7 @@
  check_next_cluster:
 	if (offset+SWAPFILE_CLUSTER-1 <= si->highest_bit)
 	{
-		int nr;
+		unsigned long nr;
 		for (nr = offset; nr < offset+SWAPFILE_CLUSTER; nr++)
 			if (si->swap_map[nr])
 			{
@@ -548,7 +548,15 @@
 	/*
 	 * Go through process' page directory.
 	 */
-	down_read(&mm->mmap_sem);
+	if (!down_read_trylock(&mm->mmap_sem)) {
+		/*
+		 * Our reference to the page stops try_to_unmap_one from
+		 * unmapping its ptes, so swapoff can make progress.
+		 */
+		unlock_page(page);
+		down_read(&mm->mmap_sem);
+		lock_page(page);
+	}
 	spin_lock(&mm->page_table_lock);
 	for (vma = mm->mmap; vma; vma = vma->vm_next) {
 		if (!is_vm_hugetlb_page(vma)) {
diff -urN linux-2.6.8-rc2/mm/vmscan.c linux-2.6.8-rc3/mm/vmscan.c
--- linux-2.6.8-rc2/mm/vmscan.c	2004-08-03 15:21:15.717864735 -0700
+++ linux-2.6.8-rc3/mm/vmscan.c	2004-08-03 15:22:16.266348589 -0700
@@ -169,22 +169,25 @@
  * slab to avoid swapping.
  *
  * We do weird things to avoid (scanned*seeks*entries) overflowing 32 bits.
+ *
+ * `lru_pages' represents the number of on-LRU pages in all the zones which
+ * are eligible for the caller's allocation attempt.  It is used for balancing
+ * slab reclaim versus page reclaim.
  */
-static int shrink_slab(unsigned long scanned, unsigned int gfp_mask)
+static int shrink_slab(unsigned long scanned, unsigned int gfp_mask,
+			unsigned long lru_pages)
 {
 	struct shrinker *shrinker;
-	long pages;
 
 	if (down_trylock(&shrinker_sem))
 		return 0;
 
-	pages = nr_used_zone_pages();
 	list_for_each_entry(shrinker, &shrinker_list, list) {
 		unsigned long long delta;
 
 		delta = (4 * scanned) / shrinker->seeks;
 		delta *= (*shrinker->shrinker)(0, gfp_mask);
-		do_div(delta, pages + 1);
+		do_div(delta, lru_pages + 1);
 		shrinker->nr += delta;
 		if (shrinker->nr < 0)
 			shrinker->nr = LONG_MAX;	/* It wrapped! */
@@ -896,6 +899,7 @@
 	int total_scanned = 0, total_reclaimed = 0;
 	struct reclaim_state *reclaim_state = current->reclaim_state;
 	struct scan_control sc;
+	unsigned long lru_pages = 0;
 	int i;
 
 	sc.gfp_mask = gfp_mask;
@@ -903,8 +907,12 @@
 
 	inc_page_state(allocstall);
 
-	for (i = 0; zones[i] != 0; i++)
-		zones[i]->temp_priority = DEF_PRIORITY;
+	for (i = 0; zones[i] != NULL; i++) {
+		struct zone *zone = zones[i];
+
+		zone->temp_priority = DEF_PRIORITY;
+		lru_pages += zone->nr_active + zone->nr_inactive;
+	}
 
 	for (priority = DEF_PRIORITY; priority >= 0; priority--) {
 		sc.nr_mapped = read_page_state(nr_mapped);
@@ -912,7 +920,7 @@
 		sc.nr_reclaimed = 0;
 		sc.priority = priority;
 		shrink_caches(zones, &sc);
-		shrink_slab(sc.nr_scanned, gfp_mask);
+		shrink_slab(sc.nr_scanned, gfp_mask, lru_pages);
 		if (reclaim_state) {
 			sc.nr_reclaimed += reclaim_state->reclaimed_slab;
 			reclaim_state->reclaimed_slab = 0;
@@ -941,7 +949,7 @@
 			blk_congestion_wait(WRITE, HZ/10);
 	}
 	if ((gfp_mask & __GFP_FS) && !(gfp_mask & __GFP_NORETRY))
-		out_of_memory();
+		out_of_memory(gfp_mask);
 out:
 	for (i = 0; zones[i] != 0; i++)
 		zones[i]->prev_priority = zones[i]->temp_priority;
@@ -997,7 +1005,7 @@
 	for (priority = DEF_PRIORITY; priority >= 0; priority--) {
 		int all_zones_ok = 1;
 		int end_zone = 0;	/* Inclusive.  0 = ZONE_DMA */
-
+		unsigned long lru_pages = 0;
 
 		if (nr_pages == 0) {
 			/*
@@ -1021,6 +1029,12 @@
 			end_zone = pgdat->nr_zones - 1;
 		}
 scan:
+		for (i = 0; i <= end_zone; i++) {
+			struct zone *zone = pgdat->node_zones + i;
+
+			lru_pages += zone->nr_active + zone->nr_inactive;
+		}
+
 		/*
 		 * Now scan the zone in the dma->highmem direction, stopping
 		 * at the last zone which needs scanning.
@@ -1048,7 +1062,7 @@
 			sc.priority = priority;
 			shrink_zone(zone, &sc);
 			reclaim_state->reclaimed_slab = 0;
-			shrink_slab(sc.nr_scanned, GFP_KERNEL);
+			shrink_slab(sc.nr_scanned, GFP_KERNEL, lru_pages);
 			sc.nr_reclaimed += reclaim_state->reclaimed_slab;
 			total_reclaimed += sc.nr_reclaimed;
 			if (zone->all_unreclaimable)
diff -urN linux-2.6.8-rc2/net/Kconfig linux-2.6.8-rc3/net/Kconfig
--- linux-2.6.8-rc2/net/Kconfig	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/net/Kconfig	2004-08-03 15:22:16.344351789 -0700
@@ -109,6 +109,8 @@
 config IPV6
 	tristate "The IPv6 protocol (EXPERIMENTAL)"
 	depends on INET && EXPERIMENTAL
+	select CRYPTO if IPV6_PRIVACY
+	select CRYPTO_MD5 if IPV6_PRIVACY
 	---help---
 	  This is experimental support for the IP version 6 (formerly called
 	  IPng "IP next generation").  You will still be able to do
diff -urN linux-2.6.8-rc2/net/appletalk/ddp.c linux-2.6.8-rc3/net/appletalk/ddp.c
--- linux-2.6.8-rc2/net/appletalk/ddp.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/net/appletalk/ddp.c	2004-08-03 15:22:16.368352773 -0700
@@ -908,12 +908,12 @@
 
 		case SIOCADDRT: {
 			struct net_device *dev = NULL;
-			/*
-			 * FIXME: the name of the device is still in user
-			 * space, isn't it?
-			 */
 			if (rt.rt_dev) {
-				dev = __dev_get_by_name(rt.rt_dev);
+				char name[IFNAMSIZ];
+				if (copy_from_user(name, rt.rt_dev, IFNAMSIZ-1))
+					return -EFAULT;
+				name[IFNAMSIZ-1] = '\0';
+				dev = __dev_get_by_name(name);
 				if (!dev)
 					return -ENODEV;
 			}			
diff -urN linux-2.6.8-rc2/net/atm/br2684.c linux-2.6.8-rc3/net/atm/br2684.c
--- linux-2.6.8-rc2/net/atm/br2684.c	2004-08-03 15:21:15.845869986 -0700
+++ linux-2.6.8-rc3/net/atm/br2684.c	2004-08-03 15:22:16.414354661 -0700
@@ -563,7 +563,7 @@
 		BRPRIV(skb->dev)->stats.rx_packets--;
 		br2684_push(atmvcc, skb);
 	}
-	(void) try_module_get(THIS_MODULE);
+	__module_get(THIS_MODULE);
 	return 0;
     error:
 	write_unlock_irq(&devs_lock);
diff -urN linux-2.6.8-rc2/net/atm/lec.c linux-2.6.8-rc3/net/atm/lec.c
--- linux-2.6.8-rc2/net/atm/lec.c	2004-08-03 15:21:15.895872037 -0700
+++ linux-2.6.8-rc3/net/atm/lec.c	2004-08-03 15:22:16.440355727 -0700
@@ -1,6 +1,6 @@
 /*
  * lec.c: Lan Emulation driver 
- * Marko Kiiskila carnil@cs.tut.fi
+ * Marko Kiiskila mkiiskila@yahoo.com
  *
  */
 
@@ -71,9 +71,9 @@
 static int lec_close(struct net_device *dev);
 static struct net_device_stats *lec_get_stats(struct net_device *dev);
 static void lec_init(struct net_device *dev);
-static inline struct lec_arp_table* lec_arp_find(struct lec_priv *priv,
+static struct lec_arp_table* lec_arp_find(struct lec_priv *priv,
                                                      unsigned char *mac_addr);
-static inline int lec_arp_remove(struct lec_priv *priv,
+static int lec_arp_remove(struct lec_priv *priv,
 				     struct lec_arp_table *to_remove);
 /* LANE2 functions */
 static void lane2_associate_ind (struct net_device *dev, u8 *mac_address,
@@ -1468,7 +1468,7 @@
 /*
  * Remove entry from lec_arp_table
  */
-static inline int 
+static int 
 lec_arp_remove(struct lec_priv *priv,
                struct lec_arp_table *to_remove)
 {
@@ -1755,7 +1755,7 @@
 /* 
  * Find entry by mac_address
  */
-static inline struct lec_arp_table*
+static struct lec_arp_table*
 lec_arp_find(struct lec_priv *priv,
              unsigned char *mac_addr)
 {
diff -urN linux-2.6.8-rc2/net/atm/lec.h linux-2.6.8-rc3/net/atm/lec.h
--- linux-2.6.8-rc2/net/atm/lec.h	2004-06-15 22:19:10.000000000 -0700
+++ linux-2.6.8-rc3/net/atm/lec.h	2004-08-03 15:22:16.441355768 -0700
@@ -2,7 +2,7 @@
  *
  * Lan Emulation client header file
  *
- * Marko Kiiskila carnil@cs.tut.fi
+ * Marko Kiiskila mkiiskila@yahoo.com
  *
  */
 
diff -urN linux-2.6.8-rc2/net/atm/lec_arpc.h linux-2.6.8-rc3/net/atm/lec_arpc.h
--- linux-2.6.8-rc2/net/atm/lec_arpc.h	2004-06-15 22:19:42.000000000 -0700
+++ linux-2.6.8-rc3/net/atm/lec_arpc.h	2004-08-03 15:22:16.456356384 -0700
@@ -1,6 +1,6 @@
 /*
  * Lec arp cache
- * Marko Kiiskila carnil@cs.tut.fi
+ * Marko Kiiskila mkiiskila@yahoo.com
  *
  */
 #ifndef _LEC_ARP_H
diff -urN linux-2.6.8-rc2/net/atm/pppoatm.c linux-2.6.8-rc3/net/atm/pppoatm.c
--- linux-2.6.8-rc2/net/atm/pppoatm.c	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/net/atm/pppoatm.c	2004-08-03 15:22:16.457356425 -0700
@@ -307,7 +307,7 @@
 	atmvcc->user_back = pvcc;
 	atmvcc->push = pppoatm_push;
 	atmvcc->pop = pppoatm_pop;
-	(void) try_module_get(THIS_MODULE);
+	__module_get(THIS_MODULE);
 	return 0;
 }
 
diff -urN linux-2.6.8-rc2/net/atm/resources.c linux-2.6.8-rc3/net/atm/resources.c
--- linux-2.6.8-rc2/net/atm/resources.c	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/net/atm/resources.c	2004-08-03 15:22:16.458356466 -0700
@@ -356,9 +356,9 @@
 				? -EFAULT : 0;
 			goto done;
 		case ATM_SETLOOP:
-			if (__ATM_LM_XTRMT((int) (long) buf) &&
-			    __ATM_LM_XTLOC((int) (long) buf) >
-			    __ATM_LM_XTRMT((int) (long) buf)) {
+			if (__ATM_LM_XTRMT((int) (unsigned long) buf) &&
+			    __ATM_LM_XTLOC((int) (unsigned long) buf) >
+			    __ATM_LM_XTRMT((int) (unsigned long) buf)) {
 				error = -EINVAL;
 				goto done;
 			}
diff -urN linux-2.6.8-rc2/net/bluetooth/Kconfig linux-2.6.8-rc3/net/bluetooth/Kconfig
--- linux-2.6.8-rc2/net/bluetooth/Kconfig	2004-08-03 15:21:15.976875360 -0700
+++ linux-2.6.8-rc3/net/bluetooth/Kconfig	2004-08-03 15:22:16.519358968 -0700
@@ -20,6 +20,7 @@
 	     RFCOMM Module (RFCOMM Protocol)  
 	     BNEP Module (Bluetooth Network Encapsulation Protocol)
 	     CMTP Module (CAPI Message Transport Protocol)
+	     HIDP Module (Human Interface Device Protocol)
 
 	  Say Y here to compile Bluetooth support into the kernel or say M to
 	  compile it as module (bluetooth).
diff -urN linux-2.6.8-rc2/net/bluetooth/bnep/bnep.h linux-2.6.8-rc3/net/bluetooth/bnep/bnep.h
--- linux-2.6.8-rc2/net/bluetooth/bnep/bnep.h	2004-06-15 22:19:35.000000000 -0700
+++ linux-2.6.8-rc3/net/bluetooth/bnep/bnep.h	2004-08-03 15:22:16.607362578 -0700
@@ -139,7 +139,7 @@
 
 struct bnep_connlist_req {
 	__u32  cnum;
-	struct bnep_conninfo *ci;
+	struct bnep_conninfo __user *ci;
 };
 
 struct bnep_proto_filter {
diff -urN linux-2.6.8-rc2/net/bluetooth/bnep/core.c linux-2.6.8-rc3/net/bluetooth/bnep/core.c
--- linux-2.6.8-rc2/net/bluetooth/bnep/core.c	2004-06-15 22:19:42.000000000 -0700
+++ linux-2.6.8-rc3/net/bluetooth/bnep/core.c	2004-08-03 15:22:16.624363276 -0700
@@ -61,7 +61,7 @@
 #define BT_DBG(D...)
 #endif
 
-#define VERSION "1.0"
+#define VERSION "1.2"
 
 static LIST_HEAD(bnep_session_list);
 static DECLARE_RWSEM(bnep_session_sem);
@@ -99,11 +99,9 @@
 static int bnep_send(struct bnep_session *s, void *data, size_t len)
 {
 	struct socket *sock = s->sock;
-	struct iovec iv = { data, len };
+	struct kvec iv = { data, len };
 
-	s->msg.msg_iov    = &iv;
-	s->msg.msg_iovlen = 1;
-	return sock_sendmsg(sock, &s->msg, len);
+	return kernel_sendmsg(sock, &s->msg, &iv, 1, len);
 }
 
 static int bnep_send_rsp(struct bnep_session *s, u8 ctrl, u16 resp)
@@ -115,6 +113,21 @@
 	return bnep_send(s, &rsp, sizeof(rsp));
 }
 
+#ifdef CONFIG_BT_BNEP_PROTO_FILTER
+static inline void bnep_set_default_proto_filter(struct bnep_session *s)
+{
+	/* (IPv4, ARP)  */
+	s->proto_filter[0].start = htons(0x0800);
+	s->proto_filter[0].end   = htons(0x0806);
+	/* (RARP, AppleTalk) */
+	s->proto_filter[1].start = htons(0x8035);
+	s->proto_filter[1].end   = htons(0x80F3);
+	/* (IPX, IPv6) */
+	s->proto_filter[2].start = htons(0x8137);
+	s->proto_filter[2].end   = htons(0x86DD);
+}
+#endif
+
 static int bnep_ctrl_set_netfilter(struct bnep_session *s, u16 *data, int len)
 {
 	int n;
@@ -143,9 +156,13 @@
 			BT_DBG("proto filter start %d end %d",
 				f[i].start, f[i].end);
 		}
+
 		if (i < BNEP_MAX_PROTO_FILTERS)
 			memset(f + i, 0, sizeof(*f));
 
+		if (n == 0)
+			bnep_set_default_proto_filter(s);
+
 		bnep_send_rsp(s, BNEP_FILTER_NET_TYPE_RSP, BNEP_SUCCESS);
 	} else {
 		bnep_send_rsp(s, BNEP_FILTER_NET_TYPE_RSP, BNEP_FILTER_LIMIT_REACHED);
@@ -389,7 +406,7 @@
 {
 	struct ethhdr *eh = (void *) skb->data;
 	struct socket *sock = s->sock;
-	struct iovec iv[3];
+	struct kvec iv[3];
 	int len = 0, il = 0;
 	u8 type = 0;
 
@@ -400,7 +417,7 @@
 		goto send;
 	}
 
-	iv[il++] = (struct iovec) { &type, 1 };
+	iv[il++] = (struct kvec) { &type, 1 };
 	len++;
 
 	if (!memcmp(eh->h_dest, s->eh.h_source, ETH_ALEN))
@@ -415,25 +432,23 @@
 	type = __bnep_tx_types[type];
 	switch (type) {
 	case BNEP_COMPRESSED_SRC_ONLY:
-		iv[il++] = (struct iovec) { eh->h_source, ETH_ALEN };
+		iv[il++] = (struct kvec) { eh->h_source, ETH_ALEN };
 		len += ETH_ALEN;
 		break;
 		
 	case BNEP_COMPRESSED_DST_ONLY:
-		iv[il++] = (struct iovec) { eh->h_dest, ETH_ALEN };
+		iv[il++] = (struct kvec) { eh->h_dest, ETH_ALEN };
 		len += ETH_ALEN;
 		break;
 	}
 
 send:
-	iv[il++] = (struct iovec) { skb->data, skb->len };
+	iv[il++] = (struct kvec) { skb->data, skb->len };
 	len += skb->len;
 	
 	/* FIXME: linearize skb */
 	{
-		s->msg.msg_iov    = iv;
-		s->msg.msg_iovlen = il;
-		len = sock_sendmsg(sock, &s->msg, len);
+		len = kernel_sendmsg(sock, &s->msg, iv, il, len);
 	}
 	kfree_skb(skb);
 
@@ -460,8 +475,6 @@
 	set_user_nice(current, -15);
 	current->flags |= PF_NOFREEZE;
 
-        set_fs(KERNEL_DS);
-
 	init_waitqueue_entry(&wait, current);
 	add_wait_queue(sk->sk_sleep, &wait);
 	while (!atomic_read(&s->killed)) {
@@ -550,21 +563,12 @@
 	/* Set default mc filter */
 	set_bit(bnep_mc_hash(dev->broadcast), (ulong *) &s->mc_filter);
 #endif
-	
+
 #ifdef CONFIG_BT_BNEP_PROTO_FILTER
 	/* Set default protocol filter */
-
-	/* (IPv4, ARP)  */
-	s->proto_filter[0].start = htons(0x0800);
-	s->proto_filter[0].end   = htons(0x0806);
-	/* (RARP, AppleTalk) */
-	s->proto_filter[1].start = htons(0x8035);
-	s->proto_filter[1].end   = htons(0x80F3);
-	/* (IPX, IPv6) */
-	s->proto_filter[2].start = htons(0x8137);
-	s->proto_filter[2].end   = htons(0x86DD);
+	bnep_set_default_proto_filter(s);
 #endif
-	
+
 	err = register_netdev(dev);
 	if (err) {
 		goto failed;
diff -urN linux-2.6.8-rc2/net/bluetooth/cmtp/core.c linux-2.6.8-rc3/net/bluetooth/cmtp/core.c
--- linux-2.6.8-rc2/net/bluetooth/cmtp/core.c	2004-06-15 22:20:03.000000000 -0700
+++ linux-2.6.8-rc3/net/bluetooth/cmtp/core.c	2004-08-03 15:22:16.625363317 -0700
@@ -201,7 +201,7 @@
 static int cmtp_send_frame(struct cmtp_session *session, unsigned char *data, int len)
 {
 	struct socket *sock = session->sock;
-	struct iovec iv = { data, len };
+	struct kvec iv = { data, len };
 	struct msghdr msg;
 
 	BT_DBG("session %p data %p len %d", session, data, len);
@@ -210,10 +210,8 @@
 		return 0;
 
 	memset(&msg, 0, sizeof(msg));
-	msg.msg_iovlen = 1;
-	msg.msg_iov = &iv;
 
-	return sock_sendmsg(sock, &msg, len);
+	return kernel_sendmsg(sock, &msg, &iv, 1, len);
 }
 
 static int cmtp_process_transmit(struct cmtp_session *session)
@@ -295,8 +293,6 @@
 	set_user_nice(current, -15);
 	current->flags |= PF_NOFREEZE;
 
-	set_fs(KERNEL_DS);
-
 	init_waitqueue_entry(&wait, current);
 	add_wait_queue(sk->sk_sleep, &wait);
 	while (!atomic_read(&session->terminate)) {
diff -urN linux-2.6.8-rc2/net/bluetooth/hidp/core.c linux-2.6.8-rc3/net/bluetooth/hidp/core.c
--- linux-2.6.8-rc2/net/bluetooth/hidp/core.c	2004-08-03 15:21:16.041878027 -0700
+++ linux-2.6.8-rc3/net/bluetooth/hidp/core.c	2004-08-03 15:22:16.631363563 -0700
@@ -274,7 +274,7 @@
 
 static int hidp_send_frame(struct socket *sock, unsigned char *data, int len)
 {
-	struct iovec iv = { data, len };
+	struct kvec iv = { data, len };
 	struct msghdr msg;
 
 	BT_DBG("sock %p data %p len %d", sock, data, len);
@@ -283,10 +283,8 @@
 		return 0;
 
 	memset(&msg, 0, sizeof(msg));
-	msg.msg_iovlen = 1;
-	msg.msg_iov = &iv;
 
-	return sock_sendmsg(sock, &msg, len);
+	return kernel_sendmsg(sock, &msg, &iv, 1, len);
 }
 
 static int hidp_process_transmit(struct hidp_session *session)
@@ -340,8 +338,6 @@
 	set_user_nice(current, -15);
 	current->flags |= PF_NOFREEZE;
 
-	set_fs(KERNEL_DS);
-
 	init_waitqueue_entry(&ctrl_wait, current);
 	init_waitqueue_entry(&intr_wait, current);
 	add_wait_queue(ctrl_sk->sk_sleep, &ctrl_wait);
diff -urN linux-2.6.8-rc2/net/bluetooth/rfcomm/core.c linux-2.6.8-rc3/net/bluetooth/rfcomm/core.c
--- linux-2.6.8-rc2/net/bluetooth/rfcomm/core.c	2004-06-15 22:18:38.000000000 -0700
+++ linux-2.6.8-rc3/net/bluetooth/rfcomm/core.c	2004-08-03 15:22:16.665364957 -0700
@@ -323,14 +323,11 @@
 
 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 {
-	mm_segment_t fs;
 	int r;
 
 	rfcomm_lock();
 
-	fs = get_fs(); set_fs(KERNEL_DS);
 	r = __rfcomm_dlc_open(d, src, dst, channel);
-	set_fs(fs);
 
 	rfcomm_unlock();
 	return r;
@@ -376,14 +373,11 @@
 
 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 {
-	mm_segment_t fs;
 	int r;
 
 	rfcomm_lock();
 
-	fs = get_fs(); set_fs(KERNEL_DS);
 	r = __rfcomm_dlc_close(d, err);
-	set_fs(fs);
 
 	rfcomm_unlock();
 	return r;
@@ -552,9 +546,8 @@
 {
 	struct rfcomm_session *s = NULL;
 	struct sockaddr_l2 addr;
-	struct l2cap_options opts;
 	struct socket *sock;
-	int    size;
+	struct sock *sk;
 
 	BT_DBG("%s %s", batostr(src), batostr(dst));
 
@@ -570,11 +563,10 @@
 		goto failed;
 
 	/* Set L2CAP options */
-	size = sizeof(opts);
-	sock->ops->getsockopt(sock, SOL_L2CAP, L2CAP_OPTIONS, (void *)&opts, &size);
-	
-	opts.imtu = RFCOMM_MAX_L2CAP_MTU;
-	sock->ops->setsockopt(sock, SOL_L2CAP, L2CAP_OPTIONS, (void *)&opts, size);
+	sk = sock->sk;
+	lock_sock(sk);
+	l2cap_pi(sk)->imtu = RFCOMM_MAX_L2CAP_MTU;
+	release_sock(sk);
 
 	s = rfcomm_session_add(sock, BT_BOUND);
 	if (!s) {
@@ -612,16 +604,14 @@
 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
 {
 	struct socket *sock = s->sock;
-	struct iovec iv = { data, len };
+	struct kvec iv = { data, len };
 	struct msghdr msg;
 
 	BT_DBG("session %p len %d", s, len);
 
 	memset(&msg, 0, sizeof(msg));
-	msg.msg_iovlen = 1;
-	msg.msg_iov = &iv;
 
-	return sock_sendmsg(sock, &msg, len);
+	return kernel_sendmsg(sock, &msg, &iv, 1, len);
 }
 
 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
@@ -905,7 +895,7 @@
 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
 {
 	struct socket *sock = s->sock;
-	struct iovec iv[3];
+	struct kvec iv[3];
 	struct msghdr msg;
 	unsigned char hdr[5], crc[1];
 
@@ -930,10 +920,8 @@
 	iv[2].iov_len  = 1;
 
 	memset(&msg, 0, sizeof(msg));
-	msg.msg_iovlen = 3;
-	msg.msg_iov = iv;
 
-	return sock_sendmsg(sock, &msg, 6 + len);
+	return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
 }
 
 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
@@ -1749,10 +1737,10 @@
 static int rfcomm_add_listener(bdaddr_t *ba)
 {
 	struct sockaddr_l2 addr;
-	struct l2cap_options opts;
 	struct socket *sock;
+	struct sock *sk;
 	struct rfcomm_session *s;
-	int    size, err = 0;
+	int    err = 0;
 
 	/* Create socket */
 	err = rfcomm_l2sock_create(&sock);
@@ -1772,11 +1760,10 @@
 	}
 
 	/* Set L2CAP options */
-	size = sizeof(opts);
-	sock->ops->getsockopt(sock, SOL_L2CAP, L2CAP_OPTIONS, (void *)&opts, &size);
-
-	opts.imtu = RFCOMM_MAX_L2CAP_MTU;
-	sock->ops->setsockopt(sock, SOL_L2CAP, L2CAP_OPTIONS, (void *)&opts, size);
+	sk = sock->sk;
+	lock_sock(sk);
+	l2cap_pi(sk)->imtu = RFCOMM_MAX_L2CAP_MTU;
+	release_sock(sk);
 
 	/* Start listening on the socket */
 	err = sock->ops->listen(sock, 10);
@@ -1820,8 +1807,6 @@
 	set_user_nice(current, -10);
 	current->flags |= PF_NOFREEZE;
 
-	set_fs(KERNEL_DS);
-
 	BT_DBG("");
 
 	rfcomm_add_listener(BDADDR_ANY);
diff -urN linux-2.6.8-rc2/net/bridge/br_device.c linux-2.6.8-rc3/net/bridge/br_device.c
--- linux-2.6.8-rc2/net/bridge/br_device.c	2004-08-03 15:21:16.120881268 -0700
+++ linux-2.6.8-rc3/net/bridge/br_device.c	2004-08-03 15:22:16.689365942 -0700
@@ -28,43 +28,28 @@
 	return &br->statistics;
 }
 
-static int __br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
+int br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-	struct net_bridge *br;
-	unsigned char *dest;
+	struct net_bridge *br = netdev_priv(dev);
+	const unsigned char *dest = skb->data;
 	struct net_bridge_fdb_entry *dst;
 
-	br = dev->priv;
 	br->statistics.tx_packets++;
 	br->statistics.tx_bytes += skb->len;
 
-	dest = skb->mac.raw = skb->data;
+	skb->mac.raw = skb->data;
 	skb_pull(skb, ETH_HLEN);
 
-	if (dest[0] & 1) {
+	rcu_read_lock();
+	if (dest[0] & 1) 
 		br_flood_deliver(br, skb, 0);
-		return 0;
-	}
-
-	if ((dst = br_fdb_get(br, dest)) != NULL) {
+	else if ((dst = __br_fdb_get(br, dest)) != NULL)
 		br_deliver(dst->dst, skb);
-		br_fdb_put(dst);
-		return 0;
-	}
-
-	br_flood_deliver(br, skb, 0);
-	return 0;
-}
-
-int br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-	int ret;
+	else
+		br_flood_deliver(br, skb, 0);
 
-	rcu_read_lock();
-	ret = __br_dev_xmit(skb, dev);
 	rcu_read_unlock();
-
-	return ret;
+	return 0;
 }
 
 static int br_dev_open(struct net_device *dev)
diff -urN linux-2.6.8-rc2/net/bridge/br_fdb.c linux-2.6.8-rc3/net/bridge/br_fdb.c
--- linux-2.6.8-rc2/net/bridge/br_fdb.c	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/net/bridge/br_fdb.c	2004-08-03 15:22:16.710366804 -0700
@@ -73,9 +73,9 @@
 
 static __inline__ void fdb_delete(struct net_bridge_fdb_entry *f)
 {
-	hlist_del(&f->hlist);
+	hlist_del_rcu(&f->hlist);
 	if (!f->is_static)
-		list_del(&f->age_list);
+		list_del(&f->u.age_list);
 
 	br_fdb_put(f);
 }
@@ -85,7 +85,7 @@
 	struct net_bridge *br = p->br;
 	int i;
 	
-	write_lock_bh(&br->hash_lock);
+	spin_lock_bh(&br->hash_lock);
 
 	/* Search all chains since old address/hash is unknown */
 	for (i = 0; i < BR_HASH_SIZE; i++) {
@@ -117,7 +117,7 @@
 	fdb_insert(br, p, newaddr, 1);
 
 
-	write_unlock_bh(&br->hash_lock);
+	spin_unlock_bh(&br->hash_lock);
 }
 
 void br_fdb_cleanup(unsigned long _data)
@@ -126,13 +126,15 @@
 	struct list_head *l, *n;
 	unsigned long delay;
 
-	write_lock_bh(&br->hash_lock);
+	spin_lock_bh(&br->hash_lock);
 	delay = hold_time(br);
 
 	list_for_each_safe(l, n, &br->age_list) {
-		struct net_bridge_fdb_entry *f
-			= list_entry(l, struct net_bridge_fdb_entry, age_list);
-		unsigned long expires = f->ageing_timer + delay;
+		struct net_bridge_fdb_entry *f;
+		unsigned long expires;
+
+		f = list_entry(l, struct net_bridge_fdb_entry, u.age_list);
+		expires = f->ageing_timer + delay;
 
 		if (time_before_eq(expires, jiffies)) {
 			WARN_ON(f->is_static);
@@ -144,14 +146,14 @@
 			break;
 		}
 	}
-	write_unlock_bh(&br->hash_lock);
+	spin_unlock_bh(&br->hash_lock);
 }
 
 void br_fdb_delete_by_port(struct net_bridge *br, struct net_bridge_port *p)
 {
 	int i;
 
-	write_lock_bh(&br->hash_lock);
+	spin_lock_bh(&br->hash_lock);
 	for (i = 0; i < BR_HASH_SIZE; i++) {
 		struct hlist_node *h, *g;
 		
@@ -182,37 +184,53 @@
 		skip_delete: ;
 		}
 	}
-	write_unlock_bh(&br->hash_lock);
+	spin_unlock_bh(&br->hash_lock);
 }
 
-struct net_bridge_fdb_entry *br_fdb_get(struct net_bridge *br, unsigned char *addr)
+/* No locking or refcounting, assumes caller has no preempt (rcu_read_lock) */
+struct net_bridge_fdb_entry *__br_fdb_get(struct net_bridge *br,
+					  const unsigned char *addr)
 {
 	struct hlist_node *h;
+	struct net_bridge_fdb_entry *fdb;
 
-	read_lock_bh(&br->hash_lock);
-		
-	hlist_for_each(h, &br->hash[br_mac_hash(addr)]) {
-		struct net_bridge_fdb_entry *fdb
-			= hlist_entry(h, struct net_bridge_fdb_entry, hlist);
-
+	hlist_for_each_entry_rcu(fdb, h, &br->hash[br_mac_hash(addr)], hlist) {
 		if (!memcmp(fdb->addr.addr, addr, ETH_ALEN)) {
-			if (has_expired(br, fdb))
-				goto ret_null;
-
-			atomic_inc(&fdb->use_count);
-			read_unlock_bh(&br->hash_lock);
+			if (unlikely(has_expired(br, fdb)))
+				break;
 			return fdb;
 		}
 	}
- ret_null:
-	read_unlock_bh(&br->hash_lock);
+
 	return NULL;
 }
 
+/* Interface used by ATM hook that keeps a ref count */
+struct net_bridge_fdb_entry *br_fdb_get(struct net_bridge *br, 
+					unsigned char *addr)
+{
+	struct net_bridge_fdb_entry *fdb;
+
+	rcu_read_lock();
+	fdb = __br_fdb_get(br, addr);
+	if (fdb) 
+		atomic_inc(&fdb->use_count);
+	rcu_read_unlock();
+	return fdb;
+}
+
+static void fdb_rcu_free(struct rcu_head *head)
+{
+	struct net_bridge_fdb_entry *ent
+		= container_of(head, struct net_bridge_fdb_entry, u.rcu);
+	kmem_cache_free(br_fdb_cache, ent);
+}
+
+/* Set entry up for deletion with RCU  */
 void br_fdb_put(struct net_bridge_fdb_entry *ent)
 {
 	if (atomic_dec_and_test(&ent->use_count))
-		kmem_cache_free(br_fdb_cache, ent);
+		call_rcu(&ent->u.rcu, fdb_rcu_free);
 }
 
 /*
@@ -229,9 +247,9 @@
 
 	memset(buf, 0, maxnum*sizeof(struct __fdb_entry));
 
-	read_lock_bh(&br->hash_lock);
+	rcu_read_lock();
 	for (i = 0; i < BR_HASH_SIZE; i++) {
-		hlist_for_each_entry(f, h, &br->hash[i], hlist) {
+		hlist_for_each_entry_rcu(f, h, &br->hash[i], hlist) {
 			if (num >= maxnum)
 				goto out;
 
@@ -255,7 +273,7 @@
 	}
 
  out:
-	read_unlock_bh(&br->hash_lock);
+	rcu_read_unlock();
 
 	return num;
 }
@@ -298,7 +316,7 @@
 				return 0;
 
 			/* move to end of age list */
-			list_del(&fdb->age_list);
+			list_del(&fdb->u.age_list);
 			goto update;
 		}
 	}
@@ -309,7 +327,7 @@
 
 	memcpy(fdb->addr.addr, addr, ETH_ALEN);
 	atomic_set(&fdb->use_count, 1);
-	hlist_add_head(&fdb->hlist, &br->hash[hash]);
+	hlist_add_head_rcu(&fdb->hlist, &br->hash[hash]);
 
 	if (!timer_pending(&br->gc_timer)) {
 		br->gc_timer.expires = jiffies + hold_time(br);
@@ -322,7 +340,7 @@
 	fdb->is_static = is_local;
 	fdb->ageing_timer = jiffies;
 	if (!is_local) 
-		list_add_tail(&fdb->age_list, &br->age_list);
+		list_add_tail(&fdb->u.age_list, &br->age_list);
 
 	return 0;
 }
@@ -332,8 +350,8 @@
 {
 	int ret;
 
-	write_lock_bh(&br->hash_lock);
+	spin_lock_bh(&br->hash_lock);
 	ret = fdb_insert(br, source, addr, is_local);
-	write_unlock_bh(&br->hash_lock);
+	spin_unlock_bh(&br->hash_lock);
 	return ret;
 }
diff -urN linux-2.6.8-rc2/net/bridge/br_if.c linux-2.6.8-rc3/net/bridge/br_if.c
--- linux-2.6.8-rc2/net/bridge/br_if.c	2004-08-03 15:21:16.158882827 -0700
+++ linux-2.6.8-rc3/net/bridge/br_if.c	2004-08-03 15:22:16.745368239 -0700
@@ -149,7 +149,7 @@
 
 	br->lock = SPIN_LOCK_UNLOCKED;
 	INIT_LIST_HEAD(&br->port_list);
-	br->hash_lock = RW_LOCK_UNLOCKED;
+	br->hash_lock = SPIN_LOCK_UNLOCKED;
 
 	br->bridge_id.prio[0] = 0x80;
 	br->bridge_id.prio[1] = 0x00;
@@ -295,6 +295,7 @@
 	return ret;
 }
 
+/* Mtu of the bridge pseudo-device 1500 or the minimum of the ports */
 int br_min_mtu(const struct net_bridge *br)
 {
 	const struct net_bridge_port *p;
@@ -343,11 +344,12 @@
 
 		spin_lock_bh(&br->lock);
 		br_stp_recalculate_bridge_id(br);
-		if ((br->dev->flags & IFF_UP) && (dev->flags & IFF_UP))
+		if ((br->dev->flags & IFF_UP) 
+		    && (dev->flags & IFF_UP) && netif_carrier_ok(dev))
 			br_stp_enable_port(p);
 		spin_unlock_bh(&br->lock);
 
-		br->dev->mtu = br_min_mtu(br);
+		dev_set_mtu(br->dev, br_min_mtu(br));
 	}
 
 	return err;
diff -urN linux-2.6.8-rc2/net/bridge/br_input.c linux-2.6.8-rc3/net/bridge/br_input.c
--- linux-2.6.8-rc2/net/bridge/br_input.c	2004-06-15 22:19:02.000000000 -0700
+++ linux-2.6.8-rc3/net/bridge/br_input.c	2004-08-03 15:22:16.746368280 -0700
@@ -83,19 +83,17 @@
 		goto out;
 	}
 
-	dst = br_fdb_get(br, dest);
+	dst = __br_fdb_get(br, dest);
 	if (dst != NULL && dst->is_local) {
 		if (!passedup)
 			br_pass_frame_up(br, skb);
 		else
 			kfree_skb(skb);
-		br_fdb_put(dst);
 		goto out;
 	}
 
 	if (dst != NULL) {
 		br_forward(dst->dst, skb);
-		br_fdb_put(dst);
 		goto out;
 	}
 
diff -urN linux-2.6.8-rc2/net/bridge/br_notify.c linux-2.6.8-rc3/net/bridge/br_notify.c
--- linux-2.6.8-rc2/net/bridge/br_notify.c	2004-08-03 15:21:16.211885001 -0700
+++ linux-2.6.8-rc3/net/bridge/br_notify.c	2004-08-03 15:22:16.778369593 -0700
@@ -19,58 +19,59 @@
 
 static int br_device_event(struct notifier_block *unused, unsigned long event, void *ptr);
 
-struct notifier_block br_device_notifier =
-{
+struct notifier_block br_device_notifier = {
 	.notifier_call = br_device_event
 };
 
 static int br_device_event(struct notifier_block *unused, unsigned long event, void *ptr)
 {
-	struct net_device *dev;
-	struct net_bridge_port *p;
+	struct net_device *dev = ptr;
+	struct net_bridge_port *p = dev->br_port;
 	struct net_bridge *br;
 
-	dev = ptr;
-	p = dev->br_port;
-
 	if (p == NULL)
 		return NOTIFY_DONE;
 
 	br = p->br;
+	if ( !(br->dev->flags & IFF_UP))
+		return NOTIFY_DONE;
+
+	if (event == NETDEV_CHANGEMTU) {
+		dev_set_mtu(br->dev, br_min_mtu(br));
+		return NOTIFY_DONE;
+	}
 
+	spin_lock_bh(&br->lock);
 	switch (event) {
 	case NETDEV_CHANGEADDR:
-		spin_lock_bh(&br->lock);
 		br_fdb_changeaddr(p, dev->dev_addr);
-		if (br->dev->flags & IFF_UP)
-			br_stp_recalculate_bridge_id(br);
-		spin_unlock_bh(&br->lock);
+		br_stp_recalculate_bridge_id(br);
 		break;
 
-	case NETDEV_CHANGEMTU:
-		br->dev->mtu = br_min_mtu(br);
+	case NETDEV_CHANGE:	/* device is up but carrier changed */
+		if (netif_carrier_ok(dev)) {
+			if (p->state == BR_STATE_DISABLED)
+				br_stp_enable_port(p);
+		} else {
+			if (p->state != BR_STATE_DISABLED)
+				br_stp_disable_port(p);
+		}
 		break;
 
 	case NETDEV_DOWN:
-		if (br->dev->flags & IFF_UP) {
-			spin_lock_bh(&br->lock);
-			br_stp_disable_port(p);
-			spin_unlock_bh(&br->lock);
-		}
+		br_stp_disable_port(p);
 		break;
 
 	case NETDEV_UP:
-		if (br->dev->flags & IFF_UP) {
-			spin_lock_bh(&br->lock);
+		if (netif_carrier_ok(dev)) 
 			br_stp_enable_port(p);
-			spin_unlock_bh(&br->lock);
-		}
 		break;
 
 	case NETDEV_UNREGISTER:
 		br_del_if(br, dev);
 		break;
-	}
+	} 
+	spin_unlock_bh(&br->lock);
 
 	return NOTIFY_DONE;
 }
diff -urN linux-2.6.8-rc2/net/bridge/br_private.h linux-2.6.8-rc3/net/bridge/br_private.h
--- linux-2.6.8-rc2/net/bridge/br_private.h	2004-08-03 15:21:16.241886232 -0700
+++ linux-2.6.8-rc3/net/bridge/br_private.h	2004-08-03 15:22:16.779369634 -0700
@@ -46,7 +46,10 @@
 {
 	struct hlist_node		hlist;
 	struct net_bridge_port		*dst;
-	struct list_head		age_list;
+	union {
+		struct list_head	age_list;
+		struct rcu_head		rcu;
+	} u;
 	atomic_t			use_count;
 	unsigned long			ageing_timer;
 	mac_addr			addr;
@@ -86,7 +89,7 @@
 	struct list_head		port_list;
 	struct net_device		*dev;
 	struct net_device_stats		statistics;
-	rwlock_t			hash_lock;
+	spinlock_t			hash_lock;
 	struct hlist_head		hash[BR_HASH_SIZE];
 	struct list_head		age_list;
 
@@ -136,8 +139,10 @@
 extern void br_fdb_cleanup(unsigned long arg);
 extern void br_fdb_delete_by_port(struct net_bridge *br,
 			   struct net_bridge_port *p);
+extern struct net_bridge_fdb_entry *__br_fdb_get(struct net_bridge *br,
+						 const unsigned char *addr);
 extern struct net_bridge_fdb_entry *br_fdb_get(struct net_bridge *br,
-					unsigned char *addr);
+					       unsigned char *addr);
 extern void br_fdb_put(struct net_bridge_fdb_entry *ent);
 extern int br_fdb_fillbuf(struct net_bridge *br, void *buf, 
 			  unsigned long count, unsigned long off);
diff -urN linux-2.6.8-rc2/net/bridge/br_stp.c linux-2.6.8-rc3/net/bridge/br_stp.c
--- linux-2.6.8-rc2/net/bridge/br_stp.c	2004-08-03 15:21:16.261887052 -0700
+++ linux-2.6.8-rc3/net/bridge/br_stp.c	2004-08-03 15:22:16.781369716 -0700
@@ -299,7 +299,7 @@
 	int isroot = br_is_root_bridge(br);
 
 	pr_info("%s: topology change detected, %s\n", br->dev->name,
-		isroot ? "propgating" : "sending tcn bpdu");
+		isroot ? "propagating" : "sending tcn bpdu");
 
 	if (isroot) {
 		br->topology_change = 1;
diff -urN linux-2.6.8-rc2/net/bridge/br_stp_if.c linux-2.6.8-rc3/net/bridge/br_stp_if.c
--- linux-2.6.8-rc2/net/bridge/br_stp_if.c	2004-06-15 22:19:53.000000000 -0700
+++ linux-2.6.8-rc3/net/bridge/br_stp_if.c	2004-08-03 15:22:16.818371234 -0700
@@ -52,7 +52,7 @@
 	br_config_bpdu_generation(br);
 
 	list_for_each_entry(p, &br->port_list, list) {
-		if (p->dev->flags & IFF_UP)
+		if ((p->dev->flags & IFF_UP) && netif_carrier_ok(p->dev))
 			br_stp_enable_port(p);
 
 	}
diff -urN linux-2.6.8-rc2/net/core/dev.c linux-2.6.8-rc3/net/core/dev.c
--- linux-2.6.8-rc2/net/core/dev.c	2004-08-03 15:21:16.301888693 -0700
+++ linux-2.6.8-rc3/net/core/dev.c	2004-08-03 15:22:16.925375624 -0700
@@ -216,11 +216,6 @@
  */
 DEFINE_PER_CPU(struct softnet_data, softnet_data) = { 0, };
 
-#ifdef CONFIG_NET_FASTROUTE
-int netdev_fastroute;
-int netdev_fastroute_obstacles;
-#endif
-
 #ifdef CONFIG_SYSFS
 extern int netdev_sysfs_init(void);
 extern int netdev_register_sysfs(struct net_device *);
@@ -278,12 +273,6 @@
 	int hash;
 
 	spin_lock_bh(&ptype_lock);
-#ifdef CONFIG_NET_FASTROUTE
-	if (pt->af_packet_priv) {
-		netdev_fastroute_obstacles++;
-		dev_clear_fastroute(pt->dev);
-	}
-#endif
 	if (pt->type == htons(ETH_P_ALL)) {
 		netdev_nit++;
 		list_add_rcu(&pt->list, &ptype_all);
@@ -326,10 +315,6 @@
 
 	list_for_each_entry(pt1, head, list) {
 		if (pt == pt1) {
-#ifdef CONFIG_NET_FASTROUTE
-			if (pt->af_packet_priv)
-				netdev_fastroute_obstacles--;
-#endif
 			list_del_rcu(&pt->list);
 			goto out;
 		}
@@ -971,39 +956,6 @@
 	return ret;
 }
 
-#ifdef CONFIG_NET_FASTROUTE
-
-static void dev_do_clear_fastroute(struct net_device *dev)
-{
-	if (dev->accept_fastpath) {
-		int i;
-
-		for (i = 0; i <= NETDEV_FASTROUTE_HMASK; i++) {
-			struct dst_entry *dst;
-
-			write_lock_irq(&dev->fastpath_lock);
-			dst = dev->fastpath[i];
-			dev->fastpath[i] = NULL;
-			write_unlock_irq(&dev->fastpath_lock);
-
-			dst_release(dst);
-		}
-	}
-}
-
-void dev_clear_fastroute(struct net_device *dev)
-{
-	if (dev) {
-		dev_do_clear_fastroute(dev);
-	} else {
-		read_lock(&dev_base_lock);
-		for (dev = dev_base; dev; dev = dev->next)
-			dev_do_clear_fastroute(dev);
-		read_unlock(&dev_base_lock);
-	}
-}
-#endif
-
 /**
  *	dev_close - shutdown an interface.
  *	@dev: device to shutdown
@@ -1056,9 +1008,6 @@
 	 */
 
 	dev->flags &= ~IFF_UP;
-#ifdef CONFIG_NET_FASTROUTE
-	dev_clear_fastroute(dev);
-#endif
 
 	/*
 	 * Tell people we are down
@@ -1320,6 +1269,13 @@
 	}						\
 }
 
+static inline void qdisc_run(struct net_device *dev)
+{
+	while (!netif_queue_stopped(dev) &&
+	       qdisc_restart(dev)<0)
+		/* NOTHING */;
+}
+
 /**
  *	dev_queue_xmit - transmit a buffer
  *	@skb: buffer to transmit
@@ -1820,13 +1776,6 @@
 
 	__get_cpu_var(netdev_rx_stat).total++;
 
-#ifdef CONFIG_NET_FASTROUTE
-	if (skb->pkt_type == PACKET_FASTROUTE) {
-		__get_cpu_var(netdev_rx_stat).fastroute_deferred_out++;
-		return dev_queue_xmit(skb);
-	}
-#endif
-
 	skb->h.raw = skb->nh.raw = skb->data;
 	skb->mac_len = skb->nh.raw - skb->mac.raw;
 
@@ -2366,13 +2315,6 @@
 	if ((dev->promiscuity += inc) == 0)
 		dev->flags &= ~IFF_PROMISC;
 	if (dev->flags ^ old_flags) {
-#ifdef CONFIG_NET_FASTROUTE
-		if (dev->flags & IFF_PROMISC) {
-			netdev_fastroute_obstacles++;
-			dev_clear_fastroute(dev);
-		} else
-			netdev_fastroute_obstacles--;
-#endif
 		dev_mc_upload(dev);
 		printk(KERN_INFO "device %s %s promiscuous mode\n",
 		       dev->name, (dev->flags & IFF_PROMISC) ? "entered" :
@@ -2925,10 +2867,6 @@
 	spin_lock_init(&dev->ingress_lock);
 #endif
 
-#ifdef CONFIG_NET_FASTROUTE
-	dev->fastpath_lock = RW_LOCK_UNLOCKED;
-#endif
-
 	ret = alloc_divert_blk(dev);
 	if (ret)
 		goto out;
@@ -3034,7 +2972,6 @@
 	while (atomic_read(&dev->refcnt) != 0) {
 		if (time_after(jiffies, rebroadcast_time + 1 * HZ)) {
 			rtnl_shlock();
-			rtnl_exlock();
 
 			/* Rebroadcast unregister notification */
 			notifier_call_chain(&netdev_chain,
@@ -3051,7 +2988,6 @@
 				linkwatch_run_queue();
 			}
 
-			rtnl_exunlock();
 			rtnl_shunlock();
 
 			rebroadcast_time = jiffies;
@@ -3249,10 +3185,6 @@
 
 	synchronize_net();
 
-#ifdef CONFIG_NET_FASTROUTE
-	dev_clear_fastroute(dev);
-#endif
-
 	/* Shutdown queueing discipline. */
 	dev_shutdown(dev);
 
@@ -3426,6 +3358,8 @@
 EXPORT_SYMBOL(dev_remove_pack);
 EXPORT_SYMBOL(dev_set_allmulti);
 EXPORT_SYMBOL(dev_set_promiscuity);
+EXPORT_SYMBOL(dev_change_flags);
+EXPORT_SYMBOL(dev_set_mtu);
 EXPORT_SYMBOL(free_netdev);
 EXPORT_SYMBOL(netdev_boot_setup_check);
 EXPORT_SYMBOL(netdev_set_master);
@@ -3443,10 +3377,7 @@
 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
 EXPORT_SYMBOL(br_handle_frame_hook);
 #endif
-/* for 801q VLAN support */
-#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
-EXPORT_SYMBOL(dev_change_flags);
-#endif
+
 #ifdef CONFIG_KMOD
 EXPORT_SYMBOL(dev_load);
 #endif
@@ -3456,10 +3387,6 @@
 EXPORT_SYMBOL(netdev_register_fc);
 EXPORT_SYMBOL(netdev_unregister_fc);
 #endif
-#ifdef CONFIG_NET_FASTROUTE
-EXPORT_SYMBOL(netdev_fastroute);
-EXPORT_SYMBOL(netdev_fastroute_obstacles);
-#endif
 
 #ifdef CONFIG_NET_CLS_ACT
 EXPORT_SYMBOL(ing_filter);
diff -urN linux-2.6.8-rc2/net/core/ethtool.c linux-2.6.8-rc3/net/core/ethtool.c
--- linux-2.6.8-rc2/net/core/ethtool.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/net/core/ethtool.c	2004-08-03 15:22:16.965377265 -0700
@@ -157,7 +157,7 @@
 	if (copy_to_user(useraddr, &regs, sizeof(regs)))
 		goto out;
 	useraddr += offsetof(struct ethtool_regs, data);
-	if (copy_to_user(useraddr, regbuf, reglen))
+	if (copy_to_user(useraddr, regbuf, regs.len))
 		goto out;
 	ret = 0;
 
diff -urN linux-2.6.8-rc2/net/core/link_watch.c linux-2.6.8-rc3/net/core/link_watch.c
--- linux-2.6.8-rc2/net/core/link_watch.c	2004-06-15 22:18:37.000000000 -0700
+++ linux-2.6.8-rc3/net/core/link_watch.c	2004-08-03 15:22:16.972377552 -0700
@@ -93,9 +93,7 @@
 	clear_bit(LW_RUNNING, &linkwatch_flags);
 
 	rtnl_shlock();
-	rtnl_exlock();
 	linkwatch_run_queue();
-	rtnl_exunlock();
 	rtnl_shunlock();
 }
 
diff -urN linux-2.6.8-rc2/net/core/pktgen.c linux-2.6.8-rc3/net/core/pktgen.c
--- linux-2.6.8-rc2/net/core/pktgen.c	2004-08-03 15:21:16.331889924 -0700
+++ linux-2.6.8-rc3/net/core/pktgen.c	2004-08-03 15:22:17.064381326 -0700
@@ -56,6 +56,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/moduleparam.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/types.h>
@@ -1409,7 +1410,7 @@
 MODULE_AUTHOR("Robert Olsson <robert.olsson@its.uu.se");
 MODULE_DESCRIPTION("Packet Generator tool");
 MODULE_LICENSE("GPL");
-MODULE_PARM(count_d, "i");
-MODULE_PARM(ipg_d, "i");
-MODULE_PARM(cpu_speed, "i");
-MODULE_PARM(clone_skb_d, "i");
+module_param(count_d, int, 0);
+module_param(ipg_d, int, 0);
+module_param(cpu_speed, int, 0);
+module_param(clone_skb_d, int, 0);
diff -urN linux-2.6.8-rc2/net/core/rtnetlink.c linux-2.6.8-rc3/net/core/rtnetlink.c
--- linux-2.6.8-rc2/net/core/rtnetlink.c	2004-08-03 15:21:16.363891237 -0700
+++ linux-2.6.8-rc3/net/core/rtnetlink.c	2004-08-03 15:22:17.065381367 -0700
@@ -56,12 +56,10 @@
 void rtnl_lock(void)
 {
 	rtnl_shlock();
-	rtnl_exlock();
 }
  
 void rtnl_unlock(void)
 {
-	rtnl_exunlock();
 	rtnl_shunlock();
 
 	netdev_run_todo();
@@ -337,7 +335,6 @@
 	struct rtnetlink_link *link_tab;
 	struct rtattr	*rta[RTATTR_MAX];
 
-	int exclusive = 0;
 	int sz_idx, kind;
 	int min_len;
 	int family;
@@ -404,14 +401,6 @@
 		return -1;
 	}
 
-	if (kind != 2) {
-		if (rtnl_exlock_nowait()) {
-			*errp = 0;
-			return -1;
-		}
-		exclusive = 1;
-	}
-
 	memset(&rta, 0, sizeof(rta));
 
 	min_len = rtm_min[sz_idx];
@@ -439,14 +428,10 @@
 		goto err_inval;
 	err = link->doit(skb, nlh, (void *)&rta);
 
-	if (exclusive)
-		rtnl_exunlock();
 	*errp = err;
 	return err;
 
 err_inval:
-	if (exclusive)
-		rtnl_exunlock();
 	*errp = -EINVAL;
 	return -1;
 }
diff -urN linux-2.6.8-rc2/net/core/sysctl_net_core.c linux-2.6.8-rc3/net/core/sysctl_net_core.c
--- linux-2.6.8-rc2/net/core/sysctl_net_core.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/net/core/sysctl_net_core.c	2004-08-03 15:22:17.176385921 -0700
@@ -130,16 +130,6 @@
 		.mode		= 0644,
 		.proc_handler	= &proc_dointvec
 	},
-#ifdef CONFIG_NET_FASTROUTE
-	{
-		.ctl_name	= NET_CORE_FASTROUTE,
-		.procname	= "netdev_fastroute",
-		.data		= &netdev_fastroute,
-		.maxlen		= sizeof(int),
-		.mode		= 0644,
-		.proc_handler	= &proc_dointvec
-	},
-#endif
 	{
 		.ctl_name	= NET_CORE_MSG_COST,
 		.procname	= "message_cost",
diff -urN linux-2.6.8-rc2/net/ipv4/Makefile linux-2.6.8-rc3/net/ipv4/Makefile
--- linux-2.6.8-rc2/net/ipv4/Makefile	2004-08-03 15:21:16.553899032 -0700
+++ linux-2.6.8-rc3/net/ipv4/Makefile	2004-08-03 15:22:17.410395520 -0700
@@ -6,7 +6,7 @@
 	     ip_input.o ip_fragment.o ip_forward.o ip_options.o \
 	     ip_output.o ip_sockglue.o \
 	     tcp.o tcp_input.o tcp_output.o tcp_timer.o tcp_ipv4.o tcp_minisocks.o \
-	     tcp_diag.o raw.o udp.o arp.o icmp.o devinet.o af_inet.o igmp.o \
+	     tcp_diag.o datagram.o raw.o udp.o arp.o icmp.o devinet.o af_inet.o igmp.o \
 	     sysctl_net_ipv4.o fib_frontend.o fib_semantics.o fib_hash.o
 
 obj-$(CONFIG_PROC_FS) += proc.o
diff -urN linux-2.6.8-rc2/net/ipv4/ah4.c linux-2.6.8-rc3/net/ipv4/ah4.c
--- linux-2.6.8-rc2/net/ipv4/ah4.c	2004-08-03 15:21:16.649902970 -0700
+++ linux-2.6.8-rc3/net/ipv4/ah4.c	2004-08-03 15:22:17.481398433 -0700
@@ -1,6 +1,5 @@
 #include <linux/config.h>
 #include <linux/module.h>
-#include <net/inet_ecn.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/ah.h>
@@ -73,9 +72,9 @@
 	iph->tos = top_iph->tos;
 	iph->ttl = top_iph->ttl;
 	iph->frag_off = top_iph->frag_off;
-	iph->daddr = top_iph->daddr;
 
 	if (top_iph->ihl != 5) {
+		iph->daddr = top_iph->daddr;
 		memcpy(iph+1, top_iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
 		err = ip_clear_mutable_options(top_iph, &top_iph->daddr);
 		if (err)
@@ -104,9 +103,10 @@
 	top_iph->tos = iph->tos;
 	top_iph->ttl = iph->ttl;
 	top_iph->frag_off = iph->frag_off;
-	top_iph->daddr = iph->daddr;
-	if (top_iph->ihl != 5)
+	if (top_iph->ihl != 5) {
+		top_iph->daddr = iph->daddr;
 		memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
+	}
 
 	ip_send_check(top_iph);
 
diff -urN linux-2.6.8-rc2/net/ipv4/arp.c linux-2.6.8-rc3/net/ipv4/arp.c
--- linux-2.6.8-rc2/net/ipv4/arp.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv4/arp.c	2004-08-03 15:22:17.482398474 -0700
@@ -426,7 +426,7 @@
 	if (ip_route_output_key(&rt, &fl) < 0) 
 		return 1;
 	if (rt->u.dst.dev != dev) { 
-		NET_INC_STATS_BH(ArpFilter);
+		NET_INC_STATS_BH(LINUX_MIB_ARPFILTER);
 		flag = 1;
 	} 
 	ip_rt_put(rt); 
diff -urN linux-2.6.8-rc2/net/ipv4/datagram.c linux-2.6.8-rc3/net/ipv4/datagram.c
--- linux-2.6.8-rc2/net/ipv4/datagram.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/net/ipv4/datagram.c	2004-08-03 15:22:17.483398515 -0700
@@ -0,0 +1,73 @@
+/*
+ *	common UDP/RAW code
+ *	Linux INET implementation
+ *
+ * Authors:
+ * 	Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
+ *
+ * 	This program is free software; you can redistribute it and/or
+ * 	modify it under the terms of the GNU General Public License
+ * 	as published by the Free Software Foundation; either version
+ * 	2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/config.h>
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/ip.h>
+#include <linux/in.h>
+#include <net/sock.h>
+#include <net/tcp.h>
+#include <net/route.h>
+
+int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+{
+	struct inet_opt *inet = inet_sk(sk);
+	struct sockaddr_in *usin = (struct sockaddr_in *) uaddr;
+	struct rtable *rt;
+	u32 saddr;
+	int oif;
+	int err;
+
+	
+	if (addr_len < sizeof(*usin)) 
+	  	return -EINVAL;
+
+	if (usin->sin_family != AF_INET) 
+	  	return -EAFNOSUPPORT;
+
+	sk_dst_reset(sk);
+
+	oif = sk->sk_bound_dev_if;
+	saddr = inet->saddr;
+	if (MULTICAST(usin->sin_addr.s_addr)) {
+		if (!oif)
+			oif = inet->mc_index;
+		if (!saddr)
+			saddr = inet->mc_addr;
+	}
+	err = ip_route_connect(&rt, usin->sin_addr.s_addr, saddr,
+			       RT_CONN_FLAGS(sk), oif,
+			       sk->sk_protocol,
+			       inet->sport, usin->sin_port, sk);
+	if (err)
+		return err;
+	if ((rt->rt_flags & RTCF_BROADCAST) && !sock_flag(sk, SOCK_BROADCAST)) {
+		ip_rt_put(rt);
+		return -EACCES;
+	}
+  	if (!inet->saddr)
+	  	inet->saddr = rt->rt_src;	/* Update source address */
+	if (!inet->rcv_saddr)
+		inet->rcv_saddr = rt->rt_src;
+	inet->daddr = rt->rt_dst;
+	inet->dport = usin->sin_port;
+	sk->sk_state = TCP_ESTABLISHED;
+	inet->id = jiffies;
+
+	sk_dst_set(sk, &rt->u.dst);
+	return(0);
+}
+
+EXPORT_SYMBOL(ip4_datagram_connect);
+
diff -urN linux-2.6.8-rc2/net/ipv4/esp4.c linux-2.6.8-rc3/net/ipv4/esp4.c
--- linux-2.6.8-rc2/net/ipv4/esp4.c	2004-08-03 15:21:16.668903749 -0700
+++ linux-2.6.8-rc3/net/ipv4/esp4.c	2004-08-03 15:22:17.520400033 -0700
@@ -1,6 +1,5 @@
 #include <linux/config.h>
 #include <linux/module.h>
-#include <net/inet_ecn.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/esp.h>
diff -urN linux-2.6.8-rc2/net/ipv4/icmp.c linux-2.6.8-rc3/net/ipv4/icmp.c
--- linux-2.6.8-rc2/net/ipv4/icmp.c	2004-08-03 15:21:16.717905760 -0700
+++ linux-2.6.8-rc3/net/ipv4/icmp.c	2004-08-03 15:22:17.576402330 -0700
@@ -213,8 +213,8 @@
  */
 
 struct icmp_control {
-	int output_off;		/* Field offset for increment on output */
-	int input_off;		/* Field offset for increment on input */
+	int output_entry;	/* Field for increment on output */
+	int input_entry;	/* Field for increment on input */
 	void (*handler)(struct sk_buff *skb);
 	short   error;		/* This ICMP is classed as an error message */
 };
@@ -318,8 +318,8 @@
 static void icmp_out_count(int type)
 {
 	if (type <= NR_ICMP_TYPES) {
-		ICMP_INC_STATS_FIELD(icmp_pointers[type].output_off);
-		ICMP_INC_STATS(IcmpOutMsgs);
+		ICMP_INC_STATS(icmp_pointers[type].output_entry);
+		ICMP_INC_STATS(ICMP_MIB_OUTMSGS);
 	}
 }
 
@@ -714,7 +714,7 @@
 out:
 	return;
 out_err:
-	ICMP_INC_STATS_BH(IcmpInErrors);
+	ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
 	goto out;
 }
 
@@ -755,7 +755,7 @@
 out:
 	return;
 out_err:
-	ICMP_INC_STATS_BH(IcmpInErrors);
+	ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
 	goto out;
 }
 
@@ -823,7 +823,7 @@
 out:
 	return;
 out_err:
-	ICMP_INC_STATS_BH(IcmpInErrors);
+	ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
 	goto out;
 }
 
@@ -922,7 +922,7 @@
 	struct icmphdr *icmph;
 	struct rtable *rt = (struct rtable *)skb->dst;
 
-	ICMP_INC_STATS_BH(IcmpInMsgs);
+	ICMP_INC_STATS_BH(ICMP_MIB_INMSGS);
 
 	switch (skb->ip_summed) {
 	case CHECKSUM_HW:
@@ -974,14 +974,14 @@
   		}
 	}
 
-	ICMP_INC_STATS_BH_FIELD(icmp_pointers[icmph->type].input_off);
+	ICMP_INC_STATS_BH(icmp_pointers[icmph->type].input_entry);
 	icmp_pointers[icmph->type].handler(skb);
 
 drop:
 	kfree_skb(skb);
 	return 0;
 error:
-	ICMP_INC_STATS_BH(IcmpInErrors);
+	ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
 	goto drop;
 }
 
@@ -990,109 +990,109 @@
  */
 static struct icmp_control icmp_pointers[NR_ICMP_TYPES + 1] = {
 	[ICMP_ECHOREPLY] = {
-		.output_off = offsetof(struct icmp_mib, IcmpOutEchoReps),
-		.input_off = offsetof(struct icmp_mib, IcmpInEchoReps),
+		.output_entry = ICMP_MIB_OUTECHOREPS,
+		.input_entry = ICMP_MIB_INECHOREPS,
 		.handler = icmp_discard,
 	},
 	[1] = {
-		.output_off = offsetof(struct icmp_mib, dummy),
-		.input_off = offsetof(struct icmp_mib,IcmpInErrors),
+		.output_entry = ICMP_MIB_DUMMY,
+		.input_entry = ICMP_MIB_INERRORS,
 		.handler = icmp_discard,
 		.error = 1,
 	},
 	[2] = {
-		.output_off = offsetof(struct icmp_mib, dummy),
-		.input_off = offsetof(struct icmp_mib,IcmpInErrors),
+		.output_entry = ICMP_MIB_DUMMY,
+		.input_entry = ICMP_MIB_INERRORS,
 		.handler = icmp_discard,
 		.error = 1,
 	},
 	[ICMP_DEST_UNREACH] = {
-		.output_off = offsetof(struct icmp_mib, IcmpOutDestUnreachs),
-		.input_off = offsetof(struct icmp_mib, IcmpInDestUnreachs),
+		.output_entry = ICMP_MIB_OUTDESTUNREACHS,
+		.input_entry = ICMP_MIB_INDESTUNREACHS,
 		.handler = icmp_unreach,
 		.error = 1,
 	},
 	[ICMP_SOURCE_QUENCH] = {
-		.output_off = offsetof(struct icmp_mib, IcmpOutSrcQuenchs),
-		.input_off = offsetof(struct icmp_mib, IcmpInSrcQuenchs),
+		.output_entry = ICMP_MIB_OUTSRCQUENCHS,
+		.input_entry = ICMP_MIB_INSRCQUENCHS,
 		.handler = icmp_unreach,
 		.error = 1,
 	},
 	[ICMP_REDIRECT] = {
-		.output_off = offsetof(struct icmp_mib, IcmpOutRedirects),
-		.input_off = offsetof(struct icmp_mib, IcmpInRedirects),
+		.output_entry = ICMP_MIB_OUTREDIRECTS,
+		.input_entry = ICMP_MIB_INREDIRECTS,
 		.handler = icmp_redirect,
 		.error = 1,
 	},
 	[6] = {
-		.output_off = offsetof(struct icmp_mib, dummy),
-		.input_off = offsetof(struct icmp_mib, IcmpInErrors),
+		.output_entry = ICMP_MIB_DUMMY,
+		.input_entry = ICMP_MIB_INERRORS,
 		.handler = icmp_discard,
 		.error = 1,
 	},
 	[7] = {
-		.output_off = offsetof(struct icmp_mib, dummy),
-		.input_off = offsetof(struct icmp_mib, IcmpInErrors),
+		.output_entry = ICMP_MIB_DUMMY,
+		.input_entry = ICMP_MIB_INERRORS,
 		.handler = icmp_discard,
 		.error = 1,
 	},
 	[ICMP_ECHO] = {
-		.output_off = offsetof(struct icmp_mib, IcmpOutEchos),
-		.input_off = offsetof(struct icmp_mib, IcmpInEchos),
+		.output_entry = ICMP_MIB_OUTECHOS,
+		.input_entry = ICMP_MIB_INECHOS,
 		.handler = icmp_echo,
 	},
 	[9] = {
-		.output_off = offsetof(struct icmp_mib, dummy),
-		.input_off = offsetof(struct icmp_mib, IcmpInErrors),
+		.output_entry = ICMP_MIB_DUMMY,
+		.input_entry = ICMP_MIB_INERRORS,
 		.handler = icmp_discard,
 		.error = 1,
 	},
 	[10] = {
-		.output_off = offsetof(struct icmp_mib, dummy),
-		.input_off = offsetof(struct icmp_mib, IcmpInErrors),
+		.output_entry = ICMP_MIB_DUMMY,
+		.input_entry = ICMP_MIB_INERRORS,
 		.handler = icmp_discard,
 		.error = 1,
 	},
 	[ICMP_TIME_EXCEEDED] = {
-		.output_off = offsetof(struct icmp_mib, IcmpOutTimeExcds),
-		.input_off = offsetof(struct icmp_mib,IcmpInTimeExcds),
+		.output_entry = ICMP_MIB_OUTTIMEEXCDS,
+		.input_entry = ICMP_MIB_INTIMEEXCDS,
 		.handler = icmp_unreach,
 		.error = 1,
 	},
 	[ICMP_PARAMETERPROB] = {
-		.output_off = offsetof(struct icmp_mib, IcmpOutParmProbs),
-		.input_off = offsetof(struct icmp_mib, IcmpInParmProbs),
+		.output_entry = ICMP_MIB_OUTPARMPROBS,
+		.input_entry = ICMP_MIB_INPARMPROBS,
 		.handler = icmp_unreach,
 		.error = 1,
 	},
 	[ICMP_TIMESTAMP] = {
-		.output_off = offsetof(struct icmp_mib, IcmpOutTimestamps),
-		.input_off = offsetof(struct icmp_mib, IcmpInTimestamps),
+		.output_entry = ICMP_MIB_OUTTIMESTAMPS,
+		.input_entry = ICMP_MIB_INTIMESTAMPS,
 		.handler = icmp_timestamp,
 	},
 	[ICMP_TIMESTAMPREPLY] = {
-		.output_off = offsetof(struct icmp_mib, IcmpOutTimestampReps),
-		.input_off = offsetof(struct icmp_mib, IcmpInTimestampReps),
+		.output_entry = ICMP_MIB_OUTTIMESTAMPREPS,
+		.input_entry = ICMP_MIB_INTIMESTAMPREPS,
 		.handler = icmp_discard,
 	},
 	[ICMP_INFO_REQUEST] = {
-		.output_off = offsetof(struct icmp_mib, dummy),
-		.input_off = offsetof(struct icmp_mib, dummy),
+		.output_entry = ICMP_MIB_DUMMY,
+		.input_entry = ICMP_MIB_DUMMY,
 		.handler = icmp_discard,
 	},
  	[ICMP_INFO_REPLY] = {
-		.output_off = offsetof(struct icmp_mib, dummy),
-		.input_off = offsetof(struct icmp_mib, dummy),
+		.output_entry = ICMP_MIB_DUMMY,
+		.input_entry = ICMP_MIB_DUMMY,
 		.handler = icmp_discard,
 	},
 	[ICMP_ADDRESS] = {
-		.output_off = offsetof(struct icmp_mib, IcmpOutAddrMasks),
-		.input_off = offsetof(struct icmp_mib, IcmpInAddrMasks),
+		.output_entry = ICMP_MIB_OUTADDRMASKS,
+		.input_entry = ICMP_MIB_INADDRMASKS,
 		.handler = icmp_address,
 	},
 	[ICMP_ADDRESSREPLY] = {
-		.output_off = offsetof(struct icmp_mib, IcmpOutAddrMaskReps),
-		.input_off = offsetof(struct icmp_mib, IcmpInAddrMaskReps),
+		.output_entry = ICMP_MIB_OUTADDRMASKREPS,
+		.input_entry = ICMP_MIB_INADDRMASKREPS,
 		.handler = icmp_address_reply,
 	},
 };
diff -urN linux-2.6.8-rc2/net/ipv4/igmp.c linux-2.6.8-rc3/net/ipv4/igmp.c
--- linux-2.6.8-rc2/net/ipv4/igmp.c	2004-08-03 15:21:16.726906129 -0700
+++ linux-2.6.8-rc3/net/ipv4/igmp.c	2004-08-03 15:22:17.609403684 -0700
@@ -2217,8 +2217,8 @@
 static int igmp_mc_seq_show(struct seq_file *seq, void *v)
 {
 	if (v == SEQ_START_TOKEN)
-		seq_printf(seq, 
-			   "Idx\tDevice    : Count Querier\tGroup    Users Timer\tReporter\n");
+		seq_puts(seq, 
+			 "Idx\tDevice    : Count Querier\tGroup    Users Timer\tReporter\n");
 	else {
 		struct ip_mc_list *im = (struct ip_mc_list *)v;
 		struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
diff -urN linux-2.6.8-rc2/net/ipv4/ip_forward.c linux-2.6.8-rc3/net/ipv4/ip_forward.c
--- linux-2.6.8-rc2/net/ipv4/ip_forward.c	2004-06-15 22:18:38.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv4/ip_forward.c	2004-08-03 15:22:17.610403725 -0700
@@ -46,7 +46,7 @@
 {
 	struct ip_options * opt	= &(IPCB(skb)->opt);
 
-	IP_INC_STATS_BH(OutForwDatagrams);
+	IP_INC_STATS_BH(IPSTATS_MIB_OUTFORWDATAGRAMS);
 
 	if (unlikely(opt->optlen))
 		ip_forward_options(skb);
diff -urN linux-2.6.8-rc2/net/ipv4/ip_fragment.c linux-2.6.8-rc3/net/ipv4/ip_fragment.c
--- linux-2.6.8-rc2/net/ipv4/ip_fragment.c	2004-06-15 22:19:03.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv4/ip_fragment.c	2004-08-03 15:22:17.630404545 -0700
@@ -263,7 +263,7 @@
 		spin_unlock(&qp->lock);
 
 		ipq_put(qp);
-		IP_INC_STATS_BH(ReasmFails);
+		IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
 	}
 }
 
@@ -281,8 +281,8 @@
 
 	ipq_kill(qp);
 
-	IP_INC_STATS_BH(ReasmTimeout);
-	IP_INC_STATS_BH(ReasmFails);
+	IP_INC_STATS_BH(IPSTATS_MIB_REASMTIMEOUT);
+	IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
 
 	if ((qp->last_in&FIRST_IN) && qp->fragments != NULL) {
 		struct sk_buff *head = qp->fragments;
@@ -609,7 +609,7 @@
 	iph = head->nh.iph;
 	iph->frag_off = 0;
 	iph->tot_len = htons(len);
-	IP_INC_STATS_BH(ReasmOKs);
+	IP_INC_STATS_BH(IPSTATS_MIB_REASMOKS);
 	qp->fragments = NULL;
 	return head;
 
@@ -625,7 +625,7 @@
 			"Oversized IP packet from %d.%d.%d.%d.\n",
 			NIPQUAD(qp->saddr));
 out_fail:
-	IP_INC_STATS_BH(ReasmFails);
+	IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
 	return NULL;
 }
 
@@ -636,7 +636,7 @@
 	struct ipq *qp;
 	struct net_device *dev;
 	
-	IP_INC_STATS_BH(ReasmReqds);
+	IP_INC_STATS_BH(IPSTATS_MIB_REASMREQDS);
 
 	/* Start by cleaning up the memory. */
 	if (atomic_read(&ip_frag_mem) > sysctl_ipfrag_high_thresh)
@@ -661,7 +661,7 @@
 		return ret;
 	}
 
-	IP_INC_STATS_BH(ReasmFails);
+	IP_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
 	kfree_skb(skb);
 	return NULL;
 }
diff -urN linux-2.6.8-rc2/net/ipv4/ip_input.c linux-2.6.8-rc3/net/ipv4/ip_input.c
--- linux-2.6.8-rc2/net/ipv4/ip_input.c	2004-08-03 15:21:16.732906375 -0700
+++ linux-2.6.8-rc3/net/ipv4/ip_input.c	2004-08-03 15:22:17.662405858 -0700
@@ -245,16 +245,16 @@
 				protocol = -ret;
 				goto resubmit;
 			}
-			IP_INC_STATS_BH(InDelivers);
+			IP_INC_STATS_BH(IPSTATS_MIB_INDELIVERS);
 		} else {
 			if (!raw_sk) {
 				if (xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-					IP_INC_STATS_BH(InUnknownProtos);
+					IP_INC_STATS_BH(IPSTATS_MIB_INUNKNOWNPROTOS);
 					icmp_send(skb, ICMP_DEST_UNREACH,
 						  ICMP_PROT_UNREACH, 0);
 				}
 			} else
-				IP_INC_STATS_BH(InDelivers);
+				IP_INC_STATS_BH(IPSTATS_MIB_INDELIVERS);
 			kfree_skb(skb);
 		}
 	}
@@ -320,7 +320,7 @@
 		*/
 
 		if (skb_cow(skb, skb_headroom(skb))) {
-			IP_INC_STATS_BH(InDiscards);
+			IP_INC_STATS_BH(IPSTATS_MIB_INDISCARDS);
 			goto drop;
 		}
 		iph = skb->nh.iph;
@@ -349,7 +349,7 @@
 	return dst_input(skb);
 
 inhdr_error:
-	IP_INC_STATS_BH(InHdrErrors);
+	IP_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 drop:
         kfree_skb(skb);
         return NET_RX_DROP;
@@ -368,10 +368,10 @@
 	if (skb->pkt_type == PACKET_OTHERHOST)
 		goto drop;
 
-	IP_INC_STATS_BH(InReceives);
+	IP_INC_STATS_BH(IPSTATS_MIB_INRECEIVES);
 
 	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) {
-		IP_INC_STATS_BH(InDiscards);
+		IP_INC_STATS_BH(IPSTATS_MIB_INDISCARDS);
 		goto out;
 	}
 
@@ -422,7 +422,7 @@
 		       ip_rcv_finish);
 
 inhdr_error:
-	IP_INC_STATS_BH(InHdrErrors);
+	IP_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 drop:
         kfree_skb(skb);
 out:
diff -urN linux-2.6.8-rc2/net/ipv4/ip_output.c linux-2.6.8-rc3/net/ipv4/ip_output.c
--- linux-2.6.8-rc2/net/ipv4/ip_output.c	2004-08-03 15:21:16.733906416 -0700
+++ linux-2.6.8-rc3/net/ipv4/ip_output.c	2004-08-03 15:22:17.663405899 -0700
@@ -233,7 +233,7 @@
 	/*
 	 *	If the indicated interface is up and running, send the packet.
 	 */
-	IP_INC_STATS(OutRequests);
+	IP_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
 
 	skb->dev = dev;
 	skb->protocol = htons(ETH_P_IP);
@@ -288,7 +288,7 @@
 {
 	struct sk_buff *skb = *pskb;
 
-	IP_INC_STATS(OutRequests);
+	IP_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
 
 	if ((skb->len > dst_pmtu(skb->dst) || skb_shinfo(skb)->frag_list) &&
 	    !skb_shinfo(skb)->tso_size)
@@ -393,7 +393,7 @@
 		       dst_output);
 
 no_route:
-	IP_INC_STATS(OutNoRoutes);
+	IP_INC_STATS(IPSTATS_MIB_OUTNOROUTES);
 	kfree_skb(skb);
 	return -EHOSTUNREACH;
 }
@@ -546,7 +546,7 @@
 		}
 
 		if (err == 0) {
-			IP_INC_STATS(FragOKs);
+			IP_INC_STATS(IPSTATS_MIB_FRAGOKS);
 			return 0;
 		}
 
@@ -555,7 +555,7 @@
 			kfree_skb(frag);
 			frag = skb;
 		}
-		IP_INC_STATS(FragFails);
+		IP_INC_STATS(IPSTATS_MIB_FRAGFAILS);
 		return err;
 	}
 
@@ -661,7 +661,7 @@
 		 *	Put this fragment into the sending queue.
 		 */
 
-		IP_INC_STATS(FragCreates);
+		IP_INC_STATS(IPSTATS_MIB_FRAGCREATES);
 
 		iph->tot_len = htons(len + hlen);
 
@@ -672,12 +672,12 @@
 			goto fail;
 	}
 	kfree_skb(skb);
-	IP_INC_STATS(FragOKs);
+	IP_INC_STATS(IPSTATS_MIB_FRAGOKS);
 	return err;
 
 fail:
 	kfree_skb(skb); 
-	IP_INC_STATS(FragFails);
+	IP_INC_STATS(IPSTATS_MIB_FRAGFAILS);
 	return err;
 }
 
@@ -963,7 +963,7 @@
 
 error:
 	inet->cork.length -= length;
-	IP_INC_STATS(OutDiscards);
+	IP_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
 	return err; 
 }
 
@@ -1076,7 +1076,7 @@
 
 error:
 	inet->cork.length -= size;
-	IP_INC_STATS(OutDiscards);
+	IP_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
 	return err;
 }
 
@@ -1184,7 +1184,7 @@
 	return err;
 
 error:
-	IP_INC_STATS(OutDiscards);
+	IP_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
 	goto out;
 }
 
diff -urN linux-2.6.8-rc2/net/ipv4/ipcomp.c linux-2.6.8-rc3/net/ipv4/ipcomp.c
--- linux-2.6.8-rc2/net/ipv4/ipcomp.c	2004-08-03 15:21:16.777908221 -0700
+++ linux-2.6.8-rc3/net/ipv4/ipcomp.c	2004-08-03 15:22:17.666406022 -0700
@@ -18,7 +18,6 @@
 #include <asm/scatterlist.h>
 #include <linux/crypto.h>
 #include <linux/pfkeyv2.h>
-#include <net/inet_ecn.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/icmp.h>
diff -urN linux-2.6.8-rc2/net/ipv4/ipmr.c linux-2.6.8-rc3/net/ipv4/ipmr.c
--- linux-2.6.8-rc2/net/ipv4/ipmr.c	2004-08-03 15:21:16.811909616 -0700
+++ linux-2.6.8-rc3/net/ipv4/ipmr.c	2004-08-03 15:22:17.882414883 -0700
@@ -1114,7 +1114,7 @@
 {
 	struct ip_options * opt	= &(IPCB(skb)->opt);
 
-	IP_INC_STATS_BH(OutForwDatagrams);
+	IP_INC_STATS_BH(IPSTATS_MIB_OUTFORWDATAGRAMS);
 
 	if (unlikely(opt->optlen))
 		ip_forward_options(skb);
@@ -1177,7 +1177,7 @@
 		   to blackhole.
 		 */
 
-		IP_INC_STATS_BH(FragFails);
+		IP_INC_STATS_BH(IPSTATS_MIB_FRAGFAILS);
 		ip_rt_put(rt);
 		goto out_free;
 	}
diff -urN linux-2.6.8-rc2/net/ipv4/ipvs/ip_vs_ftp.c linux-2.6.8-rc3/net/ipv4/ipvs/ip_vs_ftp.c
--- linux-2.6.8-rc2/net/ipv4/ipvs/ip_vs_ftp.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv4/ipvs/ip_vs_ftp.c	2004-08-03 15:22:17.883414924 -0700
@@ -25,6 +25,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/moduleparam.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
 #include <linux/in.h>
@@ -44,16 +45,17 @@
  * First port is set to the default port.
  */
 static int ports[IP_VS_APP_MAX_PORTS] = {21, 0};
+static int ports_c;
+module_param_array(ports, int, ports_c, 0);
 
 /*
  *	Debug level
  */
 #ifdef CONFIG_IP_VS_DEBUG
 static int debug=0;
-MODULE_PARM(debug, "i");
+module_param(debug, int, 0);
 #endif
 
-MODULE_PARM(ports, "1-" __MODULE_STRING(IP_VS_APP_MAX_PORTS) "i");
 
 /*	Dummy variable */
 static int ip_vs_ftp_pasv;
@@ -279,7 +281,7 @@
 	while (data <= data_limit - 6) {
 		if (strnicmp(data, "PASV\r\n", 6) == 0) {
 			/* Passive mode on */
-			IP_VS_DBG(1-debug, "got PASV at %d of %d\n",
+			IP_VS_DBG(1-debug, "got PASV at %zd of %zd\n",
 				  data - data_start,
 				  data_limit - data_start);
 			cp->app_data = &ip_vs_ftp_pasv;
diff -urN linux-2.6.8-rc2/net/ipv4/ipvs/ip_vs_proto_tcp.c linux-2.6.8-rc3/net/ipv4/ipvs/ip_vs_proto_tcp.c
--- linux-2.6.8-rc2/net/ipv4/ipvs/ip_vs_proto_tcp.c	2004-06-15 22:19:03.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv4/ipvs/ip_vs_proto_tcp.c	2004-08-03 15:22:17.932416934 -0700
@@ -158,7 +158,7 @@
 						(*pskb)->len - tcphoff,
 						cp->protocol,
 						(*pskb)->csum);
-		IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%d)\n",
+		IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
 			  pp->name, tcph->check,
 			  (char*)&(tcph->check) - (char*)tcph);
 	}
diff -urN linux-2.6.8-rc2/net/ipv4/ipvs/ip_vs_proto_udp.c linux-2.6.8-rc3/net/ipv4/ipvs/ip_vs_proto_udp.c
--- linux-2.6.8-rc2/net/ipv4/ipvs/ip_vs_proto_udp.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv4/ipvs/ip_vs_proto_udp.c	2004-08-03 15:22:17.933416976 -0700
@@ -166,7 +166,7 @@
 						(*pskb)->csum);
 		if (udph->check == 0)
 			udph->check = 0xFFFF;
-		IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%d)\n",
+		IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
 			  pp->name, udph->check,
 			  (char*)&(udph->check) - (char*)udph);
 	}
diff -urN linux-2.6.8-rc2/net/ipv4/netfilter/ip_nat_snmp_basic.c linux-2.6.8-rc3/net/ipv4/netfilter/ip_nat_snmp_basic.c
--- linux-2.6.8-rc2/net/ipv4/netfilter/ip_nat_snmp_basic.c	2004-08-03 15:21:16.921914129 -0700
+++ linux-2.6.8-rc3/net/ipv4/netfilter/ip_nat_snmp_basic.c	2004-08-03 15:22:18.212428421 -0700
@@ -862,6 +862,77 @@
 	return 1;
 }
 
+/* 
+ * Fast checksum update for possibly oddly-aligned UDP byte, from the
+ * code example in the draft.
+ */
+static void fast_csum(unsigned char *csum,
+                      const unsigned char *optr,
+                      const unsigned char *nptr,
+                      int odd)
+{
+	long x, old, new;
+	
+	x = csum[0] * 256 + csum[1];
+	
+	x =~ x & 0xFFFF;
+	
+	if (odd) old = optr[0] * 256;
+	else old = optr[0];
+	
+	x -= old & 0xFFFF;
+	if (x <= 0) {
+		x--;
+		x &= 0xFFFF;
+	}
+	
+	if (odd) new = nptr[0] * 256;
+	else new = nptr[0];
+	
+	x += new & 0xFFFF;
+	if (x & 0x10000) {
+		x++;
+		x &= 0xFFFF;
+	}
+	
+	x =~ x & 0xFFFF;
+	csum[0] = x / 256;
+	csum[1] = x & 0xFF;
+}
+
+/* 
+ * Mangle IP address.
+ * 	- begin points to the start of the snmp messgae
+ *      - addr points to the start of the address
+ */
+static inline void mangle_address(unsigned char *begin,
+                                  unsigned char *addr,
+                                  const struct oct1_map *map,
+                                  u_int16_t *check)
+{
+	if (map->from == NOCT1(*addr)) {
+		u_int32_t old;
+		
+		if (debug)
+			memcpy(&old, (unsigned char *)addr, sizeof(old));
+			
+		*addr = map->to;
+		
+		/* Update UDP checksum if being used */
+		if (*check) {
+			unsigned char odd = !((addr - begin) % 2);
+			
+			fast_csum((unsigned char *)check,
+			          &map->from, &map->to, odd);
+			          
+		}
+		
+		if (debug)
+			printk(KERN_DEBUG "bsalg: mapped %u.%u.%u.%u to "
+			       "%u.%u.%u.%u\n", NIPQUAD(old), NIPQUAD(*addr));
+	}
+}
+
 static unsigned char snmp_trap_decode(struct asn1_ctx *ctx,
                                       struct snmp_v1_trap *trap,
                                       const struct oct1_map *map,
@@ -952,77 +1023,6 @@
 	printk("\n");
 }
 
-/* 
- * Fast checksum update for possibly oddly-aligned UDP byte, from the
- * code example in the draft.
- */
-static void fast_csum(unsigned char *csum,
-                      const unsigned char *optr,
-                      const unsigned char *nptr,
-                      int odd)
-{
-	long x, old, new;
-	
-	x = csum[0] * 256 + csum[1];
-	
-	x =~ x & 0xFFFF;
-	
-	if (odd) old = optr[0] * 256;
-	else old = optr[0];
-	
-	x -= old & 0xFFFF;
-	if (x <= 0) {
-		x--;
-		x &= 0xFFFF;
-	}
-	
-	if (odd) new = nptr[0] * 256;
-	else new = nptr[0];
-	
-	x += new & 0xFFFF;
-	if (x & 0x10000) {
-		x++;
-		x &= 0xFFFF;
-	}
-	
-	x =~ x & 0xFFFF;
-	csum[0] = x / 256;
-	csum[1] = x & 0xFF;
-}
-
-/* 
- * Mangle IP address.
- * 	- begin points to the start of the snmp messgae
- *      - addr points to the start of the address
- */
-static inline void mangle_address(unsigned char *begin,
-                                  unsigned char *addr,
-                                  const struct oct1_map *map,
-                                  u_int16_t *check)
-{
-	if (map->from == NOCT1(*addr)) {
-		u_int32_t old;
-		
-		if (debug)
-			memcpy(&old, (unsigned char *)addr, sizeof(old));
-			
-		*addr = map->to;
-		
-		/* Update UDP checksum if being used */
-		if (*check) {
-			unsigned char odd = !((addr - begin) % 2);
-			
-			fast_csum((unsigned char *)check,
-			          &map->from, &map->to, odd);
-			          
-		}
-		
-		if (debug)
-			printk(KERN_DEBUG "bsalg: mapped %u.%u.%u.%u to "
-			       "%u.%u.%u.%u\n", NIPQUAD(old), NIPQUAD(*addr));
-	}
-}
-
 /*
  * Parse and mangle SNMP message according to mapping.
  * (And this is the fucking 'basic' method).
diff -urN linux-2.6.8-rc2/net/ipv4/proc.c linux-2.6.8-rc3/net/ipv4/proc.c
--- linux-2.6.8-rc2/net/ipv4/proc.c	2004-06-15 22:18:52.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv4/proc.c	2004-08-03 15:22:18.344433836 -0700
@@ -88,7 +88,7 @@
 };
 
 static unsigned long
-__fold_field(void *mib[], int offt)
+fold_field(void *mib[], int offt)
 {
 	unsigned long res = 0;
 	int i;
@@ -96,41 +96,157 @@
 	for (i = 0; i < NR_CPUS; i++) {
 		if (!cpu_possible(i))
 			continue;
-		res +=
-		    *((unsigned long *) (((void *) per_cpu_ptr(mib[0], i)) +
-					 offt));
-		res +=
-		    *((unsigned long *) (((void *) per_cpu_ptr(mib[1], i)) +
-					 offt));
+		res += *(((unsigned long *) per_cpu_ptr(mib[0], i)) + offt);
+		res += *(((unsigned long *) per_cpu_ptr(mib[1], i)) + offt);
 	}
 	return res;
 }
 
-#define fold_field(_mib, _nr)	__fold_field(_mib, (sizeof(unsigned long) * (_nr)))
-
 /* snmp items */
-static struct snmp_item snmp4_ipstats_list[] = {
-#define __SNMP_GEN(x,y)	SNMP_ITEM(struct ipstats_mib, x, y)
-#define SNMP_GEN(x)	__SNMP_GEN(x, #x)
-	SNMP_GEN(InReceives),
-	SNMP_GEN(InHdrErrors),
-	SNMP_GEN(InAddrErrors),
-	__SNMP_GEN(OutForwDatagrams,"ForwDatagrams"),	/* for backward compatibility */
-	SNMP_GEN(InUnknownProtos),
-	SNMP_GEN(InDiscards),
-	SNMP_GEN(InDelivers),
-	SNMP_GEN(OutRequests),
-	SNMP_GEN(OutDiscards),
-	SNMP_GEN(OutNoRoutes),
-	SNMP_GEN(ReasmTimeout),
-	SNMP_GEN(ReasmReqds),
-	SNMP_GEN(ReasmOKs),
-	SNMP_GEN(ReasmFails),
-	SNMP_GEN(FragOKs),
-	SNMP_GEN(FragFails),
-	SNMP_GEN(FragCreates),
-	SNMP_ITEM_SENTINEL
-#undef SNMP_GEN
+static struct snmp_mib snmp4_ipstats_list[] = {
+	SNMP_MIB_ITEM("InReceives", IPSTATS_MIB_INRECEIVES),
+	SNMP_MIB_ITEM("InHdrErrors", IPSTATS_MIB_INHDRERRORS),
+	SNMP_MIB_ITEM("InAddrErrors", IPSTATS_MIB_INADDRERRORS),
+	SNMP_MIB_ITEM("ForwDatagrams", IPSTATS_MIB_OUTFORWDATAGRAMS),
+	SNMP_MIB_ITEM("InUnknownProtos", IPSTATS_MIB_INUNKNOWNPROTOS),
+	SNMP_MIB_ITEM("InDiscards", IPSTATS_MIB_INDISCARDS),
+	SNMP_MIB_ITEM("InDelivers", IPSTATS_MIB_INDELIVERS),
+	SNMP_MIB_ITEM("OutRequests", IPSTATS_MIB_OUTREQUESTS),
+	SNMP_MIB_ITEM("OutDiscards", IPSTATS_MIB_OUTDISCARDS),
+	SNMP_MIB_ITEM("OutNoRoutes", IPSTATS_MIB_OUTNOROUTES),
+	SNMP_MIB_ITEM("ReasmTimeout", IPSTATS_MIB_REASMTIMEOUT),
+	SNMP_MIB_ITEM("ReasmReqds", IPSTATS_MIB_REASMREQDS),
+	SNMP_MIB_ITEM("ReasmOKs", IPSTATS_MIB_REASMOKS),
+	SNMP_MIB_ITEM("ReasmFails", IPSTATS_MIB_REASMFAILS),
+	SNMP_MIB_ITEM("FragOKs", IPSTATS_MIB_FRAGOKS),
+	SNMP_MIB_ITEM("FragFails", IPSTATS_MIB_FRAGFAILS),
+	SNMP_MIB_ITEM("FragCreates", IPSTATS_MIB_FRAGCREATES),
+	SNMP_MIB_SENTINEL
+};
+
+static struct snmp_mib snmp4_icmp_list[] = {
+	SNMP_MIB_ITEM("InMsgs", ICMP_MIB_INMSGS),
+	SNMP_MIB_ITEM("InErrors", ICMP_MIB_INERRORS),
+	SNMP_MIB_ITEM("InDestUnreachs", ICMP_MIB_INDESTUNREACHS),
+	SNMP_MIB_ITEM("InTimeExcds", ICMP_MIB_INTIMEEXCDS),
+	SNMP_MIB_ITEM("InParmProbs", ICMP_MIB_INPARMPROBS),
+	SNMP_MIB_ITEM("InSrcQuenchs", ICMP_MIB_INSRCQUENCHS),
+	SNMP_MIB_ITEM("InRedirects", ICMP_MIB_INREDIRECTS),
+	SNMP_MIB_ITEM("InEchos", ICMP_MIB_INECHOS),
+	SNMP_MIB_ITEM("InEchoReps", ICMP_MIB_INECHOREPS),
+	SNMP_MIB_ITEM("InTimestamps", ICMP_MIB_INTIMESTAMPS),
+	SNMP_MIB_ITEM("InTimestampReps", ICMP_MIB_INTIMESTAMPREPS),
+	SNMP_MIB_ITEM("InAddrMasks", ICMP_MIB_INADDRMASKS),
+	SNMP_MIB_ITEM("InAddrMaskReps", ICMP_MIB_INADDRMASKREPS),
+	SNMP_MIB_ITEM("OutMsgs", ICMP_MIB_OUTMSGS),
+	SNMP_MIB_ITEM("OutErrors", ICMP_MIB_OUTERRORS),
+	SNMP_MIB_ITEM("OutDestUnreachs", ICMP_MIB_OUTDESTUNREACHS),
+	SNMP_MIB_ITEM("OutTimeExcds", ICMP_MIB_OUTTIMEEXCDS),
+	SNMP_MIB_ITEM("OutParmProbs", ICMP_MIB_OUTPARMPROBS),
+	SNMP_MIB_ITEM("OutSrcQuenchs", ICMP_MIB_OUTSRCQUENCHS),
+	SNMP_MIB_ITEM("OutRedirects", ICMP_MIB_OUTREDIRECTS),
+	SNMP_MIB_ITEM("OutEchos", ICMP_MIB_OUTECHOS),
+	SNMP_MIB_ITEM("OutEchoReps", ICMP_MIB_OUTECHOREPS),
+	SNMP_MIB_ITEM("OutTimestamps", ICMP_MIB_OUTTIMESTAMPS),
+	SNMP_MIB_ITEM("OutTimestampReps", ICMP_MIB_OUTTIMESTAMPREPS),
+	SNMP_MIB_ITEM("OutAddrMasks", ICMP_MIB_OUTADDRMASKS),
+	SNMP_MIB_ITEM("OutAddrMaskReps", ICMP_MIB_OUTADDRMASKREPS),
+	SNMP_MIB_SENTINEL
+};
+
+static struct snmp_mib snmp4_tcp_list[] = {
+	SNMP_MIB_ITEM("RtoAlgorithm", TCP_MIB_RTOALGORITHM),
+	SNMP_MIB_ITEM("RtoMin", TCP_MIB_RTOMIN),
+	SNMP_MIB_ITEM("RtoMax", TCP_MIB_RTOMAX),
+	SNMP_MIB_ITEM("MaxConn", TCP_MIB_MAXCONN),
+	SNMP_MIB_ITEM("ActiveOpens", TCP_MIB_ACTIVEOPENS),
+	SNMP_MIB_ITEM("PassiveOpens", TCP_MIB_PASSIVEOPENS),
+	SNMP_MIB_ITEM("AttemptFails", TCP_MIB_ATTEMPTFAILS),
+	SNMP_MIB_ITEM("EstabResets", TCP_MIB_ESTABRESETS),
+	SNMP_MIB_ITEM("CurrEstab", TCP_MIB_CURRESTAB),
+	SNMP_MIB_ITEM("InSegs", TCP_MIB_INSEGS),
+	SNMP_MIB_ITEM("OutSegs", TCP_MIB_OUTSEGS),
+	SNMP_MIB_ITEM("RetransSegs", TCP_MIB_RETRANSSEGS),
+	SNMP_MIB_ITEM("InErrs", TCP_MIB_INERRS),
+	SNMP_MIB_ITEM("OutRsts", TCP_MIB_OUTRSTS),
+	SNMP_MIB_SENTINEL
+};
+
+static struct snmp_mib snmp4_udp_list[] = {
+	SNMP_MIB_ITEM("InDatagrams", UDP_MIB_INDATAGRAMS),
+	SNMP_MIB_ITEM("NoPorts", UDP_MIB_NOPORTS),
+	SNMP_MIB_ITEM("InErrors", UDP_MIB_INERRORS),
+	SNMP_MIB_ITEM("OutDatagrams", UDP_MIB_OUTDATAGRAMS),
+	SNMP_MIB_SENTINEL
+};
+
+static struct snmp_mib snmp4_net_list[] = {
+	SNMP_MIB_ITEM("SyncookiesSent", LINUX_MIB_SYNCOOKIESSENT),
+	SNMP_MIB_ITEM("SyncookiesRecv", LINUX_MIB_SYNCOOKIESRECV),
+	SNMP_MIB_ITEM("SyncookiesFailed", LINUX_MIB_SYNCOOKIESFAILED),
+	SNMP_MIB_ITEM("EmbryonicRsts", LINUX_MIB_EMBRYONICRSTS),
+	SNMP_MIB_ITEM("PruneCalled", LINUX_MIB_PRUNECALLED),
+	SNMP_MIB_ITEM("RcvPruned", LINUX_MIB_RCVPRUNED),
+	SNMP_MIB_ITEM("OfoPruned", LINUX_MIB_OFOPRUNED),
+	SNMP_MIB_ITEM("OutOfWindowIcmps", LINUX_MIB_OUTOFWINDOWICMPS),
+	SNMP_MIB_ITEM("LockDroppedIcmps", LINUX_MIB_LOCKDROPPEDICMPS),
+	SNMP_MIB_ITEM("ArpFilter", LINUX_MIB_ARPFILTER),
+	SNMP_MIB_ITEM("TW", LINUX_MIB_TIMEWAITED),
+	SNMP_MIB_ITEM("TWRecycled", LINUX_MIB_TIMEWAITRECYCLED),
+	SNMP_MIB_ITEM("TWKilled", LINUX_MIB_TIMEWAITKILLED),
+	SNMP_MIB_ITEM("PAWSPassive", LINUX_MIB_PAWSPASSIVEREJECTED),
+	SNMP_MIB_ITEM("PAWSActive", LINUX_MIB_PAWSACTIVEREJECTED),
+	SNMP_MIB_ITEM("PAWSEstab", LINUX_MIB_PAWSESTABREJECTED),
+	SNMP_MIB_ITEM("DelayedACKs", LINUX_MIB_DELAYEDACKS),
+	SNMP_MIB_ITEM("DelayedACKLocked", LINUX_MIB_DELAYEDACKLOCKED),
+	SNMP_MIB_ITEM("DelayedACKLost", LINUX_MIB_DELAYEDACKLOST),
+	SNMP_MIB_ITEM("ListenOverflows", LINUX_MIB_LISTENOVERFLOWS),
+	SNMP_MIB_ITEM("ListenDrops", LINUX_MIB_LISTENDROPS),
+	SNMP_MIB_ITEM("TCPPrequeued", LINUX_MIB_TCPPREQUEUED),
+	SNMP_MIB_ITEM("TCPDirectCopyFromBacklog", LINUX_MIB_TCPDIRECTCOPYFROMBACKLOG),
+	SNMP_MIB_ITEM("TCPDirectCopyFromPrequeue", LINUX_MIB_TCPDIRECTCOPYFROMPREQUEUE),
+	SNMP_MIB_ITEM("TCPPrequeueDropped", LINUX_MIB_TCPPREQUEUEDROPPED),
+	SNMP_MIB_ITEM("TCPHPHits", LINUX_MIB_TCPHPHITS),
+	SNMP_MIB_ITEM("TCPHPHitsToUser", LINUX_MIB_TCPHPHITSTOUSER),
+	SNMP_MIB_ITEM("TCPPureAcks", LINUX_MIB_TCPPUREACKS),
+	SNMP_MIB_ITEM("TCPHPAcks", LINUX_MIB_TCPHPACKS),
+	SNMP_MIB_ITEM("TCPRenoRecovery", LINUX_MIB_TCPRENORECOVERY),
+	SNMP_MIB_ITEM("TCPSackRecovery", LINUX_MIB_TCPSACKRECOVERY),
+	SNMP_MIB_ITEM("TCPSACKReneging", LINUX_MIB_TCPSACKRENEGING),
+	SNMP_MIB_ITEM("TCPFACKReorder", LINUX_MIB_TCPFACKREORDER),
+	SNMP_MIB_ITEM("TCPSACKReorder", LINUX_MIB_TCPSACKREORDER),
+	SNMP_MIB_ITEM("TCPRenoReorder", LINUX_MIB_TCPRENOREORDER),
+	SNMP_MIB_ITEM("TCPTSReorder", LINUX_MIB_TCPTSREORDER),
+	SNMP_MIB_ITEM("TCPFullUndo", LINUX_MIB_TCPFULLUNDO),
+	SNMP_MIB_ITEM("TCPPartialUndo", LINUX_MIB_TCPPARTIALUNDO),
+	SNMP_MIB_ITEM("TCPDSACKUndo", LINUX_MIB_TCPDSACKUNDO),
+	SNMP_MIB_ITEM("TCPLossUndo", LINUX_MIB_TCPLOSSUNDO),
+	SNMP_MIB_ITEM("TCPLoss", LINUX_MIB_TCPLOSS),
+	SNMP_MIB_ITEM("TCPLostRetransmit", LINUX_MIB_TCPLOSTRETRANSMIT),
+	SNMP_MIB_ITEM("TCPRenoFailures", LINUX_MIB_TCPRENOFAILURES),
+	SNMP_MIB_ITEM("TCPSackFailures", LINUX_MIB_TCPSACKFAILURES),
+	SNMP_MIB_ITEM("TCPLossFailures", LINUX_MIB_TCPLOSSFAILURES),
+	SNMP_MIB_ITEM("TCPFastRetrans", LINUX_MIB_TCPFASTRETRANS),
+	SNMP_MIB_ITEM("TCPForwardRetrans", LINUX_MIB_TCPFORWARDRETRANS),
+	SNMP_MIB_ITEM("TCPSlowStartRetrans", LINUX_MIB_TCPSLOWSTARTRETRANS),
+	SNMP_MIB_ITEM("TCPTimeouts", LINUX_MIB_TCPTIMEOUTS),
+	SNMP_MIB_ITEM("TCPRenoRecoveryFail", LINUX_MIB_TCPRENORECOVERYFAIL),
+	SNMP_MIB_ITEM("TCPSackRecoveryFail", LINUX_MIB_TCPSACKRECOVERYFAIL),
+	SNMP_MIB_ITEM("TCPSchedulerFailed", LINUX_MIB_TCPSCHEDULERFAILED),
+	SNMP_MIB_ITEM("TCPRcvCollapsed", LINUX_MIB_TCPRCVCOLLAPSED),
+	SNMP_MIB_ITEM("TCPDSACKOldSent", LINUX_MIB_TCPDSACKOLDSENT),
+	SNMP_MIB_ITEM("TCPDSACKOfoSent", LINUX_MIB_TCPDSACKOFOSENT),
+	SNMP_MIB_ITEM("TCPDSACKRecv", LINUX_MIB_TCPDSACKRECV),
+	SNMP_MIB_ITEM("TCPDSACKOfoRecv", LINUX_MIB_TCPDSACKOFORECV),
+	SNMP_MIB_ITEM("TCPAbortOnSyn", LINUX_MIB_TCPABORTONSYN),
+	SNMP_MIB_ITEM("TCPAbortOnData", LINUX_MIB_TCPABORTONDATA),
+	SNMP_MIB_ITEM("TCPAbortOnClose", LINUX_MIB_TCPABORTONCLOSE),
+	SNMP_MIB_ITEM("TCPAbortOnMemory", LINUX_MIB_TCPABORTONMEMORY),
+	SNMP_MIB_ITEM("TCPAbortOnTimeout", LINUX_MIB_TCPABORTONTIMEOUT),
+	SNMP_MIB_ITEM("TCPAbortOnLinger", LINUX_MIB_TCPABORTONLINGER),
+	SNMP_MIB_ITEM("TCPAbortFailed", LINUX_MIB_TCPABORTFAILED),
+	SNMP_MIB_ITEM("TCPMemoryPressures", LINUX_MIB_TCPMEMORYPRESSURES),
+	SNMP_MIB_SENTINEL
 };
 
 /*
@@ -140,7 +256,7 @@
 {
 	int i;
 
-	seq_printf(seq, "Ip: Forwarding DefaultTTL");
+	seq_puts(seq, "Ip: Forwarding DefaultTTL");
 
 	for (i = 0; snmp4_ipstats_list[i].name != NULL; i++)
 		seq_printf(seq, " %s", snmp4_ipstats_list[i].name);
@@ -150,44 +266,45 @@
 
 	for (i = 0; snmp4_ipstats_list[i].name != NULL; i++)
 		seq_printf(seq, " %lu",
-			   __fold_field((void **) ip_statistics, 
-					snmp4_ipstats_list[i].offset));
+			   fold_field((void **) ip_statistics, 
+				      snmp4_ipstats_list[i].entry));
 
-	seq_printf(seq, "\nIcmp: InMsgs InErrors InDestUnreachs InTimeExcds "
-			"InParmProbs InSrcQuenchs InRedirects InEchos "
-			"InEchoReps InTimestamps InTimestampReps InAddrMasks "
-			"InAddrMaskReps OutMsgs OutErrors OutDestUnreachs "
-			"OutTimeExcds OutParmProbs OutSrcQuenchs OutRedirects "
-			"OutEchos OutEchoReps OutTimestamps OutTimestampReps "
-			"OutAddrMasks OutAddrMaskReps\nIcmp:");
+	seq_puts(seq, "\nIcmp:");
+	for (i = 0; snmp4_icmp_list[i].name != NULL; i++)
+		seq_printf(seq, " %s", snmp4_icmp_list[i].name);
 
-	for (i = 0;
-	     i < offsetof(struct icmp_mib, dummy) / sizeof(unsigned long); i++)
+	seq_puts(seq, "\nIcmp:");
+	for (i = 0; snmp4_icmp_list[i].name != NULL; i++)
 		seq_printf(seq, " %lu",
-			   fold_field((void **) icmp_statistics, i)); 
+			   fold_field((void **) icmp_statistics, 
+				      snmp4_icmp_list[i].entry));
 
-	seq_printf(seq, "\nTcp: RtoAlgorithm RtoMin RtoMax MaxConn ActiveOpens "
-			"PassiveOpens AttemptFails EstabResets CurrEstab "
-			"InSegs OutSegs RetransSegs InErrs OutRsts\nTcp:");
-
-	for (i = 0;
-	     i < offsetof(struct tcp_mib, __pad) / sizeof(unsigned long); i++) {
-		if (i == (offsetof(struct tcp_mib, TcpMaxConn) / sizeof(unsigned long)))
-			/* MaxConn field is negative, RFC 2012 */
-			seq_printf(seq, " %ld", 
-				   fold_field((void **) tcp_statistics, i));
+	seq_puts(seq, "\nTcp:");
+	for (i = 0; snmp4_tcp_list[i].name != NULL; i++)
+		seq_printf(seq, " %s", snmp4_tcp_list[i].name);
+
+	seq_puts(seq, "\nTcp:");
+	for (i = 0; snmp4_tcp_list[i].name != NULL; i++) {
+		/* MaxConn field is signed, RFC 2012 */
+		if (snmp4_tcp_list[i].entry == TCP_MIB_MAXCONN)
+			seq_printf(seq, " %ld",
+				   fold_field((void **) tcp_statistics, 
+					      snmp4_tcp_list[i].entry));
 		else
-			seq_printf(seq, " %lu", 
-				   fold_field((void **) tcp_statistics, i));
+			seq_printf(seq, " %lu",
+				   fold_field((void **) tcp_statistics,
+					      snmp4_tcp_list[i].entry));
 	}
 
-	seq_printf(seq, "\nUdp: InDatagrams NoPorts InErrors OutDatagrams\n"
-			"Udp:");
+	seq_puts(seq, "\nUdp:");
+	for (i = 0; snmp4_udp_list[i].name != NULL; i++)
+		seq_printf(seq, " %s", snmp4_udp_list[i].name);
 
-	for (i = 0;
-	     i < offsetof(struct udp_mib, __pad) / sizeof(unsigned long); i++)
-		seq_printf(seq, " %lu", 
-				fold_field((void **) udp_statistics, i));
+	seq_puts(seq, "\nUdp:");
+	for (i = 0; snmp4_udp_list[i].name != NULL; i++)
+		seq_printf(seq, " %lu",
+			   fold_field((void **) udp_statistics, 
+				      snmp4_udp_list[i].entry));
 
 	seq_putc(seq, '\n');
 	return 0;
@@ -213,39 +330,16 @@
 {
 	int i;
 
-	seq_puts(seq, "TcpExt: SyncookiesSent SyncookiesRecv SyncookiesFailed"
-		      " EmbryonicRsts PruneCalled RcvPruned OfoPruned"
-		      " OutOfWindowIcmps LockDroppedIcmps ArpFilter"
-		      " TW TWRecycled TWKilled"
-		      " PAWSPassive PAWSActive PAWSEstab"
-		      " DelayedACKs DelayedACKLocked DelayedACKLost"
-		      " ListenOverflows ListenDrops"
-		      " TCPPrequeued TCPDirectCopyFromBacklog"
-		      " TCPDirectCopyFromPrequeue TCPPrequeueDropped"
-		      " TCPHPHits TCPHPHitsToUser"
-		      " TCPPureAcks TCPHPAcks"
-		      " TCPRenoRecovery TCPSackRecovery"
-		      " TCPSACKReneging"
-		      " TCPFACKReorder TCPSACKReorder TCPRenoReorder"
-		      " TCPTSReorder"
-		      " TCPFullUndo TCPPartialUndo TCPDSACKUndo TCPLossUndo"
-		      " TCPLoss TCPLostRetransmit"
-		      " TCPRenoFailures TCPSackFailures TCPLossFailures"
-		      " TCPFastRetrans TCPForwardRetrans TCPSlowStartRetrans"
-		      " TCPTimeouts"
-		      " TCPRenoRecoveryFail TCPSackRecoveryFail"
-		      " TCPSchedulerFailed TCPRcvCollapsed"
-		      " TCPDSACKOldSent TCPDSACKOfoSent TCPDSACKRecv"
-		      " TCPDSACKOfoRecv"
-		      " TCPAbortOnSyn TCPAbortOnData TCPAbortOnClose"
-		      " TCPAbortOnMemory TCPAbortOnTimeout TCPAbortOnLinger"
-		      " TCPAbortFailed TCPMemoryPressures\n"
-		      "TcpExt:");
-	for (i = 0;
-	     i < offsetof(struct linux_mib, __pad) / sizeof(unsigned long); 
-	     i++)
-		seq_printf(seq, " %lu", 
-		 	   fold_field((void **) net_statistics, i)); 
+	seq_puts(seq, "\nTcpExt:");
+	for (i = 0; snmp4_net_list[i].name != NULL; i++)
+		seq_printf(seq, " %s", snmp4_net_list[i].name);
+
+	seq_puts(seq, "\nTcpExt:");
+	for (i = 0; snmp4_net_list[i].name != NULL; i++)
+		seq_printf(seq, " %lu",
+			   fold_field((void **) net_statistics, 
+				      snmp4_net_list[i].entry));
+
 	seq_putc(seq, '\n');
 	return 0;
 }
diff -urN linux-2.6.8-rc2/net/ipv4/raw.c linux-2.6.8-rc3/net/ipv4/raw.c
--- linux-2.6.8-rc2/net/ipv4/raw.c	2004-08-03 15:21:16.935914703 -0700
+++ linux-2.6.8-rc3/net/ipv4/raw.c	2004-08-03 15:22:18.345433877 -0700
@@ -319,7 +319,7 @@
 	err = -EFAULT;
 	kfree_skb(skb);
 error:
-	IP_INC_STATS(OutDiscards);
+	IP_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
 	return err; 
 }
 
@@ -555,9 +555,11 @@
 	}
 	if (inet->cmsg_flags)
 		ip_cmsg_recv(msg, skb);
+	if (flags & MSG_TRUNC)
+		copied = skb->len;
 done:
 	skb_free_datagram(sk, skb);
-out:	return err ? : copied;
+out:	return err ? err : copied;
 }
 
 static int raw_init(struct sock *sk)
@@ -657,7 +659,7 @@
 struct proto raw_prot = {
 	.name =		"RAW",
 	.close =	raw_close,
-	.connect =	udp_connect,
+	.connect =	ip4_datagram_connect,
 	.disconnect =	udp_disconnect,
 	.ioctl =	raw_ioctl,
 	.init =		raw_init,
diff -urN linux-2.6.8-rc2/net/ipv4/route.c linux-2.6.8-rc3/net/ipv4/route.c
--- linux-2.6.8-rc2/net/ipv4/route.c	2004-08-03 15:21:16.936914744 -0700
+++ linux-2.6.8-rc3/net/ipv4/route.c	2004-08-03 15:22:18.354434246 -0700
@@ -1729,17 +1729,6 @@
 
 	rth->rt_flags = flags;
 
-#ifdef CONFIG_NET_FASTROUTE
-	if (netdev_fastroute && !(flags&(RTCF_NAT|RTCF_MASQ|RTCF_DOREDIRECT))) {
-		struct net_device *odev = rth->u.dst.dev;
-		if (odev != dev &&
-		    dev->accept_fastpath &&
-		    odev->mtu >= dev->mtu &&
-		    dev->accept_fastpath(dev, &rth->u.dst) == 0)
-			rth->rt_flags |= RTCF_FAST;
-	}
-#endif
-
 intern:
 	err = rt_intern_hash(hash, rth, (struct rtable**)&skb->dst);
 done:
diff -urN linux-2.6.8-rc2/net/ipv4/syncookies.c linux-2.6.8-rc3/net/ipv4/syncookies.c
--- linux-2.6.8-rc2/net/ipv4/syncookies.c	2004-06-15 22:18:38.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv4/syncookies.c	2004-08-03 15:22:18.355434287 -0700
@@ -59,7 +59,7 @@
 		;
 	*mssp = msstab[mssind] + 1;
 
-	NET_INC_STATS_BH(SyncookiesSent);
+	NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESSENT);
 
 	return secure_tcp_syn_cookie(skb->nh.iph->saddr, skb->nh.iph->daddr,
 				     skb->h.th->source, skb->h.th->dest,
@@ -127,11 +127,11 @@
 
   	if (time_after(jiffies, tp->last_synq_overflow + TCP_TIMEOUT_INIT) ||
 	    (mss = cookie_check(skb, cookie)) == 0) {
-	 	NET_INC_STATS_BH(SyncookiesFailed);
+	 	NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESFAILED);
 		goto out;
 	}
 
-	NET_INC_STATS_BH(SyncookiesRecv);
+	NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESRECV);
 
 	req = tcp_openreq_alloc();
 	ret = NULL;
diff -urN linux-2.6.8-rc2/net/ipv4/tcp.c linux-2.6.8-rc3/net/ipv4/tcp.c
--- linux-2.6.8-rc2/net/ipv4/tcp.c	2004-08-03 15:21:16.940914908 -0700
+++ linux-2.6.8-rc3/net/ipv4/tcp.c	2004-08-03 15:22:18.358434410 -0700
@@ -305,7 +305,7 @@
 void tcp_enter_memory_pressure(void)
 {
 	if (!tcp_memory_pressure) {
-		NET_INC_STATS(TCPMemoryPressures);
+		NET_INC_STATS(LINUX_MIB_TCPMEMORYPRESSURES);
 		tcp_memory_pressure = 1;
 	}
 }
@@ -1109,7 +1109,7 @@
 	struct sk_buff *skb;
 	struct tcp_opt *tp = tcp_sk(sk);
 
-	NET_ADD_STATS_USER(TCPPrequeued, skb_queue_len(&tp->ucopy.prequeue));
+	NET_ADD_STATS_USER(LINUX_MIB_TCPPREQUEUED, skb_queue_len(&tp->ucopy.prequeue));
 
 	/* RX process wants to run with disabled BHs, though it is not
 	 * necessary */
@@ -1392,7 +1392,7 @@
 			/* __ Restore normal policy in scheduler __ */
 
 			if ((chunk = len - tp->ucopy.len) != 0) {
-				NET_ADD_STATS_USER(TCPDirectCopyFromBacklog, chunk);
+				NET_ADD_STATS_USER(LINUX_MIB_TCPDIRECTCOPYFROMBACKLOG, chunk);
 				len -= chunk;
 				copied += chunk;
 			}
@@ -1403,7 +1403,7 @@
 				tcp_prequeue_process(sk);
 
 				if ((chunk = len - tp->ucopy.len) != 0) {
-					NET_ADD_STATS_USER(TCPDirectCopyFromPrequeue, chunk);
+					NET_ADD_STATS_USER(LINUX_MIB_TCPDIRECTCOPYFROMPREQUEUE, chunk);
 					len -= chunk;
 					copied += chunk;
 				}
@@ -1488,7 +1488,7 @@
 			tcp_prequeue_process(sk);
 
 			if (copied > 0 && (chunk = len - tp->ucopy.len) != 0) {
-				NET_ADD_STATS_USER(TCPDirectCopyFromPrequeue, chunk);
+				NET_ADD_STATS_USER(LINUX_MIB_TCPDIRECTCOPYFROMPREQUEUE, chunk);
 				len -= chunk;
 				copied += chunk;
 			}
@@ -1659,13 +1659,13 @@
 	 */
 	if (data_was_unread) {
 		/* Unread data was tossed, zap the connection. */
-		NET_INC_STATS_USER(TCPAbortOnClose);
+		NET_INC_STATS_USER(LINUX_MIB_TCPABORTONCLOSE);
 		tcp_set_state(sk, TCP_CLOSE);
 		tcp_send_active_reset(sk, GFP_KERNEL);
 	} else if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
 		/* Check zero linger _after_ checking for unread data. */
 		sk->sk_prot->disconnect(sk, 0);
-		NET_INC_STATS_USER(TCPAbortOnData);
+		NET_INC_STATS_USER(LINUX_MIB_TCPABORTONDATA);
 	} else if (tcp_close_state(sk)) {
 		/* We FIN if the application ate all the data before
 		 * zapping the connection.
@@ -1731,7 +1731,7 @@
 		if (tp->linger2 < 0) {
 			tcp_set_state(sk, TCP_CLOSE);
 			tcp_send_active_reset(sk, GFP_ATOMIC);
-			NET_INC_STATS_BH(TCPAbortOnLinger);
+			NET_INC_STATS_BH(LINUX_MIB_TCPABORTONLINGER);
 		} else {
 			int tmo = tcp_fin_time(tp);
 
@@ -1754,7 +1754,7 @@
 				       "sockets\n");
 			tcp_set_state(sk, TCP_CLOSE);
 			tcp_send_active_reset(sk, GFP_ATOMIC);
-			NET_INC_STATS_BH(TCPAbortOnMemory);
+			NET_INC_STATS_BH(LINUX_MIB_TCPABORTONMEMORY);
 		}
 	}
 	atomic_inc(&tcp_orphan_count);
diff -urN linux-2.6.8-rc2/net/ipv4/tcp_input.c linux-2.6.8-rc3/net/ipv4/tcp_input.c
--- linux-2.6.8-rc2/net/ipv4/tcp_input.c	2004-08-03 15:21:16.982916631 -0700
+++ linux-2.6.8-rc3/net/ipv4/tcp_input.c	2004-08-03 15:22:18.405436339 -0700
@@ -330,6 +330,15 @@
 	tp->snd_cwnd_stamp = tcp_time_stamp;
 }
 
+static void init_bictcp(struct tcp_opt *tp)
+{
+	tp->bictcp.cnt = 0;
+
+	tp->bictcp.last_max_cwnd = 0;
+	tp->bictcp.last_cwnd = 0;
+	tp->bictcp.last_stamp = 0;
+}
+
 /* 5. Recalculate window clamp after socket hit its memory bounds. */
 static void tcp_clamp_window(struct sock *sk, struct tcp_opt *tp)
 {
@@ -876,13 +885,13 @@
 
 		/* This exciting event is worth to be remembered. 8) */
 		if (ts)
-			NET_INC_STATS_BH(TCPTSReorder);
+			NET_INC_STATS_BH(LINUX_MIB_TCPTSREORDER);
 		else if (IsReno(tp))
-			NET_INC_STATS_BH(TCPRenoReorder);
+			NET_INC_STATS_BH(LINUX_MIB_TCPRENOREORDER);
 		else if (IsFack(tp))
-			NET_INC_STATS_BH(TCPFACKReorder);
+			NET_INC_STATS_BH(LINUX_MIB_TCPFACKREORDER);
 		else
-			NET_INC_STATS_BH(TCPSACKReorder);
+			NET_INC_STATS_BH(LINUX_MIB_TCPSACKREORDER);
 #if FASTRETRANS_DEBUG > 1
 		printk(KERN_DEBUG "Disorder%d %d %u f%u s%u rr%d\n",
 		       tp->sack_ok, tp->ca_state,
@@ -981,13 +990,13 @@
 			if (before(start_seq, ack)) {
 				dup_sack = 1;
 				tp->sack_ok |= 4;
-				NET_INC_STATS_BH(TCPDSACKRecv);
+				NET_INC_STATS_BH(LINUX_MIB_TCPDSACKRECV);
 			} else if (num_sacks > 1 &&
 				   !after(end_seq, ntohl(sp[1].end_seq)) &&
 				   !before(start_seq, ntohl(sp[1].start_seq))) {
 				dup_sack = 1;
 				tp->sack_ok |= 4;
-				NET_INC_STATS_BH(TCPDSACKOfoRecv);
+				NET_INC_STATS_BH(LINUX_MIB_TCPDSACKOFORECV);
 			}
 
 			/* D-SACK for already forgotten data...
@@ -1131,7 +1140,7 @@
 					tp->lost_out++;
 					TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
 					flag |= FLAG_DATA_SACKED;
-					NET_INC_STATS_BH(TCPLostRetransmit);
+					NET_INC_STATS_BH(LINUX_MIB_TCPLOSTRETRANSMIT);
 				}
 			}
 		}
@@ -1233,6 +1242,8 @@
 	tcp_set_ca_state(tp, TCP_CA_Loss);
 	tp->high_seq = tp->frto_highmark;
 	TCP_ECN_queue_cwr(tp);
+
+	init_bictcp(tp);
 }
 
 void tcp_clear_retrans(struct tcp_opt *tp)
@@ -1310,7 +1321,7 @@
 	 */
 	if ((skb = skb_peek(&sk->sk_write_queue)) != NULL &&
 	    (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)) {
-		NET_INC_STATS_BH(TCPSACKReneging);
+		NET_INC_STATS_BH(LINUX_MIB_TCPSACKRENEGING);
 
 		tcp_enter_loss(sk, 1);
 		tp->retransmits++;
@@ -1658,9 +1669,9 @@
 		DBGUNDO(sk, tp, tp->ca_state == TCP_CA_Loss ? "loss" : "retrans");
 		tcp_undo_cwr(tp, 1);
 		if (tp->ca_state == TCP_CA_Loss)
-			NET_INC_STATS_BH(TCPLossUndo);
+			NET_INC_STATS_BH(LINUX_MIB_TCPLOSSUNDO);
 		else
-			NET_INC_STATS_BH(TCPFullUndo);
+			NET_INC_STATS_BH(LINUX_MIB_TCPFULLUNDO);
 		tp->undo_marker = 0;
 	}
 	if (tp->snd_una == tp->high_seq && IsReno(tp)) {
@@ -1681,7 +1692,7 @@
 		DBGUNDO(sk, tp, "D-SACK");
 		tcp_undo_cwr(tp, 1);
 		tp->undo_marker = 0;
-		NET_INC_STATS_BH(TCPDSACKUndo);
+		NET_INC_STATS_BH(LINUX_MIB_TCPDSACKUNDO);
 	}
 }
 
@@ -1703,7 +1714,7 @@
 
 		DBGUNDO(sk, tp, "Hoe");
 		tcp_undo_cwr(tp, 0);
-		NET_INC_STATS_BH(TCPPartialUndo);
+		NET_INC_STATS_BH(LINUX_MIB_TCPPARTIALUNDO);
 
 		/* So... Do not make Hoe's retransmit yet.
 		 * If the first packet was delayed, the rest
@@ -1726,7 +1737,7 @@
 		tp->lost_out = 0;
 		tp->left_out = tp->sacked_out;
 		tcp_undo_cwr(tp, 1);
-		NET_INC_STATS_BH(TCPLossUndo);
+		NET_INC_STATS_BH(LINUX_MIB_TCPLOSSUNDO);
 		tp->retransmits = 0;
 		tp->undo_marker = 0;
 		if (!IsReno(tp))
@@ -1814,7 +1825,7 @@
 	    tp->ca_state != TCP_CA_Open &&
 	    tp->fackets_out > tp->reordering) {
 		tcp_mark_head_lost(sk, tp, tp->fackets_out-tp->reordering, tp->high_seq);
-		NET_INC_STATS_BH(TCPLoss);
+		NET_INC_STATS_BH(LINUX_MIB_TCPLOSS);
 	}
 
 	/* D. Synchronize left_out to current state. */
@@ -1907,9 +1918,9 @@
 		/* Otherwise enter Recovery state */
 
 		if (IsReno(tp))
-			NET_INC_STATS_BH(TCPRenoRecovery);
+			NET_INC_STATS_BH(LINUX_MIB_TCPRENORECOVERY);
 		else
-			NET_INC_STATS_BH(TCPSackRecovery);
+			NET_INC_STATS_BH(LINUX_MIB_TCPSACKRECOVERY);
 
 		tp->high_seq = tp->snd_nxt;
 		tp->prior_ssthresh = 0;
@@ -2011,10 +2022,12 @@
 	if (!sysctl_tcp_bic)
 		return tp->snd_cwnd;
 
-	if (tp->bictcp.last_cwnd == tp->snd_cwnd)
-		return tp->bictcp.cnt; /*  same cwnd, no update */
-      
+	if (tp->bictcp.last_cwnd == tp->snd_cwnd &&
+	   (s32)(tcp_time_stamp - tp->bictcp.last_stamp) <= (HZ>>5))
+		return tp->bictcp.cnt;
+
 	tp->bictcp.last_cwnd = tp->snd_cwnd;
+	tp->bictcp.last_stamp = tcp_time_stamp;
       
 	/* start off normal */
 	if (tp->snd_cwnd <= sysctl_tcp_bic_low_window)
@@ -2797,12 +2810,12 @@
 		tcp_westwood_fast_bw(sk, skb);
 		flag |= FLAG_WIN_UPDATE;
 
-		NET_INC_STATS_BH(TCPHPAcks);
+		NET_INC_STATS_BH(LINUX_MIB_TCPHPACKS);
 	} else {
 		if (ack_seq != TCP_SKB_CB(skb)->end_seq)
 			flag |= FLAG_DATA;
 		else
-			NET_INC_STATS_BH(TCPPureAcks);
+			NET_INC_STATS_BH(LINUX_MIB_TCPPUREACKS);
 
 		flag |= tcp_ack_update_window(sk, tp, skb, ack, ack_seq);
 
@@ -3197,9 +3210,9 @@
 {
 	if (tp->sack_ok && sysctl_tcp_dsack) {
 		if (before(seq, tp->rcv_nxt))
-			NET_INC_STATS_BH(TCPDSACKOldSent);
+			NET_INC_STATS_BH(LINUX_MIB_TCPDSACKOLDSENT);
 		else
-			NET_INC_STATS_BH(TCPDSACKOfoSent);
+			NET_INC_STATS_BH(LINUX_MIB_TCPDSACKOFOSENT);
 
 		tp->dsack = 1;
 		tp->duplicate_sack[0].start_seq = seq;
@@ -3222,7 +3235,7 @@
 
 	if (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq &&
 	    before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
-		NET_INC_STATS_BH(DelayedACKLost);
+		NET_INC_STATS_BH(LINUX_MIB_DELAYEDACKLOST);
 		tcp_enter_quickack_mode(tp);
 
 		if (tp->sack_ok && sysctl_tcp_dsack) {
@@ -3489,7 +3502,7 @@
 
 	if (!after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt)) {
 		/* A retransmit, 2nd most common case.  Force an immediate ack. */
-		NET_INC_STATS_BH(DelayedACKLost);
+		NET_INC_STATS_BH(LINUX_MIB_DELAYEDACKLOST);
 		tcp_dsack_set(tp, TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq);
 
 out_of_window:
@@ -3631,7 +3644,7 @@
 			struct sk_buff *next = skb->next;
 			__skb_unlink(skb, skb->list);
 			__kfree_skb(skb);
-			NET_INC_STATS_BH(TCPRcvCollapsed);
+			NET_INC_STATS_BH(LINUX_MIB_TCPRCVCOLLAPSED);
 			skb = next;
 			continue;
 		}
@@ -3697,7 +3710,7 @@
 				struct sk_buff *next = skb->next;
 				__skb_unlink(skb, skb->list);
 				__kfree_skb(skb);
-				NET_INC_STATS_BH(TCPRcvCollapsed);
+				NET_INC_STATS_BH(LINUX_MIB_TCPRCVCOLLAPSED);
 				skb = next;
 				if (skb == tail || skb->h.th->syn || skb->h.th->fin)
 					return;
@@ -3760,7 +3773,7 @@
 
 	SOCK_DEBUG(sk, "prune_queue: c=%x\n", tp->copied_seq);
 
-	NET_INC_STATS_BH(PruneCalled);
+	NET_INC_STATS_BH(LINUX_MIB_PRUNECALLED);
 
 	if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
 		tcp_clamp_window(sk, tp);
@@ -3781,7 +3794,7 @@
 
 	/* First, purge the out_of_order queue. */
 	if (skb_queue_len(&tp->out_of_order_queue)) {
-		NET_ADD_STATS_BH(OfoPruned,
+		NET_ADD_STATS_BH(LINUX_MIB_OFOPRUNED, 
 				 skb_queue_len(&tp->out_of_order_queue));
 		__skb_queue_purge(&tp->out_of_order_queue);
 
@@ -3802,7 +3815,7 @@
 	 * drop receive data on the floor.  It will get retransmitted
 	 * and hopefully then we'll have sufficient space.
 	 */
-	NET_INC_STATS_BH(RcvPruned);
+	NET_INC_STATS_BH(LINUX_MIB_RCVPRUNED);
 
 	/* Massive buffer overcommit. */
 	tp->pred_flags = 0;
@@ -4181,7 +4194,7 @@
 				tcp_data_snd_check(sk);
 				return 0;
 			} else { /* Header too small */
-				TCP_INC_STATS_BH(TcpInErrs);
+				TCP_INC_STATS_BH(TCP_MIB_INERRS);
 				goto discard;
 			}
 		} else {
@@ -4208,7 +4221,7 @@
 
 					__skb_pull(skb, tcp_header_len);
 					tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
-					NET_INC_STATS_BH(TCPHPHitsToUser);
+					NET_INC_STATS_BH(LINUX_MIB_TCPHPHITSTOUSER);
 					eaten = 1;
 				}
 			}
@@ -4230,7 +4243,7 @@
 				if ((int)skb->truesize > sk->sk_forward_alloc)
 					goto step5;
 
-				NET_INC_STATS_BH(TCPHPHits);
+				NET_INC_STATS_BH(LINUX_MIB_TCPHPHITS);
 
 				/* Bulk data transfer: receiver */
 				__skb_pull(skb,tcp_header_len);
@@ -4278,7 +4291,7 @@
 	if (tcp_fast_parse_options(skb, th, tp) && tp->saw_tstamp &&
 	    tcp_paws_discard(tp, skb)) {
 		if (!th->rst) {
-			NET_INC_STATS_BH(PAWSEstabRejected);
+			NET_INC_STATS_BH(LINUX_MIB_PAWSESTABREJECTED);
 			tcp_send_dupack(sk, skb);
 			goto discard;
 		}
@@ -4313,8 +4326,8 @@
 	tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
 
 	if (th->syn && !before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
-		TCP_INC_STATS_BH(TcpInErrs);
-		NET_INC_STATS_BH(TCPAbortOnSyn);
+		TCP_INC_STATS_BH(TCP_MIB_INERRS);
+		NET_INC_STATS_BH(LINUX_MIB_TCPABORTONSYN);
 		tcp_reset(sk);
 		return 1;
 	}
@@ -4336,7 +4349,7 @@
 	return 0;
 
 csum_error:
-	TCP_INC_STATS_BH(TcpInErrs);
+	TCP_INC_STATS_BH(TCP_MIB_INERRS);
 
 discard:
 	__kfree_skb(skb);
@@ -4369,7 +4382,7 @@
 		if (tp->saw_tstamp && tp->rcv_tsecr &&
 		    !between(tp->rcv_tsecr, tp->retrans_stamp,
 			     tcp_time_stamp)) {
-			NET_INC_STATS_BH(PAWSActiveRejected);
+			NET_INC_STATS_BH(LINUX_MIB_PAWSACTIVEREJECTED);
 			goto reset_and_undo;
 		}
 
@@ -4612,6 +4625,7 @@
 				return 1;
 
 			init_westwood(sk);
+			init_bictcp(tp);
 
 			/* Now we have several options: In theory there is 
 			 * nothing else in the frame. KA9Q has an option to 
@@ -4635,6 +4649,7 @@
 
 	case TCP_SYN_SENT:
 		init_westwood(sk);
+		init_bictcp(tp);
 
 		queued = tcp_rcv_synsent_state_process(sk, skb, th, len);
 		if (queued >= 0)
@@ -4650,7 +4665,7 @@
 	if (tcp_fast_parse_options(skb, th, tp) && tp->saw_tstamp &&
 	    tcp_paws_discard(tp, skb)) {
 		if (!th->rst) {
-			NET_INC_STATS_BH(PAWSEstabRejected);
+			NET_INC_STATS_BH(LINUX_MIB_PAWSESTABREJECTED);
 			tcp_send_dupack(sk, skb);
 			goto discard;
 		}
@@ -4679,7 +4694,7 @@
 	 *	Check for a SYN in window.
 	 */
 	if (th->syn && !before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
-		NET_INC_STATS_BH(TCPAbortOnSyn);
+		NET_INC_STATS_BH(LINUX_MIB_TCPABORTONSYN);
 		tcp_reset(sk);
 		return 1;
 	}
@@ -4758,7 +4773,7 @@
 					    (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq &&
 					     after(TCP_SKB_CB(skb)->end_seq - th->fin, tp->rcv_nxt))) {
 						tcp_done(sk);
-						NET_INC_STATS_BH(TCPAbortOnData);
+						NET_INC_STATS_BH(LINUX_MIB_TCPABORTONDATA);
 						return 1;
 					}
 
@@ -4818,7 +4833,7 @@
 		if (sk->sk_shutdown & RCV_SHUTDOWN) {
 			if (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq &&
 			    after(TCP_SKB_CB(skb)->end_seq - th->fin, tp->rcv_nxt)) {
-				NET_INC_STATS_BH(TCPAbortOnData);
+				NET_INC_STATS_BH(LINUX_MIB_TCPABORTONDATA);
 				tcp_reset(sk);
 				return 1;
 			}
diff -urN linux-2.6.8-rc2/net/ipv4/tcp_ipv4.c linux-2.6.8-rc3/net/ipv4/tcp_ipv4.c
--- linux-2.6.8-rc2/net/ipv4/tcp_ipv4.c	2004-08-03 15:21:16.996917206 -0700
+++ linux-2.6.8-rc3/net/ipv4/tcp_ipv4.c	2004-08-03 15:22:18.407436421 -0700
@@ -618,11 +618,11 @@
 
 	if (twp) {
 		*twp = tw;
-		NET_INC_STATS_BH(TimeWaitRecycled);
+		NET_INC_STATS_BH(LINUX_MIB_TIMEWAITRECYCLED);
 	} else if (tw) {
 		/* Silly. Should hash-dance instead... */
 		tcp_tw_deschedule(tw);
-		NET_INC_STATS_BH(TimeWaitRecycled);
+		NET_INC_STATS_BH(LINUX_MIB_TIMEWAITRECYCLED);
 
 		tcp_tw_put(tw);
 	}
@@ -998,14 +998,14 @@
 	int err;
 
 	if (skb->len < (iph->ihl << 2) + 8) {
-		ICMP_INC_STATS_BH(IcmpInErrors);
+		ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
 		return;
 	}
 
 	sk = tcp_v4_lookup(iph->daddr, th->dest, iph->saddr,
 			   th->source, tcp_v4_iif(skb));
 	if (!sk) {
-		ICMP_INC_STATS_BH(IcmpInErrors);
+		ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
 		return;
 	}
 	if (sk->sk_state == TCP_TIME_WAIT) {
@@ -1018,7 +1018,7 @@
 	 * servers this needs to be solved differently.
 	 */
 	if (sock_owned_by_user(sk))
-		NET_INC_STATS_BH(LockDroppedIcmps);
+		NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
 
 	if (sk->sk_state == TCP_CLOSE)
 		goto out;
@@ -1027,7 +1027,7 @@
 	seq = ntohl(th->seq);
 	if (sk->sk_state != TCP_LISTEN &&
 	    !between(seq, tp->snd_una, tp->snd_nxt)) {
-		NET_INC_STATS(OutOfWindowIcmps);
+		NET_INC_STATS(LINUX_MIB_OUTOFWINDOWICMPS);
 		goto out;
 	}
 
@@ -1078,7 +1078,7 @@
 		BUG_TRAP(!req->sk);
 
 		if (seq != req->snt_isn) {
-			NET_INC_STATS_BH(OutOfWindowIcmps);
+			NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 			goto out;
 		}
 
@@ -1096,7 +1096,7 @@
 			       It can f.e. if SYNs crossed.
 			     */
 		if (!sock_owned_by_user(sk)) {
-			TCP_INC_STATS_BH(TcpAttemptFails);
+			TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
 			sk->sk_err = err;
 
 			sk->sk_error_report(sk);
@@ -1205,8 +1205,8 @@
 
 	ip_send_reply(tcp_socket->sk, skb, &arg, sizeof rth);
 
-	TCP_INC_STATS_BH(TcpOutSegs);
-	TCP_INC_STATS_BH(TcpOutRsts);
+	TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
+	TCP_INC_STATS_BH(TCP_MIB_OUTRSTS);
 }
 
 /* The code following below sending ACKs in SYN-RECV and TIME-WAIT states
@@ -1253,7 +1253,7 @@
 
 	ip_send_reply(tcp_socket->sk, skb, &arg, arg.iov[0].iov_len);
 
-	TCP_INC_STATS_BH(TcpOutSegs);
+	TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
 }
 
 static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb)
@@ -1290,12 +1290,12 @@
 					 .dport = req->rmt_port } } };
 
 	if (ip_route_output_flow(&rt, &fl, sk, 0)) {
-		IP_INC_STATS_BH(OutNoRoutes);
+		IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
 		return NULL;
 	}
 	if (opt && opt->is_strictroute && rt->rt_dst != rt->rt_gateway) {
 		ip_rt_put(rt);
-		IP_INC_STATS_BH(OutNoRoutes);
+		IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
 		return NULL;
 	}
 	return &rt->u.dst;
@@ -1505,7 +1505,7 @@
 			if (xtime.tv_sec < peer->tcp_ts_stamp + TCP_PAWS_MSL &&
 			    (s32)(peer->tcp_ts - req->ts_recent) >
 							TCP_PAWS_WINDOW) {
-				NET_INC_STATS_BH(PAWSPassiveRejected);
+				NET_INC_STATS_BH(LINUX_MIB_PAWSPASSIVEREJECTED);
 				dst_release(dst);
 				goto drop_and_free;
 			}
@@ -1550,7 +1550,7 @@
 drop_and_free:
 	tcp_openreq_free(req);
 drop:
-	TCP_INC_STATS_BH(TcpAttemptFails);
+	TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
 	return 0;
 }
 
@@ -1605,9 +1605,9 @@
 	return newsk;
 
 exit_overflow:
-	NET_INC_STATS_BH(ListenOverflows);
+	NET_INC_STATS_BH(LINUX_MIB_LISTENOVERFLOWS);
 exit:
-	NET_INC_STATS_BH(ListenDrops);
+	NET_INC_STATS_BH(LINUX_MIB_LISTENDROPS);
 	dst_release(dst);
 	return NULL;
 }
@@ -1725,7 +1725,7 @@
 	return 0;
 
 csum_err:
-	TCP_INC_STATS_BH(TcpInErrs);
+	TCP_INC_STATS_BH(TCP_MIB_INERRS);
 	goto discard;
 }
 
@@ -1743,7 +1743,7 @@
 		goto discard_it;
 
 	/* Count it even if it's bad */
-	TCP_INC_STATS_BH(TcpInSegs);
+	TCP_INC_STATS_BH(TCP_MIB_INSEGS);
 
 	if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
 		goto discard_it;
@@ -1810,7 +1810,7 @@
 
 	if (skb->len < (th->doff << 2) || tcp_checksum_complete(skb)) {
 bad_packet:
-		TCP_INC_STATS_BH(TcpInErrs);
+		TCP_INC_STATS_BH(TCP_MIB_INERRS);
 	} else {
 		tcp_v4_send_reset(skb);
 	}
@@ -1831,7 +1831,7 @@
 	}
 
 	if (skb->len < (th->doff << 2) || tcp_checksum_complete(skb)) {
-		TCP_INC_STATS_BH(TcpInErrs);
+		TCP_INC_STATS_BH(TCP_MIB_INERRS);
 		tcp_tw_put((struct tcp_tw_bucket *) sk);
 		goto discard_it;
 	}
diff -urN linux-2.6.8-rc2/net/ipv4/tcp_minisocks.c linux-2.6.8-rc3/net/ipv4/tcp_minisocks.c
--- linux-2.6.8-rc2/net/ipv4/tcp_minisocks.c	2004-08-03 15:21:16.998917288 -0700
+++ linux-2.6.8-rc3/net/ipv4/tcp_minisocks.c	2004-08-03 15:22:18.409436503 -0700
@@ -266,7 +266,7 @@
 	}
 
 	if (paws_reject)
-		NET_INC_STATS_BH(PAWSEstabRejected);
+		NET_INC_STATS_BH(LINUX_MIB_PAWSESTABREJECTED);
 
 	if(!th->rst) {
 		/* In this case we must reset the TIMEWAIT timer.
@@ -462,7 +462,7 @@
 	}
 
 	tcp_tw_count -= killed;
-	NET_ADD_STATS_BH(TimeWaited, killed);
+	NET_ADD_STATS_BH(LINUX_MIB_TIMEWAITED, killed);
 
 	return ret;
 }
@@ -672,7 +672,7 @@
 out:
 	if ((tcp_tw_count -= killed) == 0)
 		del_timer(&tcp_tw_timer);
-	NET_ADD_STATS_BH(TimeWaitKilled, killed);
+	NET_ADD_STATS_BH(LINUX_MIB_TIMEWAITKILLED, killed);
 	spin_unlock(&tw_death_lock);
 }
 
@@ -767,9 +767,6 @@
 		newtp->snd_cwnd = 2;
 		newtp->snd_cwnd_cnt = 0;
 
-		newtp->bictcp.cnt = 0;
-		newtp->bictcp.last_max_cwnd = newtp->bictcp.last_cwnd = 0;
-
 		newtp->frto_counter = 0;
 		newtp->frto_highmark = 0;
 
@@ -845,7 +842,7 @@
 			newsk->sk_no_largesend = 1;
 
 		tcp_vegas_init(newtp);
-		TCP_INC_STATS_BH(TcpPassiveOpens);
+		TCP_INC_STATS_BH(TCP_MIB_PASSIVEOPENS);
 	}
 	return newsk;
 }
@@ -976,7 +973,7 @@
 		if (!(flg & TCP_FLAG_RST))
 			req->class->send_ack(skb, req);
 		if (paws_reject)
-			NET_INC_STATS_BH(PAWSEstabRejected);
+			NET_INC_STATS_BH(LINUX_MIB_PAWSESTABREJECTED);
 		return NULL;
 	}
 
@@ -1033,7 +1030,7 @@
 	}
 
 embryonic_reset:
-	NET_INC_STATS_BH(EmbryonicRsts);
+	NET_INC_STATS_BH(LINUX_MIB_EMBRYONICRSTS);
 	if (!(flg & TCP_FLAG_RST))
 		req->class->send_reset(skb);
 
diff -urN linux-2.6.8-rc2/net/ipv4/tcp_output.c linux-2.6.8-rc3/net/ipv4/tcp_output.c
--- linux-2.6.8-rc2/net/ipv4/tcp_output.c	2004-08-03 15:21:17.001917411 -0700
+++ linux-2.6.8-rc3/net/ipv4/tcp_output.c	2004-08-03 15:22:18.411436585 -0700
@@ -168,6 +168,14 @@
 	tp->rcv_wnd = new_win;
 	tp->rcv_wup = tp->rcv_nxt;
 
+	/* Make sure we do not exceed the maximum possible
+	 * scaled window.
+	 */
+	if (!tp->rcv_wscale)
+		new_win = min(new_win, MAX_TCP_WINDOW);
+	else
+		new_win = min(new_win, (65535U << tp->rcv_wscale));
+
 	/* RFC1323 scaling applied */
 	new_win >>= tp->rcv_wscale;
 
@@ -291,7 +299,7 @@
 		if (skb->len != tcp_header_size)
 			tcp_event_data_sent(tp, skb, sk);
 
-		TCP_INC_STATS(TcpOutSegs);
+		TCP_INC_STATS(TCP_MIB_OUTSEGS);
 
 		err = tp->af_specific->queue_xmit(skb, 0);
 		if (err <= 0)
@@ -916,7 +924,7 @@
 
 	if (err == 0) {
 		/* Update global TCP statistics. */
-		TCP_INC_STATS(TcpRetransSegs);
+		TCP_INC_STATS(TCP_MIB_RETRANSSEGS);
 
 #if FASTRETRANS_DEBUG > 0
 		if (TCP_SKB_CB(skb)->sacked&TCPCB_SACKED_RETRANS) {
@@ -968,9 +976,9 @@
 					if (tcp_retransmit_skb(sk, skb))
 						return;
 					if (tp->ca_state != TCP_CA_Loss)
-						NET_INC_STATS_BH(TCPFastRetrans);
+						NET_INC_STATS_BH(LINUX_MIB_TCPFASTRETRANS);
 					else
-						NET_INC_STATS_BH(TCPSlowStartRetrans);
+						NET_INC_STATS_BH(LINUX_MIB_TCPSLOWSTARTRETRANS);
 
 					if (skb ==
 					    skb_peek(&sk->sk_write_queue))
@@ -1022,7 +1030,7 @@
 		if (skb == skb_peek(&sk->sk_write_queue))
 			tcp_reset_xmit_timer(sk, TCP_TIME_RETRANS, tp->rto);
 
-		NET_INC_STATS_BH(TCPForwardRetrans);
+		NET_INC_STATS_BH(LINUX_MIB_TCPFORWARDRETRANS);
 	}
 }
 
@@ -1082,7 +1090,7 @@
 	/* NOTE: No TCP options attached and we never retransmit this. */
 	skb = alloc_skb(MAX_TCP_HEADER, priority);
 	if (!skb) {
-		NET_INC_STATS(TCPAbortFailed);
+		NET_INC_STATS(LINUX_MIB_TCPABORTFAILED);
 		return;
 	}
 
@@ -1097,7 +1105,7 @@
 	TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(skb)->seq;
 	TCP_SKB_CB(skb)->when = tcp_time_stamp;
 	if (tcp_transmit_skb(sk, skb))
-		NET_INC_STATS(TCPAbortFailed);
+		NET_INC_STATS(LINUX_MIB_TCPABORTFAILED);
 }
 
 /* WARNING: This routine must only be called when we have already sent
@@ -1197,7 +1205,7 @@
 
 	skb->csum = 0;
 	th->doff = (tcp_header_size >> 2);
-	TCP_INC_STATS(TcpOutSegs);
+	TCP_INC_STATS(TCP_MIB_OUTSEGS);
 	return skb;
 }
 
@@ -1285,7 +1293,7 @@
 	sk_charge_skb(sk, buff);
 	tp->packets_out++;
 	tcp_transmit_skb(sk, skb_clone(buff, GFP_KERNEL));
-	TCP_INC_STATS(TcpActiveOpens);
+	TCP_INC_STATS(TCP_MIB_ACTIVEOPENS);
 
 	/* Timer for repeating the SYN until an answer. */
 	tcp_reset_xmit_timer(sk, TCP_TIME_RETRANS, tp->rto);
diff -urN linux-2.6.8-rc2/net/ipv4/tcp_timer.c linux-2.6.8-rc3/net/ipv4/tcp_timer.c
--- linux-2.6.8-rc2/net/ipv4/tcp_timer.c	2004-08-03 15:21:17.001917411 -0700
+++ linux-2.6.8-rc3/net/ipv4/tcp_timer.c	2004-08-03 15:22:18.412436626 -0700
@@ -83,7 +83,7 @@
 	sk->sk_error_report(sk);
 
 	tcp_done(sk);
-	NET_INC_STATS_BH(TCPAbortOnTimeout);
+	NET_INC_STATS_BH(LINUX_MIB_TCPABORTONTIMEOUT);
 }
 
 /* Do not allow orphaned sockets to eat all our resources.
@@ -126,7 +126,7 @@
 		if (do_reset)
 			tcp_send_active_reset(sk, GFP_ATOMIC);
 		tcp_done(sk);
-		NET_INC_STATS_BH(TCPAbortOnMemory);
+		NET_INC_STATS_BH(LINUX_MIB_TCPABORTONMEMORY);
 		return 1;
 	}
 	return 0;
@@ -212,7 +212,7 @@
 	if (sock_owned_by_user(sk)) {
 		/* Try again later. */
 		tp->ack.blocked = 1;
-		NET_INC_STATS_BH(DelayedACKLocked);
+		NET_INC_STATS_BH(LINUX_MIB_DELAYEDACKLOCKED);
 		sk_reset_timer(sk, &tp->delack_timer, jiffies + TCP_DELACK_MIN);
 		goto out_unlock;
 	}
@@ -231,8 +231,8 @@
 	if (skb_queue_len(&tp->ucopy.prequeue)) {
 		struct sk_buff *skb;
 
-		NET_ADD_STATS_BH(TCPSchedulerFailed,
-				  skb_queue_len(&tp->ucopy.prequeue));
+		NET_ADD_STATS_BH(LINUX_MIB_TCPSCHEDULERFAILED, 
+				 skb_queue_len(&tp->ucopy.prequeue));
 
 		while ((skb = __skb_dequeue(&tp->ucopy.prequeue)) != NULL)
 			sk->sk_backlog_rcv(sk, skb);
@@ -252,7 +252,7 @@
 			tp->ack.ato = TCP_ATO_MIN;
 		}
 		tcp_send_ack(sk);
-		NET_INC_STATS_BH(DelayedACKs);
+		NET_INC_STATS_BH(LINUX_MIB_DELAYEDACKS);
 	}
 	TCP_CHECK_TIMER(sk);
 
@@ -353,19 +353,19 @@
 		if (tp->ca_state == TCP_CA_Disorder || tp->ca_state == TCP_CA_Recovery) {
 			if (tp->sack_ok) {
 				if (tp->ca_state == TCP_CA_Recovery)
-					NET_INC_STATS_BH(TCPSackRecoveryFail);
+					NET_INC_STATS_BH(LINUX_MIB_TCPSACKRECOVERYFAIL);
 				else
-					NET_INC_STATS_BH(TCPSackFailures);
+					NET_INC_STATS_BH(LINUX_MIB_TCPSACKFAILURES);
 			} else {
 				if (tp->ca_state == TCP_CA_Recovery)
-					NET_INC_STATS_BH(TCPRenoRecoveryFail);
+					NET_INC_STATS_BH(LINUX_MIB_TCPRENORECOVERYFAIL);
 				else
-					NET_INC_STATS_BH(TCPRenoFailures);
+					NET_INC_STATS_BH(LINUX_MIB_TCPRENOFAILURES);
 			}
 		} else if (tp->ca_state == TCP_CA_Loss) {
-			NET_INC_STATS_BH(TCPLossFailures);
+			NET_INC_STATS_BH(LINUX_MIB_TCPLOSSFAILURES);
 		} else {
-			NET_INC_STATS_BH(TCPTimeouts);
+			NET_INC_STATS_BH(LINUX_MIB_TCPTIMEOUTS);
 		}
 	}
 
diff -urN linux-2.6.8-rc2/net/ipv4/udp.c linux-2.6.8-rc3/net/ipv4/udp.c
--- linux-2.6.8-rc2/net/ipv4/udp.c	2004-08-03 15:21:17.003917493 -0700
+++ linux-2.6.8-rc3/net/ipv4/udp.c	2004-08-03 15:22:18.414436708 -0700
@@ -327,7 +327,7 @@
 
 	sk = udp_v4_lookup(iph->daddr, uh->dest, iph->saddr, uh->source, skb->dev->ifindex);
 	if (sk == NULL) {
-		ICMP_INC_STATS_BH(IcmpInErrors);
+		ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
     	  	return;	/* No socket for error */
 	}
 
@@ -654,7 +654,7 @@
 	if (free)
 		kfree(ipc.opt);
 	if (!err) {
-		UDP_INC_STATS_USER(UdpOutDatagrams);
+		UDP_INC_STATS_USER(UDP_MIB_OUTDATAGRAMS);
 		return len;
 	}
 	return err;
@@ -828,7 +828,10 @@
   	}
 	if (inet->cmsg_flags)
 		ip_cmsg_recv(msg, skb);
+
 	err = copied;
+	if (flags & MSG_TRUNC)
+		err = skb->len - sizeof(struct udphdr);
   
 out_free:
   	skb_free_datagram(sk, skb);
@@ -836,7 +839,7 @@
   	return err;
 
 csum_copy_err:
-	UDP_INC_STATS_BH(UdpInErrors);
+	UDP_INC_STATS_BH(UDP_MIB_INERRORS);
 
 	/* Clear queue. */
 	if (flags&MSG_PEEK) {
@@ -858,54 +861,6 @@
 	goto try_again;
 }
 
-int udp_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
-{
-	struct inet_opt *inet = inet_sk(sk);
-	struct sockaddr_in *usin = (struct sockaddr_in *) uaddr;
-	struct rtable *rt;
-	u32 saddr;
-	int oif;
-	int err;
-
-	
-	if (addr_len < sizeof(*usin)) 
-	  	return -EINVAL;
-
-	if (usin->sin_family != AF_INET) 
-	  	return -EAFNOSUPPORT;
-
-	sk_dst_reset(sk);
-
-	oif = sk->sk_bound_dev_if;
-	saddr = inet->saddr;
-	if (MULTICAST(usin->sin_addr.s_addr)) {
-		if (!oif)
-			oif = inet->mc_index;
-		if (!saddr)
-			saddr = inet->mc_addr;
-	}
-	err = ip_route_connect(&rt, usin->sin_addr.s_addr, saddr,
-			       RT_CONN_FLAGS(sk), oif,
-			       IPPROTO_UDP,
-			       inet->sport, usin->sin_port, sk);
-	if (err)
-		return err;
-	if ((rt->rt_flags & RTCF_BROADCAST) && !sock_flag(sk, SOCK_BROADCAST)) {
-		ip_rt_put(rt);
-		return -EACCES;
-	}
-  	if (!inet->saddr)
-	  	inet->saddr = rt->rt_src;	/* Update source address */
-	if (!inet->rcv_saddr)
-		inet->rcv_saddr = rt->rt_src;
-	inet->daddr = rt->rt_dst;
-	inet->dport = usin->sin_port;
-	sk->sk_state = TCP_ESTABLISHED;
-	inet->id = jiffies;
-
-	sk_dst_set(sk, &rt->u.dst);
-	return(0);
-}
 
 int udp_disconnect(struct sock *sk, int flags)
 {
@@ -975,7 +930,7 @@
 		} else
 			/* Must be an IKE packet.. pass it through */
 			return 1;
-
+		break;
 	case UDP_ENCAP_ESPINUDP_NON_IKE:
 		/* Check if this is a keepalive packet.  If so, eat it. */
 		if (len == 1 && udpdata[0] == 0xff) {
@@ -988,6 +943,7 @@
 		} else
 			/* Must be an IKE packet.. pass it through */
 			return 1;
+		break;
 	}
 
 	/* At this point we are sure that this is an ESPinUDP packet,
@@ -1060,7 +1016,7 @@
 		if (ret < 0) {
 			/* process the ESP packet */
 			ret = xfrm4_rcv_encap(skb, up->encap_type);
-			UDP_INC_STATS_BH(UdpInDatagrams);
+			UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS);
 			return -ret;
 		}
 		/* FALLTHROUGH -- it's a UDP Packet */
@@ -1068,7 +1024,7 @@
 
 	if (sk->sk_filter && skb->ip_summed != CHECKSUM_UNNECESSARY) {
 		if (__udp_checksum_complete(skb)) {
-			UDP_INC_STATS_BH(UdpInErrors);
+			UDP_INC_STATS_BH(UDP_MIB_INERRORS);
 			kfree_skb(skb);
 			return -1;
 		}
@@ -1076,11 +1032,11 @@
 	}
 
 	if (sock_queue_rcv_skb(sk,skb)<0) {
-		UDP_INC_STATS_BH(UdpInErrors);
+		UDP_INC_STATS_BH(UDP_MIB_INERRORS);
 		kfree_skb(skb);
 		return -1;
 	}
-	UDP_INC_STATS_BH(UdpInDatagrams);
+	UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS);
 	return 0;
 }
 
@@ -1208,7 +1164,7 @@
 	if (udp_checksum_complete(skb))
 		goto csum_error;
 
-	UDP_INC_STATS_BH(UdpNoPorts);
+	UDP_INC_STATS_BH(UDP_MIB_NOPORTS);
 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
 
 	/*
@@ -1228,7 +1184,7 @@
 			NIPQUAD(daddr),
 			ntohs(uh->dest)));
 no_header:
-	UDP_INC_STATS_BH(UdpInErrors);
+	UDP_INC_STATS_BH(UDP_MIB_INERRORS);
 	kfree_skb(skb);
 	return(0);
 
@@ -1245,7 +1201,7 @@
 			ntohs(uh->dest),
 			ulen));
 drop:
-	UDP_INC_STATS_BH(UdpInErrors);
+	UDP_INC_STATS_BH(UDP_MIB_INERRORS);
 	kfree_skb(skb);
 	return(0);
 }
@@ -1351,7 +1307,7 @@
 struct proto udp_prot = {
  	.name =		"UDP",
 	.close =	udp_close,
-	.connect =	udp_connect,
+	.connect =	ip4_datagram_connect,
 	.disconnect =	udp_disconnect,
 	.ioctl =	udp_ioctl,
 	.destroy =	udp_destroy_sock,
@@ -1552,7 +1508,6 @@
 }
 #endif /* CONFIG_PROC_FS */
 
-EXPORT_SYMBOL(udp_connect);
 EXPORT_SYMBOL(udp_disconnect);
 EXPORT_SYMBOL(udp_hash);
 EXPORT_SYMBOL(udp_hash_lock);
diff -urN linux-2.6.8-rc2/net/ipv4/xfrm4_output.c linux-2.6.8-rc3/net/ipv4/xfrm4_output.c
--- linux-2.6.8-rc2/net/ipv4/xfrm4_output.c	2004-08-03 15:21:17.004917534 -0700
+++ linux-2.6.8-rc3/net/ipv4/xfrm4_output.c	2004-08-03 15:22:18.415436749 -0700
@@ -13,6 +13,7 @@
 #include <net/inet_ecn.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
+#include <net/icmp.h>
 
 /* Add encapsulation header.
  *
@@ -67,6 +68,30 @@
 	memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
 }
 
+static int xfrm4_tunnel_check_size(struct sk_buff *skb)
+{
+	int mtu, ret = 0;
+	struct dst_entry *dst;
+	struct iphdr *iph = skb->nh.iph;
+
+	if (IPCB(skb)->flags & IPSKB_XFRM_TUNNEL_SIZE)
+		goto out;
+
+	IPCB(skb)->flags |= IPSKB_XFRM_TUNNEL_SIZE;
+	
+	if (!(iph->frag_off & htons(IP_DF)))
+		goto out;
+
+	dst = skb->dst;
+	mtu = dst_pmtu(dst) - dst->header_len - dst->trailer_len;
+	if (skb->len > mtu) {
+		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
+		ret = -EMSGSIZE;
+	}
+out:
+	return ret;
+}
+
 int xfrm4_output(struct sk_buff **pskb)
 {
 	struct sk_buff *skb = *pskb;
diff -urN linux-2.6.8-rc2/net/ipv4/xfrm4_state.c linux-2.6.8-rc3/net/ipv4/xfrm4_state.c
--- linux-2.6.8-rc2/net/ipv4/xfrm4_state.c	2004-08-03 15:21:17.005917575 -0700
+++ linux-2.6.8-rc3/net/ipv4/xfrm4_state.c	2004-08-03 15:22:18.416436790 -0700
@@ -74,11 +74,8 @@
 		    proto == x->id.proto &&
 		    saddr->a4 == x->props.saddr.a4 &&
 		    reqid == x->props.reqid &&
-		    x->km.state == XFRM_STATE_ACQ) {
-			    if (!x0)
-				    x0 = x;
-			    if (x->id.spi)
-				    continue;
+		    x->km.state == XFRM_STATE_ACQ &&
+		    !x->id.spi) {
 			    x0 = x;
 			    break;
 		    }
diff -urN linux-2.6.8-rc2/net/ipv4/xfrm4_tunnel.c linux-2.6.8-rc3/net/ipv4/xfrm4_tunnel.c
--- linux-2.6.8-rc2/net/ipv4/xfrm4_tunnel.c	2004-08-03 15:21:17.006917616 -0700
+++ linux-2.6.8-rc3/net/ipv4/xfrm4_tunnel.c	2004-08-03 15:22:18.416436790 -0700
@@ -6,32 +6,7 @@
 #include <linux/skbuff.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
-#include <net/icmp.h>
-#include <net/inet_ecn.h>
-
-int xfrm4_tunnel_check_size(struct sk_buff *skb)
-{
-	int mtu, ret = 0;
-	struct dst_entry *dst;
-	struct iphdr *iph = skb->nh.iph;
-
-	if (IPCB(skb)->flags & IPSKB_XFRM_TUNNEL_SIZE)
-		goto out;
-
-	IPCB(skb)->flags |= IPSKB_XFRM_TUNNEL_SIZE;
-	
-	if (!(iph->frag_off & htons(IP_DF)))
-		goto out;
-
-	dst = skb->dst;
-	mtu = dst_pmtu(dst) - dst->header_len - dst->trailer_len;
-	if (skb->len > mtu) {
-		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
-		ret = -EMSGSIZE;
-	}
-out:
-	return ret;
-}
+#include <net/protocol.h>
 
 static int ipip_output(struct sk_buff **pskb)
 {
diff -urN linux-2.6.8-rc2/net/ipv6/Kconfig linux-2.6.8-rc3/net/ipv6/Kconfig
--- linux-2.6.8-rc2/net/ipv6/Kconfig	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv6/Kconfig	2004-08-03 15:22:18.417436831 -0700
@@ -4,8 +4,6 @@
 config IPV6_PRIVACY
 	bool "IPv6: Privacy Extensions (RFC 3041) support"
 	depends on IPV6
-	select CRYPTO
-	select CRYPTO_MD5
 	---help---
 	  Privacy Extensions for Stateless Address Autoconfiguration in IPv6
 	  support.  With this option, additional periodically-alter 
diff -urN linux-2.6.8-rc2/net/ipv6/Makefile linux-2.6.8-rc3/net/ipv6/Makefile
--- linux-2.6.8-rc2/net/ipv6/Makefile	2004-08-03 15:21:17.006917616 -0700
+++ linux-2.6.8-rc3/net/ipv6/Makefile	2004-08-03 15:22:18.429437323 -0700
@@ -11,7 +11,7 @@
 		ip6_flowlabel.o ipv6_syms.o
 
 ipv6-$(CONFIG_XFRM) += xfrm6_policy.o xfrm6_state.o xfrm6_input.o \
-	xfrm6_tunnel.o
+	xfrm6_tunnel.o xfrm6_output.o
 ipv6-objs += $(ipv6-y)
 
 obj-$(CONFIG_INET6_AH) += ah6.o
diff -urN linux-2.6.8-rc2/net/ipv6/addrconf.c linux-2.6.8-rc3/net/ipv6/addrconf.c
--- linux-2.6.8-rc2/net/ipv6/addrconf.c	2004-08-03 15:21:17.029918559 -0700
+++ linux-2.6.8-rc3/net/ipv6/addrconf.c	2004-08-03 15:22:18.460438595 -0700
@@ -1544,7 +1544,7 @@
 		p.iph.ihl = 5;
 		p.iph.protocol = IPPROTO_IPV6;
 		p.iph.ttl = 64;
-		ifr.ifr_ifru.ifru_data = (void*)&p;
+		ifr.ifr_ifru.ifru_data = (void __user *)&p;
 
 		oldfs = get_fs(); set_fs(KERNEL_DS);
 		err = dev->do_ioctl(dev, &ifr, SIOCADDTUNNEL);
diff -urN linux-2.6.8-rc2/net/ipv6/af_inet6.c linux-2.6.8-rc3/net/ipv6/af_inet6.c
--- linux-2.6.8-rc2/net/ipv6/af_inet6.c	2004-08-03 15:21:17.088920980 -0700
+++ linux-2.6.8-rc3/net/ipv6/af_inet6.c	2004-08-03 15:22:18.462438677 -0700
@@ -560,8 +560,6 @@
 	.flags		= INET_PROTOSW_REUSE,
 };
 
-#define INETSW6_ARRAY_LEN (sizeof(inetsw6_array) / sizeof(struct inet_protosw))
-
 void
 inet6_register_protosw(struct inet_protosw *p)
 {
diff -urN linux-2.6.8-rc2/net/ipv6/ah6.c linux-2.6.8-rc3/net/ipv6/ah6.c
--- linux-2.6.8-rc2/net/ipv6/ah6.c	2004-08-03 15:21:17.104921636 -0700
+++ linux-2.6.8-rc3/net/ipv6/ah6.c	2004-08-03 15:22:18.491439867 -0700
@@ -26,11 +26,11 @@
 
 #include <linux/config.h>
 #include <linux/module.h>
-#include <net/inet_ecn.h>
 #include <net/ip.h>
 #include <net/ah.h>
 #include <linux/crypto.h>
 #include <linux/pfkeyv2.h>
+#include <linux/string.h>
 #include <net/icmp.h>
 #include <net/ipv6.h>
 #include <net/xfrm.h>
@@ -74,141 +74,138 @@
 	return 0;
 }
 
-static int ipv6_clear_mutable_options(struct sk_buff *skb, u16 *nh_offset, int dir)
+/**
+ *	ipv6_rearrange_rthdr - rearrange IPv6 routing header
+ *	@iph: IPv6 header
+ *	@rthdr: routing header
+ *
+ *	Rearrange the destination address in @iph and the addresses in @rthdr
+ *	so that they appear in the order they will at the final destination.
+ *	See Appendix A2 of RFC 2402 for details.
+ */
+static void ipv6_rearrange_rthdr(struct ipv6hdr *iph, struct ipv6_rt_hdr *rthdr)
 {
-	u16 offset = sizeof(struct ipv6hdr);
-	struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
-	unsigned int packet_len = skb->tail - skb->nh.raw;
-	u8 nexthdr = skb->nh.ipv6h->nexthdr;
-	u8 nextnexthdr = 0;
+	int segments, segments_left;
+	struct in6_addr *addrs;
+	struct in6_addr final_addr;
 
-	*nh_offset = ((unsigned char *)&skb->nh.ipv6h->nexthdr) - skb->nh.raw;
+	segments_left = rthdr->segments_left;
+	if (segments_left == 0)
+		return;
+	rthdr->segments_left = 0; 
 
-	while (offset + 1 <= packet_len) {
+	/* The value of rthdr->hdrlen has been verified either by the system
+	 * call if it is locally generated, or by ipv6_rthdr_rcv() for incoming
+	 * packets.  So we can assume that it is even and that segments is
+	 * greater than or equal to segments_left.
+	 *
+	 * For the same reason we can assume that this option is of type 0.
+	 */
+	segments = rthdr->hdrlen >> 1;
 
-		switch (nexthdr) {
+	addrs = ((struct rt0_hdr *)rthdr)->addr;
+	ipv6_addr_copy(&final_addr, addrs + segments - 1);
+
+	addrs += segments - segments_left;
+	memmove(addrs + 1, addrs, (segments_left - 1) * sizeof(*addrs));
+
+	ipv6_addr_copy(addrs, &iph->daddr);
+	ipv6_addr_copy(&iph->daddr, &final_addr);
+}
+
+static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len)
+{
+	union {
+		struct ipv6hdr *iph;
+		struct ipv6_opt_hdr *opth;
+		struct ipv6_rt_hdr *rth;
+		char *raw;
+	} exthdr = { .iph = iph };
+	char *end = exthdr.raw + len;
+	int nexthdr = iph->nexthdr;
+
+	exthdr.iph++;
 
+	while (exthdr.raw < end) {
+		switch (nexthdr) {
 		case NEXTHDR_HOP:
-			*nh_offset = offset;
-			offset += ipv6_optlen(exthdr);
-			if (!zero_out_mutable_opts(exthdr)) {
-				LIMIT_NETDEBUG(
-				printk(KERN_WARNING "overrun hopopts\n")); 
-				return 0;
+		case NEXTHDR_DEST:
+			if (!zero_out_mutable_opts(exthdr.opth)) {
+				LIMIT_NETDEBUG(printk(
+					KERN_WARNING "overrun %sopts\n",
+					nexthdr == NEXTHDR_HOP ?
+						"hop" : "dest"));
+				return -EINVAL;
 			}
-			nexthdr = exthdr->nexthdr;
-			exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
 			break;
 
 		case NEXTHDR_ROUTING:
-			*nh_offset = offset;
-			offset += ipv6_optlen(exthdr);
-			((struct ipv6_rt_hdr*)exthdr)->segments_left = 0; 
-			nexthdr = exthdr->nexthdr;
-			exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+			ipv6_rearrange_rthdr(iph, exthdr.rth);
 			break;
 
-		case NEXTHDR_DEST:
-			*nh_offset = offset;
-			offset += ipv6_optlen(exthdr);
-			if (!zero_out_mutable_opts(exthdr))  {
-				LIMIT_NETDEBUG(
-					printk(KERN_WARNING "overrun destopt\n")); 
-				return 0;
-			}
-			nexthdr = exthdr->nexthdr;
-			exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
-			break;
-
-		case NEXTHDR_AUTH:
-			if (dir == XFRM_POLICY_OUT) {
-				memset(((struct ipv6_auth_hdr*)exthdr)->auth_data, 0, 
-				       (((struct ipv6_auth_hdr*)exthdr)->hdrlen - 1) << 2);
-			}
-			if (exthdr->nexthdr == NEXTHDR_DEST) {
-				offset += (((struct ipv6_auth_hdr*)exthdr)->hdrlen + 2) << 2;
-				exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
-				nextnexthdr = exthdr->nexthdr;
-				if (!zero_out_mutable_opts(exthdr)) {
-					LIMIT_NETDEBUG(
-						printk(KERN_WARNING "overrun destopt\n"));
-					return 0;
-				}
-			}
-			return nexthdr;
 		default :
-			return nexthdr;
+			return 0;
 		}
+
+		nexthdr = exthdr.opth->nexthdr;
+		exthdr.raw += ipv6_optlen(exthdr.opth);
 	}
 
-	return nexthdr;
+	return 0;
 }
 
 int ah6_output(struct sk_buff **pskb)
 {
 	int err;
-	int hdr_len = sizeof(struct ipv6hdr);
+	int extlen;
 	struct dst_entry *dst = (*pskb)->dst;
 	struct xfrm_state *x  = dst->xfrm;
-	struct ipv6hdr *iph = NULL;
+	struct ipv6hdr *top_iph;
 	struct ip_auth_hdr *ah;
 	struct ah_data *ahp;
-	u16 nh_offset = 0;
 	u8 nexthdr;
+	char tmp_base[8];
+	struct {
+		struct in6_addr daddr;
+		char hdrs[0];
+	} *tmp_ext;
 
-	if ((*pskb)->ip_summed == CHECKSUM_HW) {
-		err = skb_checksum_help(pskb, 0);
-		if (err)
-			goto error_nolock;
-	}
+	top_iph = (struct ipv6hdr *)(*pskb)->data;
+	top_iph->payload_len = htons((*pskb)->len - sizeof(*top_iph));
 
-	spin_lock_bh(&x->lock);
-	err = xfrm_state_check(x, *pskb);
-	if (err)
-		goto error;
+	nexthdr = *(*pskb)->nh.raw;
+	*(*pskb)->nh.raw = IPPROTO_AH;
 
-	if (x->props.mode) {
-		err = xfrm6_tunnel_check_size(*pskb);
-		if (err)
-			goto error;
+	/* When there are no extension headers, we only need to save the first
+	 * 8 bytes of the base IP header.
+	 */
+	memcpy(tmp_base, top_iph, sizeof(tmp_base));
 
-		iph = (*pskb)->nh.ipv6h;
-		(*pskb)->nh.ipv6h = (struct ipv6hdr*)skb_push(*pskb, x->props.header_len);
-		(*pskb)->nh.ipv6h->version = 6;
-		(*pskb)->nh.ipv6h->payload_len = htons((*pskb)->len - sizeof(struct ipv6hdr));
-		(*pskb)->nh.ipv6h->nexthdr = IPPROTO_AH;
-		ipv6_addr_copy(&(*pskb)->nh.ipv6h->saddr,
-			       (struct in6_addr *) &x->props.saddr);
-		ipv6_addr_copy(&(*pskb)->nh.ipv6h->daddr,
-			       (struct in6_addr *) &x->id.daddr);
-		ah = (struct ip_auth_hdr*)((*pskb)->nh.ipv6h+1);
-		ah->nexthdr = IPPROTO_IPV6;
-	} else {
-		hdr_len = (*pskb)->h.raw - (*pskb)->nh.raw;
-		iph = kmalloc(hdr_len, GFP_ATOMIC);
-		if (!iph) {
+	tmp_ext = NULL;
+	extlen = (*pskb)->h.raw - (unsigned char *)(top_iph + 1);
+	if (extlen) {
+		extlen += sizeof(*tmp_ext);
+		tmp_ext = kmalloc(extlen, GFP_ATOMIC);
+		if (!tmp_ext) {
 			err = -ENOMEM;
 			goto error;
 		}
-		memcpy(iph, (*pskb)->data, hdr_len);
-		(*pskb)->nh.ipv6h = (struct ipv6hdr*)skb_push(*pskb, x->props.header_len);
-		memcpy((*pskb)->nh.ipv6h, iph, hdr_len);
-		nexthdr = ipv6_clear_mutable_options(*pskb, &nh_offset, XFRM_POLICY_OUT);
-		if (nexthdr == 0)
+		memcpy(tmp_ext, &top_iph->daddr, extlen);
+		err = ipv6_clear_mutable_options(top_iph,
+						 extlen - sizeof(*tmp_ext) +
+						 sizeof(*top_iph));
+		if (err)
 			goto error_free_iph;
-
-		(*pskb)->nh.raw[nh_offset] = IPPROTO_AH;
-		(*pskb)->nh.ipv6h->payload_len = htons((*pskb)->len - sizeof(struct ipv6hdr));
-		ah = (struct ip_auth_hdr*)((*pskb)->nh.raw+hdr_len);
-		(*pskb)->h.raw = (unsigned char*) ah;
-		ah->nexthdr = nexthdr;
 	}
 
-	(*pskb)->nh.ipv6h->priority    = 0;
-	(*pskb)->nh.ipv6h->flow_lbl[0] = 0;
-	(*pskb)->nh.ipv6h->flow_lbl[1] = 0;
-	(*pskb)->nh.ipv6h->flow_lbl[2] = 0;
-	(*pskb)->nh.ipv6h->hop_limit    = 0;
+	ah = (struct ip_auth_hdr *)(*pskb)->h.raw;
+	ah->nexthdr = nexthdr;
+
+	top_iph->priority    = 0;
+	top_iph->flow_lbl[0] = 0;
+	top_iph->flow_lbl[1] = 0;
+	top_iph->flow_lbl[2] = 0;
+	top_iph->hop_limit   = 0;
 
 	ahp = x->data;
 	ah->hdrlen  = (XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + 
@@ -219,37 +216,16 @@
 	ah->seq_no = htonl(++x->replay.oseq);
 	ahp->icv(ahp, *pskb, ah->auth_data);
 
-	if (x->props.mode) {
-		(*pskb)->nh.ipv6h->hop_limit   = iph->hop_limit;
-		(*pskb)->nh.ipv6h->priority    = iph->priority; 	
-		(*pskb)->nh.ipv6h->flow_lbl[0] = iph->flow_lbl[0];
-		(*pskb)->nh.ipv6h->flow_lbl[1] = iph->flow_lbl[1];
-		(*pskb)->nh.ipv6h->flow_lbl[2] = iph->flow_lbl[2];
-		if (x->props.flags & XFRM_STATE_NOECN)
-			IP6_ECN_clear((*pskb)->nh.ipv6h);
-	} else {
-		memcpy((*pskb)->nh.ipv6h, iph, hdr_len);
-		(*pskb)->nh.raw[nh_offset] = IPPROTO_AH;
-		(*pskb)->nh.ipv6h->payload_len = htons((*pskb)->len - sizeof(struct ipv6hdr));
-		kfree (iph);
-	}
-
-	(*pskb)->nh.raw = (*pskb)->data;
-
-	x->curlft.bytes += (*pskb)->len;
-	x->curlft.packets++;
-	spin_unlock_bh(&x->lock);
-	if (((*pskb)->dst = dst_pop(dst)) == NULL) {
-		err = -EHOSTUNREACH;
-		goto error_nolock;
-	}
-	return NET_XMIT_BYPASS;
+	err = 0;
+
+	memcpy(top_iph, tmp_base, sizeof(tmp_base));
+	if (tmp_ext) {
+		memcpy(&top_iph->daddr, tmp_ext, extlen);
 error_free_iph:
-	kfree(iph);
+		kfree(tmp_ext);
+	}
+
 error:
-	spin_unlock_bh(&x->lock);
-error_nolock:
-	kfree_skb(*pskb);
 	return err;
 }
 
@@ -259,7 +235,6 @@
 	 * Before process AH
 	 * [IPv6][Ext1][Ext2][AH][Dest][Payload]
 	 * |<-------------->| hdr_len
-	 * |<------------------------>| cleared_hlen
 	 *
 	 * To erase AH:
 	 * Keeping copy of cleared headers. After AH processing,
@@ -276,10 +251,7 @@
 	unsigned char *tmp_hdr = NULL;
 	u16 hdr_len;
 	u16 ah_hlen;
-	u16 cleared_hlen;
-	u16 nh_offset = 0;
-	u8 nexthdr = 0;
-	u8 *prevhdr;
+	int nexthdr;
 
 	if (!pskb_may_pull(skb, sizeof(struct ip_auth_hdr)))
 		goto out;
@@ -291,17 +263,10 @@
 		goto out;
 
 	hdr_len = skb->data - skb->nh.raw;
-	cleared_hlen = hdr_len;
 	ah = (struct ipv6_auth_hdr*)skb->data;
 	ahp = x->data;
 	nexthdr = ah->nexthdr;
 	ah_hlen = (ah->hdrlen + 2) << 2;
-	cleared_hlen += ah_hlen;
-
-	if (nexthdr == NEXTHDR_DEST) {
-		struct ipv6_opt_hdr *dsthdr = (struct ipv6_opt_hdr*)(skb->data + ah_hlen);
-		cleared_hlen += ipv6_optlen(dsthdr);
-	}
 
         if (ah_hlen != XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_full_len) &&
             ah_hlen != XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_trunc_len))
@@ -310,11 +275,12 @@
 	if (!pskb_may_pull(skb, ah_hlen))
 		goto out;
 
-	tmp_hdr = kmalloc(cleared_hlen, GFP_ATOMIC);
+	tmp_hdr = kmalloc(hdr_len, GFP_ATOMIC);
 	if (!tmp_hdr)
 		goto out;
-	memcpy(tmp_hdr, skb->nh.raw, cleared_hlen);
-	ipv6_clear_mutable_options(skb, &nh_offset, XFRM_POLICY_IN);
+	memcpy(tmp_hdr, skb->nh.raw, hdr_len);
+	if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len))
+		goto out;
 	skb->nh.ipv6h->priority    = 0;
 	skb->nh.ipv6h->flow_lbl[0] = 0;
 	skb->nh.ipv6h->flow_lbl[1] = 0;
@@ -338,13 +304,6 @@
 
 	skb->nh.raw = skb_pull(skb, ah_hlen);
 	memcpy(skb->nh.raw, tmp_hdr, hdr_len);
-	if (nexthdr == NEXTHDR_DEST) {
-		memcpy(skb->nh.raw + hdr_len,
-		       tmp_hdr + hdr_len + ah_hlen,
-		       cleared_hlen - hdr_len - ah_hlen);
-	}
-	prevhdr = (u8*)(skb->nh.raw + nh_offset);
-	*prevhdr = nexthdr;
 	skb->nh.ipv6h->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
 	skb_pull(skb, hdr_len);
 	skb->h.raw = skb->data;
diff -urN linux-2.6.8-rc2/net/ipv6/datagram.c linux-2.6.8-rc3/net/ipv6/datagram.c
--- linux-2.6.8-rc2/net/ipv6/datagram.c	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv6/datagram.c	2004-08-03 15:22:18.555442492 -0700
@@ -28,10 +28,166 @@
 #include <net/ndisc.h>
 #include <net/addrconf.h>
 #include <net/transp_v6.h>
+#include <net/ip6_route.h>
 
 #include <linux/errqueue.h>
 #include <asm/uaccess.h>
 
+int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+{
+	struct sockaddr_in6	*usin = (struct sockaddr_in6 *) uaddr;
+	struct inet_opt      	*inet = inet_sk(sk);
+	struct ipv6_pinfo      	*np = inet6_sk(sk);
+	struct in6_addr		*daddr;
+	struct dst_entry	*dst;
+	struct flowi		fl;
+	struct ip6_flowlabel	*flowlabel = NULL;
+	int			addr_type;
+	int			err;
+
+	if (usin->sin6_family == AF_INET) {
+		if (__ipv6_only_sock(sk))
+			return -EAFNOSUPPORT;
+		err = ip4_datagram_connect(sk, uaddr, addr_len);
+		goto ipv4_connected;
+	}
+
+	if (addr_len < SIN6_LEN_RFC2133)
+	  	return -EINVAL;
+
+	if (usin->sin6_family != AF_INET6) 
+	  	return -EAFNOSUPPORT;
+
+	memset(&fl, 0, sizeof(fl));
+	if (np->sndflow) {
+		fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
+		if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
+			flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
+			if (flowlabel == NULL)
+				return -EINVAL;
+			ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
+		}
+	}
+
+	addr_type = ipv6_addr_type(&usin->sin6_addr);
+
+	if (addr_type == IPV6_ADDR_ANY) {
+		/*
+		 *	connect to self
+		 */
+		usin->sin6_addr.s6_addr[15] = 0x01;
+	}
+
+	daddr = &usin->sin6_addr;
+
+	if (addr_type == IPV6_ADDR_MAPPED) {
+		struct sockaddr_in sin;
+
+		if (__ipv6_only_sock(sk)) {
+			err = -ENETUNREACH;
+			goto out;
+		}
+		sin.sin_family = AF_INET;
+		sin.sin_addr.s_addr = daddr->s6_addr32[3];
+		sin.sin_port = usin->sin6_port;
+
+		err = ip4_datagram_connect(sk, 
+					   (struct sockaddr*) &sin, 
+					   sizeof(sin));
+
+ipv4_connected:
+		if (err)
+			goto out;
+		
+		ipv6_addr_set(&np->daddr, 0, 0, htonl(0x0000ffff), inet->daddr);
+
+		if (ipv6_addr_any(&np->saddr)) {
+			ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000ffff),
+				      inet->saddr);
+		}
+
+		if (ipv6_addr_any(&np->rcv_saddr)) {
+			ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000ffff),
+				      inet->rcv_saddr);
+		}
+		goto out;
+	}
+
+	if (addr_type&IPV6_ADDR_LINKLOCAL) {
+		if (addr_len >= sizeof(struct sockaddr_in6) &&
+		    usin->sin6_scope_id) {
+			if (sk->sk_bound_dev_if &&
+			    sk->sk_bound_dev_if != usin->sin6_scope_id) {
+				err = -EINVAL;
+				goto out;
+			}
+			sk->sk_bound_dev_if = usin->sin6_scope_id;
+			if (!sk->sk_bound_dev_if &&
+			    (addr_type & IPV6_ADDR_MULTICAST))
+				fl.oif = np->mcast_oif;
+		}
+
+		/* Connect to link-local address requires an interface */
+		if (!sk->sk_bound_dev_if) {
+			err = -EINVAL;
+			goto out;
+		}
+	}
+
+	ipv6_addr_copy(&np->daddr, daddr);
+	np->flow_label = fl.fl6_flowlabel;
+
+	inet->dport = usin->sin6_port;
+
+	/*
+	 *	Check for a route to destination an obtain the
+	 *	destination cache for it.
+	 */
+
+	fl.proto = sk->sk_protocol;
+	ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
+	ipv6_addr_copy(&fl.fl6_src, &np->saddr);
+	fl.oif = sk->sk_bound_dev_if;
+	fl.fl_ip_dport = inet->dport;
+	fl.fl_ip_sport = inet->sport;
+
+	if (!fl.oif && (addr_type&IPV6_ADDR_MULTICAST))
+		fl.oif = np->mcast_oif;
+
+	if (flowlabel) {
+		if (flowlabel->opt && flowlabel->opt->srcrt) {
+			struct rt0_hdr *rt0 = (struct rt0_hdr *) flowlabel->opt->srcrt;
+			ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
+		}
+	} else if (np->opt && np->opt->srcrt) {
+		struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
+		ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
+	}
+
+	err = ip6_dst_lookup(sk, &dst, &fl);
+	if (err)
+		goto out;
+
+	/* source address lookup done in ip6_dst_lookup */
+
+	if (ipv6_addr_any(&np->saddr))
+		ipv6_addr_copy(&np->saddr, &fl.fl6_src);
+
+	if (ipv6_addr_any(&np->rcv_saddr)) {
+		ipv6_addr_copy(&np->rcv_saddr, &fl.fl6_src);
+		inet->rcv_saddr = LOOPBACK4_IPV6;
+	}
+
+	ip6_dst_store(sk, dst,
+		      !ipv6_addr_cmp(&fl.fl6_dst, &np->daddr) ?
+		      &np->daddr : NULL);
+
+	sk->sk_state = TCP_ESTABLISHED;
+out:
+	fl6_sock_release(flowlabel);
+	return err;
+}
+
 void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, 
 		     u16 port, u32 info, u8 *payload)
 {
diff -urN linux-2.6.8-rc2/net/ipv6/esp6.c linux-2.6.8-rc3/net/ipv6/esp6.c
--- linux-2.6.8-rc2/net/ipv6/esp6.c	2004-08-03 15:21:17.106921718 -0700
+++ linux-2.6.8-rc3/net/ipv6/esp6.c	2004-08-03 15:22:18.575443313 -0700
@@ -26,7 +26,6 @@
 
 #include <linux/config.h>
 #include <linux/module.h>
-#include <net/inet_ecn.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/esp.h>
@@ -41,10 +40,10 @@
 int esp6_output(struct sk_buff **pskb)
 {
 	int err;
-	int hdr_len = 0;
+	int hdr_len;
 	struct dst_entry *dst = (*pskb)->dst;
 	struct xfrm_state *x  = dst->xfrm;
-	struct ipv6hdr *iph = NULL, *top_iph;
+	struct ipv6hdr *top_iph;
 	struct ipv6_esp_hdr *esph;
 	struct crypto_tfm *tfm;
 	struct esp_data *esp;
@@ -53,37 +52,13 @@
 	int clen;
 	int alen;
 	int nfrags;
-	u8 *prevhdr;
-	u8 nexthdr = 0;
 
-	if ((*pskb)->ip_summed == CHECKSUM_HW) {
-		err = skb_checksum_help(pskb, 0);
-		if (err)
-			goto error_nolock;
-	}
+	esp = x->data;
+	hdr_len = (*pskb)->h.raw - (*pskb)->data +
+		  sizeof(*esph) + esp->conf.ivlen;
 
-	spin_lock_bh(&x->lock);
-	err = xfrm_state_check(x, *pskb);
-	if (err)
-		goto error;
-
-	if (x->props.mode) {
-		err = xfrm6_tunnel_check_size(*pskb);
-		if (err)
-			goto error;
-	} else {
-		/* Strip IP header in transport mode. Save it. */
-		hdr_len = ip6_find_1stfragopt(*pskb, &prevhdr);
-		nexthdr = *prevhdr;
-		*prevhdr = IPPROTO_ESP;
-		iph = kmalloc(hdr_len, GFP_ATOMIC);
-		if (!iph) {
-			err = -ENOMEM;
-			goto error;
-		}
-		memcpy(iph, (*pskb)->nh.raw, hdr_len);
-		__skb_pull(*pskb, hdr_len);
-	}
+	/* Strip IP+ESP header. */
+	__skb_pull(*pskb, hdr_len);
 
 	/* Now skb is pure payload to encrypt */
 	err = -ENOMEM;
@@ -91,7 +66,6 @@
 	/* Round to block size */
 	clen = (*pskb)->len;
 
-	esp = x->data;
 	alen = esp->auth.icv_trunc_len;
 	tfm = esp->conf.tfm;
 	blksize = (crypto_tfm_alg_blocksize(tfm) + 3) & ~3;
@@ -100,7 +74,6 @@
 		clen = (clen + esp->conf.padlen-1)&~(esp->conf.padlen-1);
 
 	if ((nfrags = skb_cow_data(*pskb, clen-(*pskb)->len+alen, &trailer)) < 0) {
-		if (!x->props.mode && iph) kfree(iph);
 		goto error;
 	}
 
@@ -113,34 +86,11 @@
 	*(u8*)(trailer->tail + clen-(*pskb)->len - 2) = (clen - (*pskb)->len)-2;
 	pskb_put(*pskb, trailer, clen - (*pskb)->len);
 
-	if (x->props.mode) {
-		iph = (*pskb)->nh.ipv6h;
-		top_iph = (struct ipv6hdr*)skb_push(*pskb, x->props.header_len);
-		esph = (struct ipv6_esp_hdr*)(top_iph+1);
-		*(u8*)(trailer->tail - 1) = IPPROTO_IPV6;
-		top_iph->version = 6;
-		top_iph->priority = iph->priority;
-		top_iph->flow_lbl[0] = iph->flow_lbl[0];
-		top_iph->flow_lbl[1] = iph->flow_lbl[1];
-		top_iph->flow_lbl[2] = iph->flow_lbl[2];
-		if (x->props.flags & XFRM_STATE_NOECN)
-			IP6_ECN_clear(top_iph);
-		top_iph->nexthdr = IPPROTO_ESP;
-		top_iph->payload_len = htons((*pskb)->len + alen - sizeof(struct ipv6hdr));
-		top_iph->hop_limit = iph->hop_limit;
-		ipv6_addr_copy(&top_iph->saddr,
-			       (struct in6_addr *)&x->props.saddr);
-		ipv6_addr_copy(&top_iph->daddr,
-			       (struct in6_addr *)&x->id.daddr);
-	} else { 
-		esph = (struct ipv6_esp_hdr*)skb_push(*pskb, x->props.header_len);
-		(*pskb)->h.raw = (unsigned char*)esph;
-		top_iph = (struct ipv6hdr*)skb_push(*pskb, hdr_len);
-		memcpy(top_iph, iph, hdr_len);
-		kfree(iph);
-		top_iph->payload_len = htons((*pskb)->len + alen - sizeof(struct ipv6hdr));
-		*(u8*)(trailer->tail - 1) = nexthdr;
-	}
+	top_iph = (struct ipv6hdr *)__skb_push(*pskb, hdr_len);
+	esph = (struct ipv6_esp_hdr *)(*pskb)->h.raw;
+	top_iph->payload_len = htons((*pskb)->len + alen - sizeof(*top_iph));
+	*(u8*)(trailer->tail - 1) = *(*pskb)->nh.raw;
+	*(*pskb)->nh.raw = IPPROTO_ESP;
 
 	esph->spi = x->id.spi;
 	esph->seq_no = htonl(++x->replay.oseq);
@@ -173,21 +123,9 @@
 		pskb_put(*pskb, trailer, alen);
 	}
 
-	(*pskb)->nh.raw = (*pskb)->data;
-
-	x->curlft.bytes += (*pskb)->len;
-	x->curlft.packets++;
-	spin_unlock_bh(&x->lock);
-	if (((*pskb)->dst = dst_pop(dst)) == NULL) {
-		err = -EHOSTUNREACH;
-		goto error_nolock;
-	}
-	return NET_XMIT_BYPASS;
+	err = 0;
 
 error:
-	spin_unlock_bh(&x->lock);
-error_nolock:
-	kfree_skb(*pskb);
 	return err;
 }
 
@@ -258,7 +196,6 @@
 		u8 nexthdr[2];
 		struct scatterlist *sg = &esp->sgbuf[0];
 		u8 padlen;
-		u8 *prevhdr;
 
 		if (unlikely(nfrags > ESP_NUM_FAST_SG)) {
 			sg = kmalloc(sizeof(struct scatterlist)*nfrags, GFP_ATOMIC);
@@ -289,8 +226,7 @@
 		skb->nh.raw += sizeof(struct ipv6_esp_hdr) + esp->conf.ivlen;
 		memcpy(skb->nh.raw, tmp_hdr, hdr_len);
 		skb->nh.ipv6h->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
-		ip6_find_1stfragopt(skb, &prevhdr);
-		ret = *prevhdr = nexthdr[1];
+		ret = nexthdr[1];
 	}
 
 out:
diff -urN linux-2.6.8-rc2/net/ipv6/exthdrs.c linux-2.6.8-rc3/net/ipv6/exthdrs.c
--- linux-2.6.8-rc2/net/ipv6/exthdrs.c	2004-06-15 22:18:56.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv6/exthdrs.c	2004-08-03 15:22:18.576443354 -0700
@@ -159,7 +159,7 @@
 
 	if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+8) ||
 	    !pskb_may_pull(skb, (skb->h.raw-skb->data)+((skb->h.raw[1]+1)<<3))) {
-		IP6_INC_STATS_BH(InHdrErrors);
+		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 		kfree_skb(skb);
 		return -1;
 	}
@@ -172,7 +172,7 @@
 		return 1;
 	}
 
-	IP6_INC_STATS_BH(InHdrErrors);
+	IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 	return -1;
 }
 
@@ -227,7 +227,7 @@
 
 	if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+8) ||
 	    !pskb_may_pull(skb, (skb->h.raw-skb->data)+((skb->h.raw[1]+1)<<3))) {
-		IP6_INC_STATS_BH(InHdrErrors);
+		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 		kfree_skb(skb);
 		return -1;
 	}
@@ -236,7 +236,7 @@
 
 	if (ipv6_addr_is_multicast(&skb->nh.ipv6h->daddr) ||
 	    skb->pkt_type != PACKET_HOST) {
-		IP6_INC_STATS_BH(InAddrErrors);
+		IP6_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
 		kfree_skb(skb);
 		return -1;
 	}
@@ -252,13 +252,13 @@
 	}
 
 	if (hdr->type != IPV6_SRCRT_TYPE_0) {
-		IP6_INC_STATS_BH(InHdrErrors);
+		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->type) - skb->nh.raw);
 		return -1;
 	}
 	
 	if (hdr->hdrlen & 0x01) {
-		IP6_INC_STATS_BH(InHdrErrors);
+		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->hdrlen) - skb->nh.raw);
 		return -1;
 	}
@@ -271,7 +271,7 @@
 	n = hdr->hdrlen >> 1;
 
 	if (hdr->segments_left > n) {
-		IP6_INC_STATS_BH(InHdrErrors);
+		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->segments_left) - skb->nh.raw);
 		return -1;
 	}
@@ -284,7 +284,7 @@
 		kfree_skb(skb);
 		/* the copy is a forwarded packet */
 		if (skb2 == NULL) {
-			IP6_INC_STATS_BH(OutDiscards);	
+			IP6_INC_STATS_BH(IPSTATS_MIB_OUTDISCARDS);	
 			return -1;
 		}
 		*skbp = skb = skb2;
@@ -302,7 +302,7 @@
 	addr += i - 1;
 
 	if (ipv6_addr_is_multicast(addr)) {
-		IP6_INC_STATS_BH(InAddrErrors);
+		IP6_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
 		kfree_skb(skb);
 		return -1;
 	}
@@ -319,7 +319,7 @@
 	}
 	if (skb->dst->dev->flags&IFF_LOOPBACK) {
 		if (skb->nh.ipv6h->hop_limit <= 1) {
-			IP6_INC_STATS_BH(InHdrErrors);
+			IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 			icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
 				    0, skb->dev);
 			kfree_skb(skb);
@@ -436,24 +436,24 @@
 	if (skb->nh.raw[optoff+1] != 4 || (optoff&3) != 2) {
 		LIMIT_NETDEBUG(
 			 printk(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n", skb->nh.raw[optoff+1]));
-		IP6_INC_STATS_BH(InHdrErrors);
+		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 		goto drop;
 	}
 
 	pkt_len = ntohl(*(u32*)(skb->nh.raw+optoff+2));
 	if (pkt_len <= IPV6_MAXPLEN) {
-		IP6_INC_STATS_BH(InHdrErrors);
+		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
 		return 0;
 	}
 	if (skb->nh.ipv6h->payload_len) {
-		IP6_INC_STATS_BH(InHdrErrors);
+		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
 		return 0;
 	}
 
 	if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
-		IP6_INC_STATS_BH(InTruncatedPkts);
+		IP6_INC_STATS_BH(IPSTATS_MIB_INTRUNCATEDPKTS);
 		goto drop;
 	}
 	if (pkt_len + sizeof(struct ipv6hdr) < skb->len) {
diff -urN linux-2.6.8-rc2/net/ipv6/icmp.c linux-2.6.8-rc3/net/ipv6/icmp.c
--- linux-2.6.8-rc2/net/ipv6/icmp.c	2004-08-03 15:21:17.117922170 -0700
+++ linux-2.6.8-rc3/net/ipv6/icmp.c	2004-08-03 15:22:18.577443395 -0700
@@ -174,7 +174,7 @@
 	 */
 	dst = ip6_route_output(sk, fl);
 	if (dst->error) {
-		IP6_INC_STATS(OutNoRoutes);
+		IP6_INC_STATS(IPSTATS_MIB_OUTNOROUTES);
 	} else if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) {
 		res = 1;
 	} else {
@@ -404,8 +404,8 @@
 	err = icmpv6_push_pending_frames(sk, &fl, &tmp_hdr, len + sizeof(struct icmp6hdr));
 
 	if (type >= ICMPV6_DEST_UNREACH && type <= ICMPV6_PARAMPROB)
-		ICMP6_INC_STATS_OFFSET_BH(idev, Icmp6OutDestUnreachs, type - ICMPV6_DEST_UNREACH);
-	ICMP6_INC_STATS_BH(idev, Icmp6OutMsgs);
+		ICMP6_INC_STATS_OFFSET_BH(idev, ICMP6_MIB_OUTDESTUNREACHS, type - ICMPV6_DEST_UNREACH);
+	ICMP6_INC_STATS_BH(idev, ICMP6_MIB_OUTMSGS);
 
 out_put:
 	if (likely(idev != NULL))
@@ -480,8 +480,8 @@
 	}
 	err = icmpv6_push_pending_frames(sk, &fl, &tmp_hdr, skb->len + sizeof(struct icmp6hdr));
 
-        ICMP6_INC_STATS_BH(idev, Icmp6OutEchoReplies);
-        ICMP6_INC_STATS_BH(idev, Icmp6OutMsgs);
+        ICMP6_INC_STATS_BH(idev, ICMP6_MIB_OUTECHOREPLIES);
+        ICMP6_INC_STATS_BH(idev, ICMP6_MIB_OUTMSGS);
 
 out_put: 
 	if (likely(idev != NULL))
@@ -560,7 +560,7 @@
 	struct icmp6hdr *hdr;
 	int type;
 
-	ICMP6_INC_STATS_BH(idev, Icmp6InMsgs);
+	ICMP6_INC_STATS_BH(idev, ICMP6_MIB_INMSGS);
 
 	saddr = &skb->nh.ipv6h->saddr;
 	daddr = &skb->nh.ipv6h->daddr;
@@ -593,9 +593,9 @@
 	type = hdr->icmp6_type;
 
 	if (type >= ICMPV6_DEST_UNREACH && type <= ICMPV6_PARAMPROB)
-		ICMP6_INC_STATS_OFFSET_BH(idev, Icmp6InDestUnreachs, type - ICMPV6_DEST_UNREACH);
+		ICMP6_INC_STATS_OFFSET_BH(idev, ICMP6_MIB_INDESTUNREACHS, type - ICMPV6_DEST_UNREACH);
 	else if (type >= ICMPV6_ECHO_REQUEST && type <= NDISC_REDIRECT)
-		ICMP6_INC_STATS_OFFSET_BH(idev, Icmp6InEchos, type - ICMPV6_ECHO_REQUEST);
+		ICMP6_INC_STATS_OFFSET_BH(idev, ICMP6_MIB_INECHOS, type - ICMPV6_ECHO_REQUEST);
 
 	switch (type) {
 	case ICMPV6_ECHO_REQUEST:
@@ -646,7 +646,13 @@
 		break;
 
 	case ICMPV6_MGM_REDUCTION:
+	case ICMPV6_NI_QUERY:
+	case ICMPV6_NI_REPLY:
 	case ICMPV6_MLD2_REPORT:
+	case ICMPV6_DHAAD_REQUEST:
+	case ICMPV6_DHAAD_REPLY:
+	case ICMPV6_MOBILE_PREFIX_SOL:
+	case ICMPV6_MOBILE_PREFIX_ADV:
 		break;
 
 	default:
@@ -668,7 +674,7 @@
 	return 0;
 
 discard_it:
-	ICMP6_INC_STATS_BH(idev, Icmp6InErrors);
+	ICMP6_INC_STATS_BH(idev, ICMP6_MIB_INERRORS);
 	kfree_skb(skb);
 	return 0;
 }
diff -urN linux-2.6.8-rc2/net/ipv6/ip6_fib.c linux-2.6.8-rc3/net/ipv6/ip6_fib.c
--- linux-2.6.8-rc2/net/ipv6/ip6_fib.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv6/ip6_fib.c	2004-08-03 15:22:18.578443436 -0700
@@ -94,7 +94,7 @@
 
 static struct timer_list ip6_fib_timer = TIMER_INITIALIZER(fib6_run_gc, 0, 0);
 
-static struct fib6_walker_t fib6_walker_list = {
+struct fib6_walker_t fib6_walker_list = {
 	.prev	= &fib6_walker_list,
 	.next	= &fib6_walker_list, 
 };
diff -urN linux-2.6.8-rc2/net/ipv6/ip6_flowlabel.c linux-2.6.8-rc3/net/ipv6/ip6_flowlabel.c
--- linux-2.6.8-rc2/net/ipv6/ip6_flowlabel.c	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv6/ip6_flowlabel.c	2004-08-03 15:22:18.579443477 -0700
@@ -645,8 +645,8 @@
 static int ip6fl_seq_show(struct seq_file *seq, void *v)
 {
 	if (v == SEQ_START_TOKEN)
-		seq_printf(seq, "Label S Owner  Users  Linger Expires  "
-				"Dst                              Opt\n");
+		seq_puts(seq, "Label S Owner  Users  Linger Expires  "
+			      "Dst                              Opt\n");
 	else
 		ip6fl_fl_seq_show(seq, v);
 	return 0;
diff -urN linux-2.6.8-rc2/net/ipv6/ip6_input.c linux-2.6.8-rc3/net/ipv6/ip6_input.c
--- linux-2.6.8-rc2/net/ipv6/ip6_input.c	2004-06-15 22:19:43.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv6/ip6_input.c	2004-08-03 15:22:18.579443477 -0700
@@ -64,10 +64,10 @@
 	if (skb->pkt_type == PACKET_OTHERHOST)
 		goto drop;
 
-	IP6_INC_STATS_BH(InReceives);
+	IP6_INC_STATS_BH(IPSTATS_MIB_INRECEIVES);
 
 	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) {
-		IP6_INC_STATS_BH(InDiscards);
+		IP6_INC_STATS_BH(IPSTATS_MIB_INDISCARDS);
 		goto out;
 	}
 
@@ -80,7 +80,7 @@
 		goto err;
 
 	if (!pskb_may_pull(skb, sizeof(struct ipv6hdr))) {
-		IP6_INC_STATS_BH(InHdrErrors);
+		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 		goto drop;
 	}
 
@@ -97,7 +97,7 @@
 			goto truncated;
 		if (pkt_len + sizeof(struct ipv6hdr) < skb->len) {
 			if (__pskb_trim(skb, pkt_len + sizeof(struct ipv6hdr))){
-				IP6_INC_STATS_BH(InHdrErrors);
+				IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 				goto drop;
 			}
 			hdr = skb->nh.ipv6h;
@@ -109,7 +109,7 @@
 	if (hdr->nexthdr == NEXTHDR_HOP) {
 		skb->h.raw = (u8*)(hdr+1);
 		if (ipv6_parse_hopopts(skb, offsetof(struct ipv6hdr, nexthdr)) < 0) {
-			IP6_INC_STATS_BH(InHdrErrors);
+			IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 			return 0;
 		}
 		hdr = skb->nh.ipv6h;
@@ -117,9 +117,9 @@
 
 	return NF_HOOK(PF_INET6,NF_IP6_PRE_ROUTING, skb, dev, NULL, ip6_rcv_finish);
 truncated:
-	IP6_INC_STATS_BH(InTruncatedPkts);
+	IP6_INC_STATS_BH(IPSTATS_MIB_INTRUNCATEDPKTS);
 err:
-	IP6_INC_STATS_BH(InHdrErrors);
+	IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 drop:
 	kfree_skb(skb);
 out:
@@ -194,15 +194,15 @@
 		if (ret > 0)
 			goto resubmit;
 		else if (ret == 0)
-			IP6_INC_STATS_BH(InDelivers);
+			IP6_INC_STATS_BH(IPSTATS_MIB_INDELIVERS);
 	} else {
 		if (!raw_sk) {
 			if (xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-				IP6_INC_STATS_BH(InUnknownProtos);
+				IP6_INC_STATS_BH(IPSTATS_MIB_INUNKNOWNPROTOS);
 				icmpv6_param_prob(skb, ICMPV6_UNK_NEXTHDR, nhoff);
 			}
 		} else {
-			IP6_INC_STATS_BH(InDelivers);
+			IP6_INC_STATS_BH(IPSTATS_MIB_INDELIVERS);
 			kfree_skb(skb);
 		}
 	}
@@ -210,7 +210,7 @@
 	return 0;
 
 discard:
-	IP6_INC_STATS_BH(InDiscards);
+	IP6_INC_STATS_BH(IPSTATS_MIB_INDISCARDS);
 	rcu_read_unlock();
 	kfree_skb(skb);
 	return 0;
@@ -227,7 +227,7 @@
 	struct ipv6hdr *hdr;
 	int deliver;
 
-	IP6_INC_STATS_BH(InMcastPkts);
+	IP6_INC_STATS_BH(IPSTATS_MIB_INMCASTPKTS);
 
 	hdr = skb->nh.ipv6h;
 	deliver = likely(!(skb->dev->flags & (IFF_PROMISC|IFF_ALLMULTI))) ||
diff -urN linux-2.6.8-rc2/net/ipv6/ip6_output.c linux-2.6.8-rc3/net/ipv6/ip6_output.c
--- linux-2.6.8-rc2/net/ipv6/ip6_output.c	2004-08-03 15:21:17.132922785 -0700
+++ linux-2.6.8-rc3/net/ipv6/ip6_output.c	2004-08-03 15:22:18.581443559 -0700
@@ -87,7 +87,7 @@
 	} else if (dst->neighbour)
 		return dst->neighbour->output(skb);
 
-	IP6_INC_STATS_BH(OutNoRoutes);
+	IP6_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
 	kfree_skb(skb);
 	return -EINVAL;
 
@@ -133,13 +133,13 @@
 					ip6_dev_loopback_xmit);
 
 			if (skb->nh.ipv6h->hop_limit == 0) {
-				IP6_INC_STATS(OutDiscards);
+				IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
 				kfree_skb(skb);
 				return 0;
 			}
 		}
 
-		IP6_INC_STATS(OutMcastPkts);
+		IP6_INC_STATS(IPSTATS_MIB_OUTMCASTPKTS);
 	}
 
 	return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb,NULL, skb->dev,ip6_output_finish);
@@ -172,7 +172,7 @@
 	dst = ip6_route_output(skb->sk, &fl);
 
 	if (dst->error) {
-		IP6_INC_STATS(OutNoRoutes);
+		IP6_INC_STATS(IPSTATS_MIB_OUTNOROUTES);
 		LIMIT_NETDEBUG(
 			printk(KERN_DEBUG "ip6_route_me_harder: No more route.\n"));
 		dst_release(dst);
@@ -231,7 +231,7 @@
 			kfree_skb(skb);
 			skb = skb2;
 			if (skb == NULL) {	
-				IP6_INC_STATS(OutDiscards);
+				IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
 				return -ENOBUFS;
 			}
 			if (sk)
@@ -265,7 +265,7 @@
 
 	mtu = dst_pmtu(dst);
 	if ((skb->len <= mtu) || ipfragok) {
-		IP6_INC_STATS(OutRequests);
+		IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
 		return NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev, ip6_maybe_reroute);
 	}
 
@@ -273,7 +273,7 @@
 		printk(KERN_DEBUG "IPv6: sending pkt_too_big to self\n");
 	skb->dev = dst->dev;
 	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
-	IP6_INC_STATS(FragFails);
+	IP6_INC_STATS(IPSTATS_MIB_FRAGFAILS);
 	kfree_skb(skb);
 	return -EMSGSIZE;
 }
@@ -355,7 +355,7 @@
 		goto error;
 
 	if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
-		IP6_INC_STATS(InDiscards);
+		IP6_INC_STATS(IPSTATS_MIB_INDISCARDS);
 		goto drop;
 	}
 
@@ -394,7 +394,7 @@
 	}
 
 	if (!xfrm6_route_forward(skb)) {
-		IP6_INC_STATS(InDiscards);
+		IP6_INC_STATS(IPSTATS_MIB_INDISCARDS);
 		goto drop;
 	}
 
@@ -432,14 +432,14 @@
 		/* Again, force OUTPUT device used as source address */
 		skb->dev = dst->dev;
 		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, dst_pmtu(dst), skb->dev);
-		IP6_INC_STATS_BH(InTooBigErrors);
-		IP6_INC_STATS_BH(FragFails);
+		IP6_INC_STATS_BH(IPSTATS_MIB_INTOOBIGERRORS);
+		IP6_INC_STATS_BH(IPSTATS_MIB_FRAGFAILS);
 		kfree_skb(skb);
 		return -EMSGSIZE;
 	}
 
 	if (skb_cow(skb, dst->dev->hard_header_len)) {
-		IP6_INC_STATS(OutDiscards);
+		IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
 		goto drop;
 	}
 
@@ -449,11 +449,11 @@
  
 	hdr->hop_limit--;
 
-	IP6_INC_STATS_BH(OutForwDatagrams);
+	IP6_INC_STATS_BH(IPSTATS_MIB_OUTFORWDATAGRAMS);
 	return NF_HOOK(PF_INET6,NF_IP6_FORWARD, skb, skb->dev, dst->dev, ip6_forward_finish);
 
 error:
-	IP6_INC_STATS_BH(InAddrErrors);
+	IP6_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
 drop:
 	kfree_skb(skb);
 	return -EINVAL;
@@ -566,7 +566,7 @@
 
 		tmp_hdr = kmalloc(hlen, GFP_ATOMIC);
 		if (!tmp_hdr) {
-			IP6_INC_STATS(FragFails);
+			IP6_INC_STATS(IPSTATS_MIB_FRAGFAILS);
 			return -ENOMEM;
 		}
 
@@ -621,7 +621,7 @@
 			kfree(tmp_hdr);
 
 		if (err == 0) {
-			IP6_INC_STATS(FragOKs);
+			IP6_INC_STATS(IPSTATS_MIB_FRAGOKS);
 			return 0;
 		}
 
@@ -631,7 +631,7 @@
 			frag = skb;
 		}
 
-		IP6_INC_STATS(FragFails);
+		IP6_INC_STATS(IPSTATS_MIB_FRAGFAILS);
 		return err;
 	}
 
@@ -664,7 +664,7 @@
 
 		if ((frag = alloc_skb(len+hlen+sizeof(struct frag_hdr)+LL_RESERVED_SPACE(rt->u.dst.dev), GFP_ATOMIC)) == NULL) {
 			NETDEBUG(printk(KERN_INFO "IPv6: frag: no memory for new fragment!\n"));
-			IP6_INC_STATS(FragFails);
+			IP6_INC_STATS(IPSTATS_MIB_FRAGFAILS);
 			err = -ENOMEM;
 			goto fail;
 		}
@@ -722,19 +722,19 @@
 		 *	Put this fragment into the sending queue.
 		 */
 
-		IP6_INC_STATS(FragCreates);
+		IP6_INC_STATS(IPSTATS_MIB_FRAGCREATES);
 
 		err = output(&frag);
 		if (err)
 			goto fail;
 	}
 	kfree_skb(skb);
-	IP6_INC_STATS(FragOKs);
+	IP6_INC_STATS(IPSTATS_MIB_FRAGOKS);
 	return err;
 
 fail:
 	kfree_skb(skb); 
-	IP6_INC_STATS(FragFails);
+	IP6_INC_STATS(IPSTATS_MIB_FRAGFAILS);
 	return err;
 }
 
@@ -1019,7 +1019,7 @@
 	return 0;
 error:
 	inet->cork.length -= length;
-	IP6_INC_STATS(OutDiscards);
+	IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
 	return err;
 }
 
@@ -1079,7 +1079,7 @@
 	ipv6_addr_copy(&hdr->daddr, final_dst);
 
 	skb->dst = dst_clone(&rt->u.dst);
-	IP6_INC_STATS(OutRequests);	
+	IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);	
 	err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, skb->dst->dev, dst_output);
 	if (err) {
 		if (err > 0)
@@ -1111,7 +1111,7 @@
 	struct sk_buff *skb;
 
 	while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
-		IP6_INC_STATS(OutDiscards);
+		IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
 		kfree_skb(skb);
 	}
 
diff -urN linux-2.6.8-rc2/net/ipv6/ipcomp6.c linux-2.6.8-rc3/net/ipv6/ipcomp6.c
--- linux-2.6.8-rc2/net/ipv6/ipcomp6.c	2004-08-03 15:21:17.158923852 -0700
+++ linux-2.6.8-rc3/net/ipv6/ipcomp6.c	2004-08-03 15:22:18.628445487 -0700
@@ -32,7 +32,6 @@
  */
 #include <linux/config.h>
 #include <linux/module.h>
-#include <net/inet_ecn.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/ipcomp.h>
@@ -49,7 +48,6 @@
 {
 	int err = 0;
 	u8 nexthdr = 0;
-	u8 *prevhdr;
 	int hdr_len = skb->h.raw - skb->nh.raw;
 	unsigned char *tmp_hdr = NULL;
 	struct ipv6hdr *iph;
@@ -106,8 +104,6 @@
 	iph = skb->nh.ipv6h;
 	iph->payload_len = htons(skb->len);
 	
-	ip6_find_1stfragopt(skb, &prevhdr);
-	*prevhdr = nexthdr;
 out:
 	if (tmp_hdr)
 		kfree(tmp_hdr);
@@ -123,52 +119,14 @@
 	int err;
 	struct dst_entry *dst = (*pskb)->dst;
 	struct xfrm_state *x = dst->xfrm;
-	struct ipv6hdr *iph, *top_iph;
-	int hdr_len = 0;
+	struct ipv6hdr *top_iph;
+	int hdr_len;
 	struct ipv6_comp_hdr *ipch;
 	struct ipcomp_data *ipcd = x->data;
-	u8 *prevhdr;
-	u8 nexthdr = 0;
 	int plen, dlen;
 	u8 *start, *scratch = ipcd->scratch;
 
-	if ((*pskb)->ip_summed == CHECKSUM_HW) {
-		err = skb_checksum_help(pskb, 0);
-		if (err)
-			goto error_nolock;
-	}
-
-	spin_lock_bh(&x->lock);
-
-	err = xfrm_state_check(x, *pskb);
-	if (err)
-		goto error;
-
-	if (x->props.mode) {
-		err = xfrm6_tunnel_check_size(*pskb);
-		if (err)
-			goto error;
-
-		hdr_len = sizeof(struct ipv6hdr);
-		nexthdr = IPPROTO_IPV6;
-		iph = (*pskb)->nh.ipv6h;
-		top_iph = (struct ipv6hdr *)skb_push(*pskb, sizeof(struct ipv6hdr));
-		top_iph->version = 6;
-		top_iph->priority = iph->priority;
-		top_iph->flow_lbl[0] = iph->flow_lbl[0];
-		top_iph->flow_lbl[1] = iph->flow_lbl[1];
-		top_iph->flow_lbl[2] = iph->flow_lbl[2];
-		top_iph->nexthdr = IPPROTO_IPV6; /* initial */
-		top_iph->payload_len = htons((*pskb)->len - sizeof(struct ipv6hdr));
-		top_iph->hop_limit = iph->hop_limit;
-		memcpy(&top_iph->saddr, (struct in6_addr *)&x->props.saddr, sizeof(struct in6_addr));
-		memcpy(&top_iph->daddr, (struct in6_addr *)&x->id.daddr, sizeof(struct in6_addr));
-		(*pskb)->nh.raw = (*pskb)->data; /* == top_iph */
-		(*pskb)->h.raw = (*pskb)->nh.raw + hdr_len;
-	} else {
-		hdr_len = ip6_find_1stfragopt(*pskb, &prevhdr);
-		nexthdr = *prevhdr;
-	}
+	hdr_len = (*pskb)->h.raw - (*pskb)->data;
 
 	/* check whether datagram len is larger than threshold */
 	if (((*pskb)->len - hdr_len) < ipcd->threshold) {
@@ -184,7 +142,7 @@
 	/* compression */
 	plen = (*pskb)->len - hdr_len;
 	dlen = IPCOMP_SCRATCH_SIZE;
-	start = (*pskb)->data + hdr_len;
+	start = (*pskb)->h.raw;
 
 	err = crypto_comp_compress(ipcd->tfm, start, plen, scratch, &dlen);
 	if (err) {
@@ -197,39 +155,21 @@
 	pskb_trim(*pskb, hdr_len + dlen + sizeof(struct ip_comp_hdr));
 
 	/* insert ipcomp header and replace datagram */
-	top_iph = (*pskb)->nh.ipv6h;
+	top_iph = (struct ipv6hdr *)(*pskb)->data;
 
-	if (x->props.mode && (x->props.flags & XFRM_STATE_NOECN))
-		IP6_ECN_clear(top_iph);
 	top_iph->payload_len = htons((*pskb)->len - sizeof(struct ipv6hdr));
-	(*pskb)->nh.raw = (*pskb)->data; /* top_iph */
-	ip6_find_1stfragopt(*pskb, &prevhdr); 
-	*prevhdr = IPPROTO_COMP;
 
-	ipch = (struct ipv6_comp_hdr *)((unsigned char *)top_iph + hdr_len);
-	ipch->nexthdr = nexthdr;
+	ipch = (struct ipv6_comp_hdr *)start;
+	ipch->nexthdr = *(*pskb)->nh.raw;
 	ipch->flags = 0;
 	ipch->cpi = htons((u16 )ntohl(x->id.spi));
+	*(*pskb)->nh.raw = IPPROTO_COMP;
 
-	(*pskb)->h.raw = (unsigned char*)ipch;
 out_ok:
-	x->curlft.bytes += (*pskb)->len;
-	x->curlft.packets++;
-	spin_unlock_bh(&x->lock);
-
-	if (((*pskb)->dst = dst_pop(dst)) == NULL) {
-		err = -EHOSTUNREACH;
-		goto error_nolock;
-	}
-	err = NET_XMIT_BYPASS;
+	err = 0;
 
-out_exit:
-	return err;
 error:
-	spin_unlock_bh(&x->lock);
-error_nolock:
-	kfree_skb(*pskb);
-	goto out_exit;
+	return err;
 }
 
 static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
@@ -240,7 +180,7 @@
 	struct ipv6_comp_hdr *ipcomph = (struct ipv6_comp_hdr*)(skb->data+offset);
 	struct xfrm_state *x;
 
-	if (type != ICMPV6_DEST_UNREACH || type != ICMPV6_PKT_TOOBIG)
+	if (type != ICMPV6_DEST_UNREACH && type != ICMPV6_PKT_TOOBIG)
 		return;
 
 	spi = ntohl(ntohs(ipcomph->cpi));
diff -urN linux-2.6.8-rc2/net/ipv6/mcast.c linux-2.6.8-rc3/net/ipv6/mcast.c
--- linux-2.6.8-rc2/net/ipv6/mcast.c	2004-08-03 15:21:17.192925246 -0700
+++ linux-2.6.8-rc3/net/ipv6/mcast.c	2004-08-03 15:22:18.630445569 -0700
@@ -1317,7 +1317,7 @@
 	struct inet6_dev *idev = in6_dev_get(skb->dev);
 	int err;
 
-	IP6_INC_STATS(OutRequests);
+	IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
 	payload_len = skb->tail - (unsigned char *)skb->nh.ipv6h -
 		sizeof(struct ipv6hdr);
 	mldlen = skb->tail - skb->h.raw;
@@ -1328,10 +1328,10 @@
 	err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, skb->dev,
 		dev_queue_xmit);
 	if (!err) {
-		ICMP6_INC_STATS(idev,Icmp6OutMsgs);
-		IP6_INC_STATS(OutMcastPkts);
+		ICMP6_INC_STATS(idev,ICMP6_MIB_OUTMSGS);
+		IP6_INC_STATS(IPSTATS_MIB_OUTMCASTPKTS);
 	} else
-		IP6_INC_STATS(OutDiscards);
+		IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
 
 	if (likely(idev != NULL))
 		in6_dev_put(idev);
@@ -1613,7 +1613,7 @@
 		     IPV6_TLV_ROUTERALERT, 2, 0, 0,
 		     IPV6_TLV_PADN, 0 };
 
-	IP6_INC_STATS(OutRequests);
+	IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
 	snd_addr = addr;
 	if (type == ICMPV6_MGM_REDUCTION) {
 		snd_addr = &all_routers;
@@ -1627,7 +1627,7 @@
 	skb = sock_alloc_send_skb(sk, LL_RESERVED_SPACE(dev) + full_len, 1, &err);
 
 	if (skb == NULL) {
-		IP6_INC_STATS(OutDiscards);
+		IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
 		return;
 	}
 
@@ -1668,20 +1668,20 @@
 		dev_queue_xmit);
 	if (!err) {
 		if (type == ICMPV6_MGM_REDUCTION)
-			ICMP6_INC_STATS(idev, Icmp6OutGroupMembReductions);
+			ICMP6_INC_STATS(idev, ICMP6_MIB_OUTGROUPMEMBREDUCTIONS);
 		else
-			ICMP6_INC_STATS(idev, Icmp6OutGroupMembResponses);
-		ICMP6_INC_STATS(idev, Icmp6OutMsgs);
-		IP6_INC_STATS(OutMcastPkts);
+			ICMP6_INC_STATS(idev, ICMP6_MIB_OUTGROUPMEMBRESPONSES);
+		ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS);
+		IP6_INC_STATS(IPSTATS_MIB_OUTMCASTPKTS);
 	} else
-		IP6_INC_STATS(OutDiscards);
+		IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
 
 	if (likely(idev != NULL))
 		in6_dev_put(idev);
 	return;
 
 out:
-	IP6_INC_STATS(OutDiscards);
+	IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
 	kfree_skb(skb);
 }
 
diff -urN linux-2.6.8-rc2/net/ipv6/ndisc.c linux-2.6.8-rc3/net/ipv6/ndisc.c
--- linux-2.6.8-rc2/net/ipv6/ndisc.c	2004-08-03 15:21:17.194925328 -0700
+++ linux-2.6.8-rc3/net/ipv6/ndisc.c	2004-08-03 15:22:18.632445651 -0700
@@ -452,11 +452,11 @@
 
 	skb->dst = dst;
 	idev = in6_dev_get(dst->dev);
-	IP6_INC_STATS(OutRequests);
+	IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
 	err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev, dst_output);
 	if (!err) {
-		ICMP6_INC_STATS(idev, Icmp6OutNeighborAdvertisements);
-		ICMP6_INC_STATS(idev, Icmp6OutMsgs);
+		ICMP6_INC_STATS(idev, ICMP6_MIB_OUTNEIGHBORADVERTISEMENTS);
+		ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS);
 	}
 
 	if (likely(idev != NULL))
@@ -536,11 +536,11 @@
 	/* send it! */
 	skb->dst = dst;
 	idev = in6_dev_get(dst->dev);
-	IP6_INC_STATS(OutRequests);
+	IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
 	err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev, dst_output);
 	if (!err) {
-		ICMP6_INC_STATS(idev, Icmp6OutNeighborSolicits);
-		ICMP6_INC_STATS(idev, Icmp6OutMsgs);
+		ICMP6_INC_STATS(idev, ICMP6_MIB_OUTNEIGHBORSOLICITS);
+		ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS);
 	}
 
 	if (likely(idev != NULL))
@@ -609,11 +609,11 @@
 	/* send it! */
 	skb->dst = dst;
 	idev = in6_dev_get(dst->dev);
-	IP6_INC_STATS(OutRequests);	
+	IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);	
 	err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev, dst_output);
 	if (!err) {
-		ICMP6_INC_STATS(idev, Icmp6OutRouterSolicits);
-		ICMP6_INC_STATS(idev, Icmp6OutMsgs);
+		ICMP6_INC_STATS(idev, ICMP6_MIB_OUTROUTERSOLICITS);
+		ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS);
 	}
 
 	if (likely(idev != NULL))
@@ -1335,11 +1335,11 @@
 
 	buff->dst = dst;
 	idev = in6_dev_get(dst->dev);
-	IP6_INC_STATS(OutRequests);
+	IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
 	err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, buff, NULL, dst->dev, dst_output);
 	if (!err) {
-		ICMP6_INC_STATS(idev, Icmp6OutRedirects);
-		ICMP6_INC_STATS(idev, Icmp6OutMsgs);
+		ICMP6_INC_STATS(idev, ICMP6_MIB_OUTREDIRECTS);
+		ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS);
 	}
 
 	if (likely(idev != NULL))
diff -urN linux-2.6.8-rc2/net/ipv6/proc.c linux-2.6.8-rc3/net/ipv6/proc.c
--- linux-2.6.8-rc2/net/ipv6/proc.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv6/proc.c	2004-08-03 15:22:18.689447989 -0700
@@ -57,36 +57,34 @@
 	return 0;
 }
 
-static struct snmp_item snmp6_ipstats_list[] = {
+static struct snmp_mib snmp6_ipstats_list[] = {
 /* ipv6 mib according to RFC 2465 */
-#define SNMP6_GEN(x)	SNMP_ITEM(struct ipstats_mib, x, "Ip6" #x)
-	SNMP6_GEN(InReceives),
-	SNMP6_GEN(InHdrErrors),
-	SNMP6_GEN(InTooBigErrors),
-	SNMP6_GEN(InNoRoutes),
-	SNMP6_GEN(InAddrErrors),
-	SNMP6_GEN(InUnknownProtos),
-	SNMP6_GEN(InTruncatedPkts),
-	SNMP6_GEN(InDiscards),
-	SNMP6_GEN(InDelivers),
-	SNMP6_GEN(OutForwDatagrams),
-	SNMP6_GEN(OutRequests),
-	SNMP6_GEN(OutDiscards),
-	SNMP6_GEN(OutNoRoutes),
-	SNMP6_GEN(ReasmTimeout),
-	SNMP6_GEN(ReasmReqds),
-	SNMP6_GEN(ReasmOKs),
-	SNMP6_GEN(ReasmFails),
-	SNMP6_GEN(FragOKs),
-	SNMP6_GEN(FragFails),
-	SNMP6_GEN(FragCreates),
-	SNMP6_GEN(InMcastPkts),
-	SNMP6_GEN(OutMcastPkts),
-#undef SNMP6_GEN
-	SNMP_ITEM_SENTINEL
+	SNMP_MIB_ITEM("Ip6InReceives", IPSTATS_MIB_INRECEIVES),
+	SNMP_MIB_ITEM("Ip6InHdrErrors", IPSTATS_MIB_INHDRERRORS),
+	SNMP_MIB_ITEM("Ip6InTooBigErrors", IPSTATS_MIB_INTOOBIGERRORS),
+	SNMP_MIB_ITEM("Ip6InNoRoutes", IPSTATS_MIB_INNOROUTES),
+	SNMP_MIB_ITEM("Ip6InAddrErrors", IPSTATS_MIB_INADDRERRORS),
+	SNMP_MIB_ITEM("Ip6InUnknownProtos", IPSTATS_MIB_INUNKNOWNPROTOS),
+	SNMP_MIB_ITEM("Ip6InTruncatedPkts", IPSTATS_MIB_INTRUNCATEDPKTS),
+	SNMP_MIB_ITEM("Ip6InDiscards", IPSTATS_MIB_INDISCARDS),
+	SNMP_MIB_ITEM("Ip6InDelivers", IPSTATS_MIB_INDELIVERS),
+	SNMP_MIB_ITEM("Ip6OutForwDatagrams", IPSTATS_MIB_OUTFORWDATAGRAMS),
+	SNMP_MIB_ITEM("Ip6OutRequests", IPSTATS_MIB_OUTREQUESTS),
+	SNMP_MIB_ITEM("Ip6OutDiscards", IPSTATS_MIB_OUTDISCARDS),
+	SNMP_MIB_ITEM("Ip6OutNoRoutes", IPSTATS_MIB_OUTNOROUTES),
+	SNMP_MIB_ITEM("Ip6ReasmTimeout", IPSTATS_MIB_REASMTIMEOUT),
+	SNMP_MIB_ITEM("Ip6ReasmReqds", IPSTATS_MIB_REASMREQDS),
+	SNMP_MIB_ITEM("Ip6ReasmOKs", IPSTATS_MIB_REASMOKS),
+	SNMP_MIB_ITEM("Ip6ReasmFails", IPSTATS_MIB_REASMFAILS),
+	SNMP_MIB_ITEM("Ip6FragOKs", IPSTATS_MIB_FRAGOKS),
+	SNMP_MIB_ITEM("Ip6FragFails", IPSTATS_MIB_FRAGFAILS),
+	SNMP_MIB_ITEM("Ip6FragCreates", IPSTATS_MIB_FRAGCREATES),
+	SNMP_MIB_ITEM("Ip6InMcastPkts", IPSTATS_MIB_INMCASTPKTS),
+	SNMP_MIB_ITEM("Ip6OutMcastPkts", IPSTATS_MIB_OUTMCASTPKTS),
+	SNMP_MIB_SENTINEL
 };
 
-static struct snmp_item snmp6_icmp6_list[] = {
+static struct snmp_mib snmp6_icmp6_list[] = {
 /* icmpv6 mib according to RFC 2466
 
    Exceptions:  {In|Out}AdminProhibs are removed, because I see
@@ -97,47 +95,43 @@
 		OutRouterAdvertisements too.
 		OutGroupMembQueries too.
  */
-#define SNMP6_GEN(x)	SNMP_ITEM(struct icmpv6_mib, x, #x)
-	SNMP6_GEN(Icmp6InMsgs),
-	SNMP6_GEN(Icmp6InErrors),
-	SNMP6_GEN(Icmp6InDestUnreachs),
-	SNMP6_GEN(Icmp6InPktTooBigs),
-	SNMP6_GEN(Icmp6InTimeExcds),
-	SNMP6_GEN(Icmp6InParmProblems),
-	SNMP6_GEN(Icmp6InEchos),
-	SNMP6_GEN(Icmp6InEchoReplies),
-	SNMP6_GEN(Icmp6InGroupMembQueries),
-	SNMP6_GEN(Icmp6InGroupMembResponses),
-	SNMP6_GEN(Icmp6InGroupMembReductions),
-	SNMP6_GEN(Icmp6InRouterSolicits),
-	SNMP6_GEN(Icmp6InRouterAdvertisements),
-	SNMP6_GEN(Icmp6InNeighborSolicits),
-	SNMP6_GEN(Icmp6InNeighborAdvertisements),
-	SNMP6_GEN(Icmp6InRedirects),
-	SNMP6_GEN(Icmp6OutMsgs),
-	SNMP6_GEN(Icmp6OutDestUnreachs),
-	SNMP6_GEN(Icmp6OutPktTooBigs),
-	SNMP6_GEN(Icmp6OutTimeExcds),
-	SNMP6_GEN(Icmp6OutParmProblems),
-	SNMP6_GEN(Icmp6OutEchoReplies),
-	SNMP6_GEN(Icmp6OutRouterSolicits),
-	SNMP6_GEN(Icmp6OutNeighborSolicits),
-	SNMP6_GEN(Icmp6OutNeighborAdvertisements),
-	SNMP6_GEN(Icmp6OutRedirects),
-	SNMP6_GEN(Icmp6OutGroupMembResponses),
-	SNMP6_GEN(Icmp6OutGroupMembReductions),
-#undef SNMP6_GEN
-	SNMP_ITEM_SENTINEL
+	SNMP_MIB_ITEM("Icmp6InMsgs", ICMP6_MIB_INMSGS),
+	SNMP_MIB_ITEM("Icmp6InErrors", ICMP6_MIB_INERRORS),
+	SNMP_MIB_ITEM("Icmp6InDestUnreachs", ICMP6_MIB_INDESTUNREACHS),
+	SNMP_MIB_ITEM("Icmp6InPktTooBigs", ICMP6_MIB_INPKTTOOBIGS),
+	SNMP_MIB_ITEM("Icmp6InTimeExcds", ICMP6_MIB_INTIMEEXCDS),
+	SNMP_MIB_ITEM("Icmp6InParmProblems", ICMP6_MIB_INPARMPROBLEMS),
+	SNMP_MIB_ITEM("Icmp6InEchos", ICMP6_MIB_INECHOS),
+	SNMP_MIB_ITEM("Icmp6InEchoReplies", ICMP6_MIB_INECHOREPLIES),
+	SNMP_MIB_ITEM("Icmp6InGroupMembQueries", ICMP6_MIB_INGROUPMEMBQUERIES),
+	SNMP_MIB_ITEM("Icmp6InGroupMembResponses", ICMP6_MIB_INGROUPMEMBRESPONSES),
+	SNMP_MIB_ITEM("Icmp6InGroupMembReductions", ICMP6_MIB_INGROUPMEMBREDUCTIONS),
+	SNMP_MIB_ITEM("Icmp6InRouterSolicits", ICMP6_MIB_INROUTERSOLICITS),
+	SNMP_MIB_ITEM("Icmp6InRouterAdvertisements", ICMP6_MIB_INROUTERADVERTISEMENTS),
+	SNMP_MIB_ITEM("Icmp6InNeighborSolicits", ICMP6_MIB_INNEIGHBORSOLICITS),
+	SNMP_MIB_ITEM("Icmp6InNeighborAdvertisements", ICMP6_MIB_INNEIGHBORADVERTISEMENTS),
+	SNMP_MIB_ITEM("Icmp6InRedirects", ICMP6_MIB_INREDIRECTS),
+	SNMP_MIB_ITEM("Icmp6OutMsgs", ICMP6_MIB_OUTMSGS),
+	SNMP_MIB_ITEM("Icmp6OutDestUnreachs", ICMP6_MIB_OUTDESTUNREACHS),
+	SNMP_MIB_ITEM("Icmp6OutPktTooBigs", ICMP6_MIB_OUTPKTTOOBIGS),
+	SNMP_MIB_ITEM("Icmp6OutTimeExcds", ICMP6_MIB_OUTTIMEEXCDS),
+	SNMP_MIB_ITEM("Icmp6OutParmProblems", ICMP6_MIB_OUTPARMPROBLEMS),
+	SNMP_MIB_ITEM("Icmp6OutEchoReplies", ICMP6_MIB_OUTECHOREPLIES),
+	SNMP_MIB_ITEM("Icmp6OutRouterSolicits", ICMP6_MIB_OUTROUTERSOLICITS),
+	SNMP_MIB_ITEM("Icmp6OutNeighborSolicits", ICMP6_MIB_OUTNEIGHBORSOLICITS),
+	SNMP_MIB_ITEM("Icmp6OutNeighborAdvertisements", ICMP6_MIB_OUTNEIGHBORADVERTISEMENTS),
+	SNMP_MIB_ITEM("Icmp6OutRedirects", ICMP6_MIB_OUTREDIRECTS),
+	SNMP_MIB_ITEM("Icmp6OutGroupMembResponses", ICMP6_MIB_OUTGROUPMEMBRESPONSES),
+	SNMP_MIB_ITEM("Icmp6OutGroupMembReductions", ICMP6_MIB_OUTGROUPMEMBREDUCTIONS),
+	SNMP_MIB_SENTINEL
 };
 
-static struct snmp_item snmp6_udp6_list[] = {
-#define SNMP6_GEN(x)	SNMP_ITEM(struct udp_mib, Udp##x, "Udp6" #x)
-	SNMP6_GEN(InDatagrams),
-	SNMP6_GEN(NoPorts),
-	SNMP6_GEN(InErrors),
-	SNMP6_GEN(OutDatagrams),
-#undef SNMP6_GEN
-	SNMP_ITEM_SENTINEL
+static struct snmp_mib snmp6_udp6_list[] = {
+	SNMP_MIB_ITEM("Udp6InDatagrams", UDP_MIB_INDATAGRAMS),
+	SNMP_MIB_ITEM("Udp6NoPorts", UDP_MIB_NOPORTS),
+	SNMP_MIB_ITEM("Udp6InErrors", UDP_MIB_INERRORS),
+	SNMP_MIB_ITEM("Udp6OutDatagrams", UDP_MIB_OUTDATAGRAMS),
+	SNMP_MIB_SENTINEL
 };
 
 static unsigned long
@@ -149,23 +143,19 @@
         for (i = 0; i < NR_CPUS; i++) {
                 if (!cpu_possible(i))
                         continue;
-                res +=
-                    *((unsigned long *) (((void *)per_cpu_ptr(mib[0], i)) +
-                                         offt));
-                res +=
-                    *((unsigned long *) (((void *)per_cpu_ptr(mib[1], i)) +
-                                         offt));
+                res += *(((unsigned long *)per_cpu_ptr(mib[0], i)) + offt);
+                res += *(((unsigned long *)per_cpu_ptr(mib[1], i)) + offt);
         }
         return res;
 }
 
 static inline void
-snmp6_seq_show_item(struct seq_file *seq, void **mib, struct snmp_item *itemlist)
+snmp6_seq_show_item(struct seq_file *seq, void **mib, struct snmp_mib *itemlist)
 {
 	int i;
 	for (i=0; itemlist[i].name; i++)
 		seq_printf(seq, "%-32s\t%lu\n", itemlist[i].name, 
-				fold_field(mib, itemlist[i].offset));
+				fold_field(mib, itemlist[i].entry));
 }
 
 static int snmp6_seq_show(struct seq_file *seq, void *v)
diff -urN linux-2.6.8-rc2/net/ipv6/raw.c linux-2.6.8-rc3/net/ipv6/raw.c
--- linux-2.6.8-rc2/net/ipv6/raw.c	2004-08-03 15:21:17.224926559 -0700
+++ linux-2.6.8-rc3/net/ipv6/raw.c	2004-08-03 15:22:18.690448030 -0700
@@ -419,7 +419,10 @@
 
 	if (np->rxopt.all)
 		datagram_recv_ctl(sk, msg, skb);
+
 	err = copied;
+	if (flags & MSG_TRUNC)
+		err = skb->len;
 
 out_free:
 	skb_free_datagram(sk, skb);
@@ -535,7 +538,7 @@
 	if (err)
 		goto error_fault;
 
-	IP6_INC_STATS(OutRequests);		
+	IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);		
 	err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, rt->u.dst.dev,
 		      dst_output);
 	if (err > 0)
@@ -549,7 +552,7 @@
 	err = -EFAULT;
 	kfree_skb(skb);
 error:
-	IP6_INC_STATS(OutDiscards);
+	IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
 	return err; 
 }
 static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
@@ -916,7 +919,7 @@
 struct proto rawv6_prot = {
 	.name =		"RAW",
 	.close =	rawv6_close,
-	.connect =	udpv6_connect,
+	.connect =	ip6_datagram_connect,
 	.disconnect =	udp_disconnect,
 	.ioctl =	rawv6_ioctl,
 	.init =		rawv6_init_sk,
diff -urN linux-2.6.8-rc2/net/ipv6/reassembly.c linux-2.6.8-rc3/net/ipv6/reassembly.c
--- linux-2.6.8-rc2/net/ipv6/reassembly.c	2004-06-15 22:19:09.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv6/reassembly.c	2004-08-03 15:22:18.691448071 -0700
@@ -284,7 +284,7 @@
 		spin_unlock(&fq->lock);
 
 		fq_put(fq);
-		IP6_INC_STATS_BH(ReasmFails);
+		IP6_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
 	}
 }
 
@@ -299,8 +299,8 @@
 
 	fq_kill(fq);
 
-	IP6_INC_STATS_BH(ReasmTimeout);
-	IP6_INC_STATS_BH(ReasmFails);
+	IP6_INC_STATS_BH(IPSTATS_MIB_REASMTIMEOUT);
+	IP6_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
 
 	/* Send error only if the first segment arrived. */
 	if (fq->last_in&FIRST_IN && fq->fragments) {
@@ -386,7 +386,7 @@
 	return ip6_frag_intern(hash, fq);
 
 oom:
-	IP6_INC_STATS_BH(ReasmFails);
+	IP6_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
 	return NULL;
 }
 
@@ -426,7 +426,7 @@
 			((u8 *) (fhdr + 1) - (u8 *) (skb->nh.ipv6h + 1)));
 
 	if ((unsigned int)end > IPV6_MAXPLEN) {
-		IP6_INC_STATS_BH(InHdrErrors);
+		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
  		icmpv6_param_prob(skb,ICMPV6_HDR_FIELD, (u8*)&fhdr->frag_off - skb->nh.raw);
  		return;
 	}
@@ -453,7 +453,7 @@
 			/* RFC2460 says always send parameter problem in
 			 * this case. -DaveM
 			 */
-			IP6_INC_STATS_BH(InHdrErrors);
+			IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
 			icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, 
 					  offsetof(struct ipv6hdr, payload_len));
 			return;
@@ -572,7 +572,7 @@
 	return;
 
 err:
-	IP6_INC_STATS(ReasmFails);
+	IP6_INC_STATS(IPSTATS_MIB_REASMFAILS);
 	kfree_skb(skb);
 }
 
@@ -666,7 +666,7 @@
 	if (head->ip_summed == CHECKSUM_HW)
 		head->csum = csum_partial(head->nh.raw, head->h.raw-head->nh.raw, head->csum);
 
-	IP6_INC_STATS_BH(ReasmOKs);
+	IP6_INC_STATS_BH(IPSTATS_MIB_REASMOKS);
 	fq->fragments = NULL;
 	*nhoffp = nhoff;
 	return 1;
@@ -679,7 +679,7 @@
 	if (net_ratelimit())
 		printk(KERN_DEBUG "ip6_frag_reasm: no memory for reassembly\n");
 out_fail:
-	IP6_INC_STATS_BH(ReasmFails);
+	IP6_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
 	return -1;
 }
 
@@ -693,16 +693,16 @@
 
 	hdr = skb->nh.ipv6h;
 
-	IP6_INC_STATS_BH(ReasmReqds);
+	IP6_INC_STATS_BH(IPSTATS_MIB_REASMREQDS);
 
 	/* Jumbo payload inhibits frag. header */
 	if (hdr->payload_len==0) {
-		IP6_INC_STATS(InHdrErrors);
+		IP6_INC_STATS(IPSTATS_MIB_INHDRERRORS);
 		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, skb->h.raw-skb->nh.raw);
 		return -1;
 	}
 	if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+sizeof(struct frag_hdr))) {
-		IP6_INC_STATS(InHdrErrors);
+		IP6_INC_STATS(IPSTATS_MIB_INHDRERRORS);
 		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, skb->h.raw-skb->nh.raw);
 		return -1;
 	}
@@ -713,7 +713,7 @@
 	if (!(fhdr->frag_off & htons(0xFFF9))) {
 		/* It is not a fragmented frame */
 		skb->h.raw += sizeof(struct frag_hdr);
-		IP6_INC_STATS_BH(ReasmOKs);
+		IP6_INC_STATS_BH(IPSTATS_MIB_REASMOKS);
 
 		*nhoffp = (u8*)fhdr - skb->nh.raw;
 		return 1;
@@ -738,7 +738,7 @@
 		return ret;
 	}
 
-	IP6_INC_STATS_BH(ReasmFails);
+	IP6_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
 	kfree_skb(skb);
 	return -1;
 }
diff -urN linux-2.6.8-rc2/net/ipv6/route.c linux-2.6.8-rc3/net/ipv6/route.c
--- linux-2.6.8-rc2/net/ipv6/route.c	2004-08-03 15:21:17.227926682 -0700
+++ linux-2.6.8-rc3/net/ipv6/route.c	2004-08-03 15:22:18.693448153 -0700
@@ -584,7 +584,24 @@
 /* Protected by rt6_lock.  */
 static struct dst_entry *ndisc_dst_gc_list;
 static int ipv6_get_mtu(struct net_device *dev);
-static inline unsigned int ipv6_advmss(unsigned int mtu);
+
+static inline unsigned int ipv6_advmss(unsigned int mtu)
+{
+	mtu -= sizeof(struct ipv6hdr) + sizeof(struct tcphdr);
+
+	if (mtu < ip6_rt_min_advmss)
+		mtu = ip6_rt_min_advmss;
+
+	/*
+	 * Maximal non-jumbo IPv6 payload is IPV6_MAXPLEN and 
+	 * corresponding MSS is IPV6_MAXPLEN - tcp_header_size. 
+	 * IPV6_MAXPLEN is also valid and means: "any MSS, 
+	 * rely only on pmtu discovery"
+	 */
+	if (mtu > IPV6_MAXPLEN - sizeof(struct tcphdr))
+		mtu = IPV6_MAXPLEN;
+	return mtu;
+}
 
 struct dst_entry *ndisc_dst_alloc(struct net_device *dev, 
 				  struct neighbour *neigh,
@@ -692,24 +709,6 @@
 	return mtu;
 }
 
-static inline unsigned int ipv6_advmss(unsigned int mtu)
-{
-	mtu -= sizeof(struct ipv6hdr) + sizeof(struct tcphdr);
-
-	if (mtu < ip6_rt_min_advmss)
-		mtu = ip6_rt_min_advmss;
-
-	/*
-	 * Maximal non-jumbo IPv6 payload is IPV6_MAXPLEN and 
-	 * corresponding MSS is IPV6_MAXPLEN - tcp_header_size. 
-	 * IPV6_MAXPLEN is also valid and means: "any MSS, 
-	 * rely only on pmtu discovery"
-	 */
-	if (mtu > IPV6_MAXPLEN - sizeof(struct tcphdr))
-		mtu = IPV6_MAXPLEN;
-	return mtu;
-}
-
 static int ipv6_get_hoplimit(struct net_device *dev)
 {
 	int hoplimit = ipv6_devconf.hop_limit;
@@ -1292,7 +1291,7 @@
 
 int ip6_pkt_discard(struct sk_buff *skb)
 {
-	IP6_INC_STATS(OutNoRoutes);
+	IP6_INC_STATS(IPSTATS_MIB_OUTNOROUTES);
 	icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_NOROUTE, 0, skb->dev);
 	kfree_skb(skb);
 	return 0;
diff -urN linux-2.6.8-rc2/net/ipv6/tcp_ipv6.c linux-2.6.8-rc3/net/ipv6/tcp_ipv6.c
--- linux-2.6.8-rc2/net/ipv6/tcp_ipv6.c	2004-08-03 15:21:17.230926805 -0700
+++ linux-2.6.8-rc3/net/ipv6/tcp_ipv6.c	2004-08-03 15:22:18.718449179 -0700
@@ -55,6 +55,8 @@
 #include <net/inet_ecn.h>
 #include <net/protocol.h>
 #include <net/xfrm.h>
+#include <net/addrconf.h>
+#include <net/snmp.h>
 
 #include <asm/uaccess.h>
 
@@ -495,7 +497,7 @@
 		/* Silly. Should hash-dance instead... */
 		local_bh_disable();
 		tcp_tw_deschedule(tw);
-		NET_INC_STATS_BH(TimeWaitRecycled);
+		NET_INC_STATS_BH(LINUX_MIB_TIMEWAITRECYCLED);
 		local_bh_enable();
 
 		tcp_tw_put(tw);
@@ -734,7 +736,7 @@
 	sk = tcp_v6_lookup(&hdr->daddr, th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 
 	if (sk == NULL) {
-		ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), Icmp6InErrors);
+		ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
 		return;
 	}
 
@@ -745,7 +747,7 @@
 
 	bh_lock_sock(sk);
 	if (sock_owned_by_user(sk))
-		NET_INC_STATS_BH(LockDroppedIcmps);
+		NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
 
 	if (sk->sk_state == TCP_CLOSE)
 		goto out;
@@ -754,7 +756,7 @@
 	seq = ntohl(th->seq); 
 	if (sk->sk_state != TCP_LISTEN &&
 	    !between(seq, tp->snd_una, tp->snd_nxt)) {
-		NET_INC_STATS_BH(OutOfWindowIcmps);
+		NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 		goto out;
 	}
 
@@ -822,7 +824,7 @@
 		BUG_TRAP(req->sk == NULL);
 
 		if (seq != req->snt_isn) {
-			NET_INC_STATS_BH(OutOfWindowIcmps);
+			NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
 			goto out;
 		}
 
@@ -833,7 +835,7 @@
 	case TCP_SYN_RECV:  /* Cannot happen.
 			       It can, it SYNs are crossed. --ANK */ 
 		if (!sock_owned_by_user(sk)) {
-			TCP_INC_STATS_BH(TcpAttemptFails);
+			TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
 			sk->sk_err = err;
 			sk->sk_error_report(sk);		/* Wake people up to see the error (see connect in sock.c) */
 
@@ -1020,8 +1022,8 @@
 	/* sk = NULL, but it is safe for now. RST socket required. */
 	if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
 		ip6_xmit(NULL, buff, &fl, NULL, 0);
-		TCP_INC_STATS_BH(TcpOutSegs);
-		TCP_INC_STATS_BH(TcpOutRsts);
+		TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
+		TCP_INC_STATS_BH(TCP_MIB_OUTRSTS);
 		return;
 	}
 
@@ -1081,7 +1083,7 @@
 
 	if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
 		ip6_xmit(NULL, buff, &fl, NULL, 0);
-		TCP_INC_STATS_BH(TcpOutSegs);
+		TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
 		return;
 	}
 
@@ -1233,7 +1235,7 @@
 	if (req)
 		tcp_openreq_free(req);
 
-	TCP_INC_STATS_BH(TcpAttemptFails);
+	TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
 	return 0; /* don't send reset */
 }
 
@@ -1409,9 +1411,9 @@
 	return newsk;
 
 out_overflow:
-	NET_INC_STATS_BH(ListenOverflows);
+	NET_INC_STATS_BH(LINUX_MIB_LISTENOVERFLOWS);
 out:
-	NET_INC_STATS_BH(ListenDrops);
+	NET_INC_STATS_BH(LINUX_MIB_LISTENDROPS);
 	if (opt && opt != np->opt)
 		sock_kfree_s(sk, opt, opt->tot_len);
 	dst_release(dst);
@@ -1536,7 +1538,7 @@
 	kfree_skb(skb);
 	return 0;
 csum_err:
-	TCP_INC_STATS_BH(TcpInErrs);
+	TCP_INC_STATS_BH(TCP_MIB_INERRS);
 	goto discard;
 
 
@@ -1582,7 +1584,7 @@
 	/*
 	 *	Count it even if it's bad.
 	 */
-	TCP_INC_STATS_BH(TcpInSegs);
+	TCP_INC_STATS_BH(TCP_MIB_INSEGS);
 
 	if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
 		goto discard_it;
@@ -1643,7 +1645,7 @@
 
 	if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
 bad_packet:
-		TCP_INC_STATS_BH(TcpInErrs);
+		TCP_INC_STATS_BH(TCP_MIB_INERRS);
 	} else {
 		tcp_v6_send_reset(skb);
 	}
@@ -1668,7 +1670,7 @@
 	}
 
 	if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
-		TCP_INC_STATS_BH(TcpInErrs);
+		TCP_INC_STATS_BH(TCP_MIB_INERRS);
 		tcp_tw_put((struct tcp_tw_bucket *) sk);
 		goto discard_it;
 	}
@@ -2015,12 +2017,12 @@
 	struct tcp_iter_state *st;
 
 	if (v == SEQ_START_TOKEN) {
-		seq_printf(seq,
-			   "  sl  "
-			   "local_address                         "
-			   "remote_address                        "
-			   "st tx_queue rx_queue tr tm->when retrnsmt"
-			   "   uid  timeout inode\n");
+		seq_puts(seq,
+			 "  sl  "
+			 "local_address                         "
+			 "remote_address                        "
+			 "st tx_queue rx_queue tr tm->when retrnsmt"
+			 "   uid  timeout inode\n");
 		goto out;
 	}
 	st = seq->private;
diff -urN linux-2.6.8-rc2/net/ipv6/udp.c linux-2.6.8-rc3/net/ipv6/udp.c
--- linux-2.6.8-rc2/net/ipv6/udp.c	2004-08-03 15:21:17.231926846 -0700
+++ linux-2.6.8-rc3/net/ipv6/udp.c	2004-08-03 15:22:18.719449220 -0700
@@ -49,6 +49,7 @@
 #include <net/addrconf.h>
 #include <net/ip.h>
 #include <net/udp.h>
+#include <net/raw.h>
 #include <net/inet_common.h>
 
 #include <net/ip6_checksum.h>
@@ -203,159 +204,6 @@
  *
  */
 
-int udpv6_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
-{
-	struct sockaddr_in6	*usin = (struct sockaddr_in6 *) uaddr;
-	struct inet_opt      	*inet = inet_sk(sk);
-	struct ipv6_pinfo      	*np = inet6_sk(sk);
-	struct in6_addr		*daddr;
-	struct dst_entry	*dst;
-	struct flowi		fl;
-	struct ip6_flowlabel	*flowlabel = NULL;
-	int			addr_type;
-	int			err;
-
-	if (usin->sin6_family == AF_INET) {
-		if (__ipv6_only_sock(sk))
-			return -EAFNOSUPPORT;
-		err = udp_connect(sk, uaddr, addr_len);
-		goto ipv4_connected;
-	}
-
-	if (addr_len < SIN6_LEN_RFC2133)
-	  	return -EINVAL;
-
-	if (usin->sin6_family != AF_INET6) 
-	  	return -EAFNOSUPPORT;
-
-	memset(&fl, 0, sizeof(fl));
-	if (np->sndflow) {
-		fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
-		if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
-			flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
-			if (flowlabel == NULL)
-				return -EINVAL;
-			ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
-		}
-	}
-
-	addr_type = ipv6_addr_type(&usin->sin6_addr);
-
-	if (addr_type == IPV6_ADDR_ANY) {
-		/*
-		 *	connect to self
-		 */
-		usin->sin6_addr.s6_addr[15] = 0x01;
-	}
-
-	daddr = &usin->sin6_addr;
-
-	if (addr_type == IPV6_ADDR_MAPPED) {
-		struct sockaddr_in sin;
-
-		if (__ipv6_only_sock(sk)) {
-			err = -ENETUNREACH;
-			goto out;
-		}
-		sin.sin_family = AF_INET;
-		sin.sin_addr.s_addr = daddr->s6_addr32[3];
-		sin.sin_port = usin->sin6_port;
-
-		err = udp_connect(sk, (struct sockaddr*) &sin, sizeof(sin));
-
-ipv4_connected:
-		if (err)
-			goto out;
-		
-		ipv6_addr_set(&np->daddr, 0, 0, htonl(0x0000ffff), inet->daddr);
-
-		if (ipv6_addr_any(&np->saddr)) {
-			ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000ffff),
-				      inet->saddr);
-		}
-
-		if (ipv6_addr_any(&np->rcv_saddr)) {
-			ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000ffff),
-				      inet->rcv_saddr);
-		}
-		goto out;
-	}
-
-	if (addr_type&IPV6_ADDR_LINKLOCAL) {
-		if (addr_len >= sizeof(struct sockaddr_in6) &&
-		    usin->sin6_scope_id) {
-			if (sk->sk_bound_dev_if &&
-			    sk->sk_bound_dev_if != usin->sin6_scope_id) {
-				err = -EINVAL;
-				goto out;
-			}
-			sk->sk_bound_dev_if = usin->sin6_scope_id;
-			if (!sk->sk_bound_dev_if &&
-			    (addr_type & IPV6_ADDR_MULTICAST))
-				fl.oif = np->mcast_oif;
-		}
-
-		/* Connect to link-local address requires an interface */
-		if (!sk->sk_bound_dev_if) {
-			err = -EINVAL;
-			goto out;
-		}
-	}
-
-	ipv6_addr_copy(&np->daddr, daddr);
-	np->flow_label = fl.fl6_flowlabel;
-
-	inet->dport = usin->sin6_port;
-
-	/*
-	 *	Check for a route to destination an obtain the
-	 *	destination cache for it.
-	 */
-
-	fl.proto = IPPROTO_UDP;
-	ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
-	ipv6_addr_copy(&fl.fl6_src, &np->saddr);
-	fl.oif = sk->sk_bound_dev_if;
-	fl.fl_ip_dport = inet->dport;
-	fl.fl_ip_sport = inet->sport;
-
-	if (!fl.oif && (addr_type&IPV6_ADDR_MULTICAST))
-		fl.oif = np->mcast_oif;
-
-	if (flowlabel) {
-		if (flowlabel->opt && flowlabel->opt->srcrt) {
-			struct rt0_hdr *rt0 = (struct rt0_hdr *) flowlabel->opt->srcrt;
-			ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
-		}
-	} else if (np->opt && np->opt->srcrt) {
-		struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
-		ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
-	}
-
-	err = ip6_dst_lookup(sk, &dst, &fl);
-	if (err)
-		goto out;
-
-	/* source address lookup done in ip6_dst_lookup */
-
-	if (ipv6_addr_any(&np->saddr))
-		ipv6_addr_copy(&np->saddr, &fl.fl6_src);
-
-	if (ipv6_addr_any(&np->rcv_saddr)) {
-		ipv6_addr_copy(&np->rcv_saddr, &fl.fl6_src);
-		inet->rcv_saddr = LOOPBACK4_IPV6;
-	}
-
-	ip6_dst_store(sk, dst,
-		      !ipv6_addr_cmp(&fl.fl6_dst, &np->daddr) ?
-		      &np->daddr : NULL);
-
-	sk->sk_state = TCP_ESTABLISHED;
-out:
-	fl6_sock_release(flowlabel);
-	return err;
-}
-
 static void udpv6_close(struct sock *sk, long timeout)
 {
 	sk_common_release(sk);
@@ -436,7 +284,10 @@
 				sin6->sin6_scope_id = IP6CB(skb)->iif;
 		}
   	}
+
 	err = copied;
+	if (flags & MSG_TRUNC)
+		err = skb->len - sizeof(struct udphdr);
 
 out_free:
 	skb_free_datagram(sk, skb);
@@ -460,7 +311,7 @@
 	skb_free_datagram(sk, skb);
 
 	if (flags & MSG_DONTWAIT) {
-		UDP6_INC_STATS_USER(UdpInErrors);
+		UDP6_INC_STATS_USER(UDP_MIB_INERRORS);
 		return -EAGAIN;
 	}
 	goto try_again;
@@ -509,7 +360,7 @@
 
 	if (skb->ip_summed != CHECKSUM_UNNECESSARY) {
 		if ((unsigned short)csum_fold(skb_checksum(skb, 0, skb->len, skb->csum))) {
-			UDP6_INC_STATS_BH(UdpInErrors);
+			UDP6_INC_STATS_BH(UDP_MIB_INERRORS);
 			kfree_skb(skb);
 			return 0;
 		}
@@ -517,11 +368,11 @@
 	}
 
 	if (sock_queue_rcv_skb(sk,skb)<0) {
-		UDP6_INC_STATS_BH(UdpInErrors);
+		UDP6_INC_STATS_BH(UDP_MIB_INERRORS);
 		kfree_skb(skb);
 		return 0;
 	}
-	UDP6_INC_STATS_BH(UdpInDatagrams);
+	UDP6_INC_STATS_BH(UDP_MIB_INDATAGRAMS);
 	return 0;
 }
 
@@ -670,7 +521,7 @@
 		if (skb->ip_summed != CHECKSUM_UNNECESSARY &&
 		    (unsigned short)csum_fold(skb_checksum(skb, 0, skb->len, skb->csum)))
 			goto discard;
-		UDP6_INC_STATS_BH(UdpNoPorts);
+		UDP6_INC_STATS_BH(UDP_MIB_NOPORTS);
 
 		icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
 
@@ -689,7 +540,7 @@
 		printk(KERN_DEBUG "UDP: short packet: %d/%u\n", ulen, skb->len);
 
 discard:
-	UDP6_INC_STATS_BH(UdpInErrors);
+	UDP6_INC_STATS_BH(UDP_MIB_INERRORS);
 	kfree_skb(skb);
 	return(0);	
 }
@@ -988,7 +839,7 @@
 out:
 	fl6_sock_release(flowlabel);
 	if (!err) {
-		UDP6_INC_STATS_USER(UdpOutDatagrams);
+		UDP6_INC_STATS_USER(UDP_MIB_OUTDATAGRAMS);
 		return len;
 	}
 	return err;
@@ -1174,7 +1025,7 @@
 struct proto udpv6_prot = {
 	.name =		"UDP",
 	.close =	udpv6_close,
-	.connect =	udpv6_connect,
+	.connect =	ip6_datagram_connect,
 	.disconnect =	udp_disconnect,
 	.ioctl =	udp_ioctl,
 	.destroy =	udpv6_destroy_sock,
diff -urN linux-2.6.8-rc2/net/ipv6/xfrm6_input.c linux-2.6.8-rc3/net/ipv6/xfrm6_input.c
--- linux-2.6.8-rc2/net/ipv6/xfrm6_input.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv6/xfrm6_input.c	2004-08-03 15:22:18.720449261 -0700
@@ -34,12 +34,11 @@
 	struct xfrm_state *x;
 	int xfrm_nr = 0;
 	int decaps = 0;
-	int nexthdr = 0;
-	u8 *prevhdr = NULL;
+	int nexthdr;
+	unsigned int nhoff;
 
-	ip6_find_1stfragopt(skb, &prevhdr);
-	nexthdr = *prevhdr;
-	*nhoffp = prevhdr - skb->nh.raw;
+	nhoff = *nhoffp;
+	nexthdr = skb->nh.raw[nhoff];
 
 	if ((err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) != 0)
 		goto drop;
@@ -67,6 +66,8 @@
 		if (nexthdr <= 0)
 			goto drop_unlock;
 
+		skb->nh.raw[nhoff] = nexthdr;
+
 		if (x->props.replay_window)
 			xfrm_replay_advance(x, seq);
 
diff -urN linux-2.6.8-rc2/net/ipv6/xfrm6_output.c linux-2.6.8-rc3/net/ipv6/xfrm6_output.c
--- linux-2.6.8-rc2/net/ipv6/xfrm6_output.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/net/ipv6/xfrm6_output.c	2004-08-03 15:22:18.720449261 -0700
@@ -0,0 +1,141 @@
+/*
+ * xfrm6_output.c - Common IPsec encapsulation code for IPv6.
+ * Copyright (C) 2002 USAGI/WIDE Project
+ * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au>
+ * 
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/icmpv6.h>
+#include <net/inet_ecn.h>
+#include <net/ipv6.h>
+#include <net/xfrm.h>
+
+/* Add encapsulation header.
+ *
+ * In transport mode, the IP header and mutable extension headers will be moved
+ * forward to make space for the encapsulation header.
+ *
+ * In tunnel mode, the top IP header will be constructed per RFC 2401.
+ * The following fields in it shall be filled in by x->type->output:
+ *	payload_len
+ *
+ * On exit, skb->h will be set to the start of the encapsulation header to be
+ * filled in by x->type->output and skb->nh will be set to the nextheader field
+ * of the extension header directly preceding the encapsulation header, or in
+ * its absence, that of the top IP header.  The value of skb->data will always
+ * point to the top IP header.
+ */
+static void xfrm6_encap(struct sk_buff *skb)
+{
+	struct dst_entry *dst = skb->dst;
+	struct xfrm_state *x = dst->xfrm;
+	struct ipv6hdr *iph, *top_iph;
+
+	skb_push(skb, x->props.header_len);
+	iph = skb->nh.ipv6h;
+
+	if (!x->props.mode) {
+		u8 *prevhdr;
+		int hdr_len;
+
+		hdr_len = ip6_find_1stfragopt(skb, &prevhdr);
+		skb->nh.raw = prevhdr - x->props.header_len;
+		skb->h.raw = skb->data + hdr_len;
+		memmove(skb->data, iph, hdr_len);
+		return;
+	}
+
+	skb->nh.raw = skb->data;
+	top_iph = skb->nh.ipv6h;
+	skb->nh.raw = &top_iph->nexthdr;
+	skb->h.ipv6h = top_iph + 1;
+
+	top_iph->version = 6;
+	top_iph->priority = iph->priority;
+	if (x->props.flags & XFRM_STATE_NOECN)
+		IP6_ECN_clear(top_iph);
+	top_iph->flow_lbl[0] = iph->flow_lbl[0];
+	top_iph->flow_lbl[1] = iph->flow_lbl[1];
+	top_iph->flow_lbl[2] = iph->flow_lbl[2];
+	top_iph->nexthdr = IPPROTO_IPV6; 
+	top_iph->hop_limit = iph->hop_limit;
+	ipv6_addr_copy(&top_iph->saddr, (struct in6_addr *)&x->props.saddr);
+	ipv6_addr_copy(&top_iph->daddr, (struct in6_addr *)&x->id.daddr);
+}
+
+static int xfrm6_tunnel_check_size(struct sk_buff *skb)
+{
+	int mtu, ret = 0;
+	struct dst_entry *dst = skb->dst;
+
+	mtu = dst_pmtu(dst) - sizeof(struct ipv6hdr);
+	if (mtu < IPV6_MIN_MTU)
+		mtu = IPV6_MIN_MTU;
+
+	if (skb->len > mtu) {
+		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+		ret = -EMSGSIZE;
+	}
+
+	return ret;
+}
+
+int xfrm6_output(struct sk_buff **pskb)
+{
+	struct sk_buff *skb = *pskb;
+	struct dst_entry *dst = skb->dst;
+	struct xfrm_state *x = dst->xfrm;
+	int err;
+	
+	if (skb->ip_summed == CHECKSUM_HW) {
+		err = skb_checksum_help(pskb, 0);
+		skb = *pskb;
+		if (err)
+			goto error_nolock;
+	}
+
+	spin_lock_bh(&x->lock);
+	err = xfrm_state_check(x, skb);
+	if (err)
+		goto error;
+
+	if (x->props.mode) {
+		err = xfrm6_tunnel_check_size(skb);
+		if (err)
+			goto error;
+	}
+
+	xfrm6_encap(skb);
+
+	err = x->type->output(pskb);
+	skb = *pskb;
+	if (err)
+		goto error;
+
+	x->curlft.bytes += skb->len;
+	x->curlft.packets++;
+
+	spin_unlock_bh(&x->lock);
+
+	skb->nh.raw = skb->data;
+	
+	if (!(skb->dst = dst_pop(dst))) {
+		err = -EHOSTUNREACH;
+		goto error_nolock;
+	}
+	err = NET_XMIT_BYPASS;
+
+out_exit:
+	return err;
+error:
+	spin_unlock_bh(&x->lock);
+error_nolock:
+	kfree_skb(skb);
+	goto out_exit;
+}
diff -urN linux-2.6.8-rc2/net/ipv6/xfrm6_policy.c linux-2.6.8-rc3/net/ipv6/xfrm6_policy.c
--- linux-2.6.8-rc2/net/ipv6/xfrm6_policy.c	2004-08-03 15:21:17.231926846 -0700
+++ linux-2.6.8-rc3/net/ipv6/xfrm6_policy.c	2004-08-03 15:22:18.721449302 -0700
@@ -157,7 +157,7 @@
 		/* Copy neighbour for reachability confirmation */
 		dst_prev->neighbour	= neigh_clone(rt->u.dst.neighbour);
 		dst_prev->input		= rt->u.dst.input;
-		dst_prev->output	= dst_prev->xfrm->type->output;
+		dst_prev->output	= xfrm6_output;
 		/* Sheit... I remember I did this right. Apparently,
 		 * it was magically lost, so this code needs audit */
 		x->u.rt6.rt6i_flags    = rt0->rt6i_flags&(RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL);
diff -urN linux-2.6.8-rc2/net/ipv6/xfrm6_state.c linux-2.6.8-rc3/net/ipv6/xfrm6_state.c
--- linux-2.6.8-rc2/net/ipv6/xfrm6_state.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/net/ipv6/xfrm6_state.c	2004-08-03 15:22:18.721449302 -0700
@@ -16,7 +16,7 @@
 #include <linux/ipsec.h>
 #include <net/ipv6.h>
 
-extern struct xfrm_state_afinfo xfrm6_state_afinfo;
+static struct xfrm_state_afinfo xfrm6_state_afinfo;
 
 static void
 __xfrm6_init_tempsel(struct xfrm_state *x, struct flowi *fl,
@@ -81,11 +81,8 @@
 		    proto == x->id.proto &&
 		    !ipv6_addr_cmp((struct in6_addr *)saddr, (struct in6_addr *)x->props.saddr.a6) &&
 		    reqid == x->props.reqid &&
-		    x->km.state == XFRM_STATE_ACQ) {
-			    if (!x0)
-				    x0 = x;
-			    if (x->id.spi)
-				    continue;
+		    x->km.state == XFRM_STATE_ACQ &&
+		    !x->id.spi) {
 			    x0 = x;
 			    break;
 		    }
diff -urN linux-2.6.8-rc2/net/ipv6/xfrm6_tunnel.c linux-2.6.8-rc3/net/ipv6/xfrm6_tunnel.c
--- linux-2.6.8-rc2/net/ipv6/xfrm6_tunnel.c	2004-08-03 15:21:17.233926928 -0700
+++ linux-2.6.8-rc3/net/ipv6/xfrm6_tunnel.c	2004-08-03 15:22:18.723449384 -0700
@@ -27,8 +27,8 @@
 #include <linux/list.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
-#include <net/icmp.h>
 #include <net/ipv6.h>
+#include <net/protocol.h>
 #include <linux/ipv6.h>
 #include <linux/icmpv6.h>
 
@@ -343,68 +343,15 @@
 
 EXPORT_SYMBOL(xfrm6_tunnel_free_spi);
 
-int xfrm6_tunnel_check_size(struct sk_buff *skb)
-{
-	int mtu, ret = 0;
-	struct dst_entry *dst = skb->dst;
-
-	mtu = dst_pmtu(dst) - sizeof(struct ipv6hdr);
-	if (mtu < IPV6_MIN_MTU)
-		mtu = IPV6_MIN_MTU;
-
-	if (skb->len > mtu) {
-		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
-		ret = -EMSGSIZE;
-	}
-
-	return ret;
-}
-
-EXPORT_SYMBOL(xfrm6_tunnel_check_size);
-
 static int xfrm6_tunnel_output(struct sk_buff **pskb)
 {
 	struct sk_buff *skb = *pskb;
-	struct dst_entry *dst = skb->dst;
-	struct xfrm_state *x = dst->xfrm;
-	struct ipv6hdr *iph, *top_iph;
-	int err;
-
-	if ((err = xfrm6_tunnel_check_size(skb)) != 0)
-		goto error_nolock;
-
-	iph = skb->nh.ipv6h;
-
-	top_iph = (struct ipv6hdr *)skb_push(skb, x->props.header_len);
-	top_iph->version = 6;
-	top_iph->priority = iph->priority;
-	top_iph->flow_lbl[0] = iph->flow_lbl[0];
-	top_iph->flow_lbl[1] = iph->flow_lbl[1];
-	top_iph->flow_lbl[2] = iph->flow_lbl[2];
-	top_iph->nexthdr = IPPROTO_IPV6; 
-	top_iph->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
-	top_iph->hop_limit = iph->hop_limit;
-	memcpy(&top_iph->saddr, (struct in6_addr *)&x->props.saddr, sizeof(struct in6_addr));
-	memcpy(&top_iph->daddr, (struct in6_addr *)&x->id.daddr, sizeof(struct in6_addr));
-	skb->nh.raw = skb->data;
-	skb->h.raw = skb->nh.raw + sizeof(struct ipv6hdr);
-
-	x->curlft.bytes += skb->len;
-	x->curlft.packets++;
+	struct ipv6hdr *top_iph;
 
-	spin_unlock_bh(&x->lock);
-
-	if ((skb->dst = dst_pop(dst)) == NULL) { 
-		kfree_skb(skb);
-		err = -EHOSTUNREACH;
-		goto error_nolock;
-	}
-
-	return NET_XMIT_BYPASS;
+	top_iph = (struct ipv6hdr *)skb->data;
+	top_iph->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
 
-error_nolock:
-	kfree_skb(skb);
-	return err;
+	return 0;
 }
 
 static int xfrm6_tunnel_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb)
diff -urN linux-2.6.8-rc2/net/irda/af_irda.c linux-2.6.8-rc3/net/irda/af_irda.c
--- linux-2.6.8-rc2/net/irda/af_irda.c	2004-06-15 22:19:10.000000000 -0700
+++ linux-2.6.8-rc3/net/irda/af_irda.c	2004-08-03 15:22:18.774451476 -0700
@@ -1266,7 +1266,7 @@
 	unsigned char *asmptr;
 	int err;
 
-	IRDA_DEBUG(4, "%s(), len=%d\n", __FUNCTION__, len);
+	IRDA_DEBUG(4, "%s(), len=%zd\n", __FUNCTION__, len);
 
 	/* Note : socket.c set MSG_EOR on SEQPACKET sockets */
 	if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_CMSG_COMPAT))
@@ -1295,7 +1295,7 @@
 
 	/* Check that we don't send out to big frames */
 	if (len > self->max_data_size) {
-		IRDA_DEBUG(2, "%s(), Chopping frame from %d to %d bytes!\n",
+		IRDA_DEBUG(2, "%s(), Chopping frame from %zd to %d bytes!\n",
 			   __FUNCTION__, len, self->max_data_size);
 		len = self->max_data_size;
 	}
@@ -1355,7 +1355,7 @@
 	copied     = skb->len;
 
 	if (copied > size) {
-		IRDA_DEBUG(2, "%s(), Received truncated frame (%d < %d)!\n",
+		IRDA_DEBUG(2, "%s(), Received truncated frame (%zd < %zd)!\n",
 			   __FUNCTION__, copied, size);
 		copied = size;
 		msg->msg_flags |= MSG_TRUNC;
@@ -1519,7 +1519,7 @@
 	unsigned char *asmptr;
 	int err;
 
-	IRDA_DEBUG(4, "%s(), len=%d\n", __FUNCTION__, len);
+	IRDA_DEBUG(4, "%s(), len=%zd\n", __FUNCTION__, len);
 
 	if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_CMSG_COMPAT))
 		return -EINVAL;
@@ -1541,7 +1541,7 @@
 	 */
 	if (len > self->max_data_size) {
 		IRDA_DEBUG(0, "%s(), Warning to much data! "
-			   "Chopping frame from %d to %d bytes!\n",
+			   "Chopping frame from %zd to %d bytes!\n",
 			   __FUNCTION__, len, self->max_data_size);
 		len = self->max_data_size;
 	}
@@ -1591,7 +1591,7 @@
 	unsigned char *asmptr;
 	int err;
 
-	IRDA_DEBUG(4, "%s(), len=%d\n", __FUNCTION__, len);
+	IRDA_DEBUG(4, "%s(), len=%zd\n", __FUNCTION__, len);
 
 	if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_CMSG_COMPAT))
 		return -EINVAL;
@@ -1637,7 +1637,7 @@
 	 */
 	if (len > self->max_data_size) {
 		IRDA_DEBUG(0, "%s(), Warning to much data! "
-			   "Chopping frame from %d to %d bytes!\n",
+			   "Chopping frame from %zd to %d bytes!\n",
 			   __FUNCTION__, len, self->max_data_size);
 		len = self->max_data_size;
 	}
diff -urN linux-2.6.8-rc2/net/key/af_key.c linux-2.6.8-rc3/net/key/af_key.c
--- linux-2.6.8-rc2/net/key/af_key.c	2004-08-03 15:21:17.416934436 -0700
+++ linux-2.6.8-rc3/net/key/af_key.c	2004-08-03 15:22:19.016461404 -0700
@@ -1182,10 +1182,10 @@
 			min_spi = range->sadb_spirange_min;
 			max_spi = range->sadb_spirange_max;
 		} else {
-			min_spi = htonl(0x100);
-			max_spi = htonl(0x0fffffff);
+			min_spi = 0x100;
+			max_spi = 0x0fffffff;
 		}
-		xfrm_alloc_spi(x, min_spi, max_spi);
+		xfrm_alloc_spi(x, htonl(min_spi), htonl(max_spi));
 		if (x->id.spi)
 			resp_skb = pfkey_xfrm_state2msg(x, 0, 3);
 	}
diff -urN linux-2.6.8-rc2/net/netrom/af_netrom.c linux-2.6.8-rc3/net/netrom/af_netrom.c
--- linux-2.6.8-rc2/net/netrom/af_netrom.c	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/net/netrom/af_netrom.c	2004-08-03 15:22:19.064463373 -0700
@@ -10,6 +10,7 @@
  */
 #include <linux/config.h>
 #include <linux/module.h>
+#include <linux/moduleparam.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
@@ -1451,8 +1452,7 @@
 
 module_init(nr_proto_init);
 
-
-MODULE_PARM(nr_ndevs, "i");
+module_param(nr_ndevs, int, 0);
 MODULE_PARM_DESC(nr_ndevs, "number of NET/ROM devices");
 
 MODULE_AUTHOR("Jonathan Naylor G4KLX <g4klx@g4klx.demon.co.uk>");
diff -urN linux-2.6.8-rc2/net/rose/af_rose.c linux-2.6.8-rc3/net/rose/af_rose.c
--- linux-2.6.8-rc2/net/rose/af_rose.c	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/net/rose/af_rose.c	2004-08-03 15:22:19.113465383 -0700
@@ -11,6 +11,7 @@
  */
 #include <linux/config.h>
 #include <linux/module.h>
+#include <linux/moduleparam.h>
 #include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/types.h>
@@ -57,7 +58,7 @@
 int sysctl_rose_maximum_vcs             = ROSE_DEFAULT_MAXVC;
 int sysctl_rose_window_size             = ROSE_DEFAULT_WINDOW_SIZE;
 
-HLIST_HEAD(rose_list);
+static HLIST_HEAD(rose_list);
 spinlock_t rose_list_lock = SPIN_LOCK_UNLOCKED;
 
 static struct proto_ops rose_proto_ops;
@@ -1550,7 +1551,7 @@
 }
 module_init(rose_proto_init);
 
-MODULE_PARM(rose_ndevs, "i");
+module_param(rose_ndevs, int, 0);
 MODULE_PARM_DESC(rose_ndevs, "number of ROSE devices");
 
 MODULE_AUTHOR("Jonathan Naylor G4KLX <g4klx@g4klx.demon.co.uk>");
diff -urN linux-2.6.8-rc2/net/sched/Kconfig linux-2.6.8-rc3/net/sched/Kconfig
--- linux-2.6.8-rc2/net/sched/Kconfig	2004-08-03 15:21:17.628943133 -0700
+++ linux-2.6.8-rc3/net/sched/Kconfig	2004-08-03 15:22:19.292472726 -0700
@@ -1,6 +1,61 @@
 #
 # Traffic control configuration.
 # 
+choice
+	prompt "Packet scheduler clock source"
+	depends on NET_SCHED
+	default NET_SCH_CLK_JIFFIES
+	help
+	  Packet schedulers need a monotonic clock that increments at a static
+	  rate. The kernel provides several suitable interfaces, each with
+	  different properties:
+	  
+	  - high resolution (us or better)
+	  - fast to read (minimal locking, no i/o access)
+	  - synchronized on all processors
+	  - handles cpu clock frequency changes
+
+	  but nothing provides all of the above.
+
+config NET_SCH_CLK_JIFFIES
+	bool "Timer interrupt"
+	help
+	  Say Y here if you want to use the timer interrupt (jiffies) as clock
+	  source. This clock source is fast, synchronized on all processors and
+	  handles cpu clock frequency changes, but its resolution is too low
+	  for accurate shaping except at very low speed.
+
+config NET_SCH_CLK_GETTIMEOFDAY
+	bool "gettimeofday"
+	help
+	  Say Y here if you want to use gettimeofday as clock source. This clock
+	  source has high resolution, is synchronized on all processors and
+	  handles cpu clock frequency changes, but it is slow.
+
+	  Choose this if you need a high resolution clock source but can't use
+	  the CPU's cycle counter.
+
+config NET_SCH_CLK_CPU
+	bool "CPU cycle counter"
+	depends on X86_TSC || X86_64 || ALPHA || SPARC64 || PPC64 || IA64
+	help
+	  Say Y here if you want to use the CPU's cycle counter as clock source.
+	  This is a cheap and high resolution clock source, but on some
+	  architectures it is not synchronized on all processors and doesn't
+	  handle cpu clock frequency changes.
+
+	  The useable cycle counters are:
+
+	  	x86/x86_64	- Timestamp Counter
+		alpha		- Cycle Counter
+		sparc64		- %ticks register
+		ppc64		- Time base
+		ia64		- Interval Time Counter
+
+	  Choose this if your CPU's cycle counter is working properly.
+
+endchoice
+
 config NET_SCH_CBQ
 	tristate "CBQ packet scheduler"
 	depends on NET_SCHED
@@ -158,7 +213,9 @@
 	  testing applications or protocols.
 
 	  To compile this driver as a module, choose M here: the module
-	  will be called sch_delay.
+	  will be called sch_netem.
+
+	  If unsure, say N.
 
 config NET_SCH_INGRESS
 	tristate "Ingress Qdisc"
diff -urN linux-2.6.8-rc2/net/sched/cls_api.c linux-2.6.8-rc3/net/sched/cls_api.c
--- linux-2.6.8-rc2/net/sched/cls_api.c	2004-08-03 15:21:17.632943297 -0700
+++ linux-2.6.8-rc3/net/sched/cls_api.c	2004-08-03 15:22:19.392476829 -0700
@@ -236,12 +236,12 @@
 			kfree(tp);
 			goto errout;
 		}
-		write_lock(&qdisc_tree_lock);
-		spin_lock_bh(&dev->queue_lock);
+
+		qdisc_lock_tree(dev);
 		tp->next = *back;
 		*back = tp;
-		spin_unlock_bh(&dev->queue_lock);
-		write_unlock(&qdisc_tree_lock);
+		qdisc_unlock_tree(dev);
+
 	} else if (tca[TCA_KIND-1] && rtattr_strcmp(tca[TCA_KIND-1], tp->ops->kind))
 		goto errout;
 
@@ -249,11 +249,10 @@
 
 	if (fh == 0) {
 		if (n->nlmsg_type == RTM_DELTFILTER && t->tcm_handle == 0) {
-			write_lock(&qdisc_tree_lock);
-			spin_lock_bh(&dev->queue_lock);
+			qdisc_lock_tree(dev);
 			*back = tp->next;
-			spin_unlock_bh(&dev->queue_lock);
-			write_unlock(&qdisc_tree_lock);
+			qdisc_unlock_tree(dev);
+
 			tfilter_notify(skb, n, tp, fh_s, RTM_DELTFILTER);
 			tcf_destroy(tp);
 			err = 0;
@@ -294,6 +293,19 @@
 	return err;
 }
 
+unsigned long tcf_set_class(struct tcf_proto *tp, unsigned long *clp, 
+			    unsigned long cl)
+{
+	unsigned long old_cl;
+
+	tcf_tree_lock(tp);
+	old_cl = __cls_set_class(clp, cl);
+	tcf_tree_unlock(tp);
+
+	return old_cl;
+}
+
+
 static int
 tcf_fill_node(struct sk_buff *skb, struct tcf_proto *tp, unsigned long fh,
 	      u32 pid, u32 seq, unsigned flags, int event)
@@ -459,3 +471,4 @@
 
 EXPORT_SYMBOL(register_tcf_proto_ops);
 EXPORT_SYMBOL(unregister_tcf_proto_ops);
+EXPORT_SYMBOL(tcf_set_class);
diff -urN linux-2.6.8-rc2/net/sched/cls_u32.c linux-2.6.8-rc3/net/sched/cls_u32.c
--- linux-2.6.8-rc2/net/sched/cls_u32.c	2004-08-03 15:21:17.678945185 -0700
+++ linux-2.6.8-rc3/net/sched/cls_u32.c	2004-08-03 15:22:19.450479208 -0700
@@ -64,17 +64,20 @@
 	struct tc_u_hnode	*ht_up;
 #ifdef CONFIG_NET_CLS_ACT
 	struct tc_action	*action;
-#ifdef CONFIG_NET_CLS_IND
-	char                     indev[IFNAMSIZ];
-#endif
 #else
 #ifdef CONFIG_NET_CLS_POLICE
 	struct tcf_police	*police;
 #endif
 #endif
+#ifdef CONFIG_NET_CLS_IND
+	char                     indev[IFNAMSIZ];
+#endif
 	u8			fshift;
 	struct tcf_result	res;
 	struct tc_u_hnode	*ht_down;
+#ifdef CONFIG_CLS_U32_PERF
+	struct tc_u32_pcnt	*pf;
+#endif
 	struct tc_u32_sel	sel;
 };
 
@@ -120,6 +123,9 @@
 	int sdepth = 0;
 	int off2 = 0;
 	int sel = 0;
+#ifdef CONFIG_CLS_U32_PERF
+	int j;
+#endif
 	int i;
 
 next_ht:
@@ -130,7 +136,8 @@
 		struct tc_u32_key *key = n->sel.keys;
 
 #ifdef CONFIG_CLS_U32_PERF
-		n->sel.rcnt +=1;
+		n->pf->rcnt +=1;
+		j = 0;
 #endif
 		for (i = n->sel.nkeys; i>0; i--, key++) {
 
@@ -139,7 +146,8 @@
 				goto next_knode;
 			}
 #ifdef CONFIG_CLS_U32_PERF
-			key->kcnt +=1;
+			n->pf->kcnts[j] +=1;
+			j++;
 #endif
 		}
 		if (n->ht_down == NULL) {
@@ -147,7 +155,6 @@
 			if (n->sel.flags&TC_U32_TERMINAL) {
 
 				*res = n->res;
-#ifdef CONFIG_NET_CLS_ACT
 #ifdef CONFIG_NET_CLS_IND
 				/* yes, i know it sucks but the feature is 
 				** optional dammit! - JHS */
@@ -164,8 +171,9 @@
 				}
 #endif
 #ifdef CONFIG_CLS_U32_PERF
-		n->sel.rhit +=1;
+				n->pf->rhit +=1;
 #endif
+#ifdef CONFIG_NET_CLS_ACT
 				if (n->action) {
 					int pol_res = tcf_action_exec(skb, n->action);
 					if (skb->tc_classid > 0) {
@@ -358,6 +366,10 @@
 #endif
 	if (n->ht_down)
 		n->ht_down->refcnt--;
+#ifdef CONFIG_CLS_U32_PERF
+	if (n && (NULL != n->pf))
+		kfree(n->pf);
+#endif
 	kfree(n);
 	return 0;
 }
@@ -571,18 +583,6 @@
 		tcf_action_destroy(act, TCA_ACT_UNBIND);
 	}
 
-#ifdef CONFIG_NET_CLS_IND
-	n->indev[0] = 0;
-	if(tb[TCA_U32_INDEV-1]) {
-		struct rtattr *input_dev = tb[TCA_U32_INDEV-1];
-		if (RTA_PAYLOAD(input_dev) >= IFNAMSIZ) {
-			printk("cls_u32: bad indev name %s\n",(char*)RTA_DATA(input_dev));
-			/* should we clear state first? */
-			return  -EINVAL;
-		}
-		sprintf(n->indev, "%s", (char*)RTA_DATA(input_dev));
-	}
-#endif
 
 #else
 #ifdef CONFIG_NET_CLS_POLICE
@@ -595,6 +595,19 @@
 	}
 #endif
 #endif
+#ifdef CONFIG_NET_CLS_IND
+	n->indev[0] = 0;
+	if(tb[TCA_U32_INDEV-1]) {
+		struct rtattr *input_dev = tb[TCA_U32_INDEV-1];
+		if (RTA_PAYLOAD(input_dev) >= IFNAMSIZ) {
+			printk("cls_u32: bad indev name %s\n",(char*)RTA_DATA(input_dev));
+			/* should we clear state first? */
+			return  -EINVAL;
+		}
+		sprintf(n->indev, "%s", (char*)RTA_DATA(input_dev));
+		printk("got IND %s\n",n->indev);
+	}
+#endif
 
 	return 0;
 }
@@ -682,17 +695,20 @@
 
 	s = RTA_DATA(tb[TCA_U32_SEL-1]);
 
-#ifdef CONFIG_CLS_U32_PERF
-	if (RTA_PAYLOAD(tb[TCA_U32_SEL-1]) < 
-		(s->nkeys*sizeof(struct tc_u32_key)) + sizeof(struct tc_u32_sel)) {
-			printk("Please upgrade your iproute2 tools or compile proper options in!\n");
-			return -EINVAL;
-}
-#endif
 	n = kmalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), GFP_KERNEL);
 	if (n == NULL)
 		return -ENOBUFS;
+
 	memset(n, 0, sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key));
+#ifdef CONFIG_CLS_U32_PERF
+	n->pf = kmalloc(sizeof(struct tc_u32_pcnt) + s->nkeys*sizeof(__u64), GFP_KERNEL);
+	if (n->pf == NULL) {
+		kfree(n);
+		return -ENOBUFS;
+	}
+	memset(n->pf, 0, sizeof(struct tc_u32_pcnt) + s->nkeys*sizeof(__u64));
+#endif
+
 	memcpy(&n->sel, s, sizeof(*s) + s->nkeys*sizeof(struct tc_u32_key));
 	n->ht_up = ht;
 	n->handle = handle;
@@ -721,6 +737,10 @@
 		*arg = (unsigned long)n;
 		return 0;
 	}
+#ifdef CONFIG_CLS_U32_PERF
+	if (n && (NULL != n->pf))
+		kfree(n->pf);
+#endif
 	kfree(n);
 	return err;
 }
@@ -812,13 +832,6 @@
 
 			p_rta->rta_len = skb->tail - (u8*)p_rta;
 		}
-#ifdef CONFIG_NET_CLS_IND
-		if(strlen(n->indev)) {
-			struct rtattr * p_rta = (struct rtattr*)skb->tail;
-			RTA_PUT(skb, TCA_U32_INDEV, IFNAMSIZ, n->indev);
-			p_rta->rta_len = skb->tail - (u8*)p_rta;
-		}
-#endif
 
 #else
 #ifdef CONFIG_NET_CLS_POLICE
@@ -834,13 +847,28 @@
 		}
 #endif
 #endif
+
+#ifdef CONFIG_NET_CLS_IND
+		if(strlen(n->indev)) {
+			struct rtattr * p_rta = (struct rtattr*)skb->tail;
+			RTA_PUT(skb, TCA_U32_INDEV, IFNAMSIZ, n->indev);
+			p_rta->rta_len = skb->tail - (u8*)p_rta;
+		}
+#endif
+#ifdef CONFIG_CLS_U32_PERF
+		RTA_PUT(skb, TCA_U32_PCNT, 
+		sizeof(struct tc_u32_pcnt) + n->sel.nkeys*sizeof(__u64),
+			n->pf);
+#endif
 	}
 
 	rta->rta_len = skb->tail - b;
 #ifdef CONFIG_NET_CLS_ACT
-	if (TC_U32_KEY(n->handle) && n->action && n->action->type == TCA_OLD_COMPAT) {
-		if (tcf_action_copy_stats(skb,n->action))
-			goto rtattr_failure;
+	if (TC_U32_KEY(n->handle) != 0) {
+		if (TC_U32_KEY(n->handle) && n->action && n->action->type == TCA_OLD_COMPAT) {
+			if (tcf_action_copy_stats(skb,n->action))
+				goto rtattr_failure;
+		}
 	}
 #else
 #ifdef CONFIG_NET_CLS_POLICE
@@ -875,6 +903,19 @@
 
 static int __init init_u32(void)
 {
+	printk("u32 classifier\n");
+#ifdef CONFIG_CLS_U32_PERF
+	printk("    Perfomance counters on\n");
+#endif
+#ifdef CONFIG_NET_CLS_POLICE
+	printk("    OLD policer on \n");
+#endif
+#ifdef CONFIG_NET_CLS_IND
+	printk("    input device check on \n");
+#endif
+#ifdef CONFIG_NET_CLS_ACT
+	printk("    Actions configured \n");
+#endif
 	return register_tcf_proto_ops(&cls_u32_ops);
 }
 
diff -urN linux-2.6.8-rc2/net/sched/sch_api.c linux-2.6.8-rc3/net/sched/sch_api.c
--- linux-2.6.8-rc2/net/sched/sch_api.c	2004-08-03 15:21:17.754948302 -0700
+++ linux-2.6.8-rc3/net/sched/sch_api.c	2004-08-03 15:22:19.482480521 -0700
@@ -306,8 +306,7 @@
 	if (dev->flags & IFF_UP)
 		dev_deactivate(dev);
 
-	write_lock(&qdisc_tree_lock);
-	spin_lock_bh(&dev->queue_lock);
+	qdisc_lock_tree(dev);
 	if (qdisc && qdisc->flags&TCQ_F_INGRES) {
 		oqdisc = dev->qdisc_ingress;
 		/* Prune old scheduler */
@@ -334,8 +333,7 @@
 		dev->qdisc = &noop_qdisc;
 	}
 
-	spin_unlock_bh(&dev->queue_lock);
-	write_unlock(&qdisc_tree_lock);
+	qdisc_unlock_tree(dev);
 
 	if (dev->flags & IFF_UP)
 		dev_activate(dev);
@@ -454,10 +452,11 @@
 	 * before we set a netdevice's qdisc pointer to sch */
 	smp_wmb();
 	if (!ops->init || (err = ops->init(sch, tca[TCA_OPTIONS-1])) == 0) {
-		write_lock(&qdisc_tree_lock);
+		qdisc_lock_tree(dev);
 		sch->next = dev->qdisc_list;
 		dev->qdisc_list = sch;
-		write_unlock(&qdisc_tree_lock);
+		qdisc_unlock_tree(dev);
+
 #ifdef CONFIG_NET_ESTIMATOR
 		if (tca[TCA_RATE-1])
 			qdisc_new_estimator(&sch->stats, sch->stats_lock,
@@ -1088,7 +1087,7 @@
 };	
 #endif
 
-#if PSCHED_CLOCK_SOURCE == PSCHED_GETTIMEOFDAY
+#ifdef CONFIG_NET_SCH_CLK_GETTIMEOFDAY
 int psched_tod_diff(int delta_sec, int bound)
 {
 	int delta;
@@ -1103,42 +1102,34 @@
 EXPORT_SYMBOL(psched_tod_diff);
 #endif
 
-psched_time_t psched_time_base;
-
-#if PSCHED_CLOCK_SOURCE == PSCHED_CPU
+#ifdef CONFIG_NET_SCH_CLK_CPU
 psched_tdiff_t psched_clock_per_hz;
 int psched_clock_scale;
 EXPORT_SYMBOL(psched_clock_per_hz);
 EXPORT_SYMBOL(psched_clock_scale);
-#endif
 
-#ifdef PSCHED_WATCHER
-PSCHED_WATCHER psched_time_mark;
+psched_time_t psched_time_base;
+cycles_t psched_time_mark;
 EXPORT_SYMBOL(psched_time_mark);
 EXPORT_SYMBOL(psched_time_base);
 
+/*
+ * Periodically adjust psched_time_base to avoid overflow
+ * with 32-bit get_cycles(). Safe up to 4GHz CPU.
+ */
 static void psched_tick(unsigned long);
-
 static struct timer_list psched_timer = TIMER_INITIALIZER(psched_tick, 0, 0);
 
 static void psched_tick(unsigned long dummy)
 {
-#if PSCHED_CLOCK_SOURCE == PSCHED_CPU
-	psched_time_t dummy_stamp;
-	PSCHED_GET_TIME(dummy_stamp);
-	/* It is OK up to 4GHz cpu */
-	psched_timer.expires = jiffies + 1*HZ;
-#else
-	unsigned long now = jiffies;
-	psched_time_base += ((u64)(now-psched_time_mark))<<PSCHED_JSCALE;
-	psched_time_mark = now;
-	psched_timer.expires = now + 60*60*HZ;
-#endif
-	add_timer(&psched_timer);
+	if (sizeof(cycles_t) == sizeof(u32)) {
+		psched_time_t dummy_stamp;
+		PSCHED_GET_TIME(dummy_stamp);
+		psched_timer.expires = jiffies + 1*HZ;
+		add_timer(&psched_timer);
+	}
 }
-#endif
 
-#if PSCHED_CLOCK_SOURCE == PSCHED_CPU
 int __init psched_calibrate_clock(void)
 {
 	psched_time_t stamp, stamp1;
@@ -1147,9 +1138,7 @@
 	long rdelay;
 	unsigned long stop;
 
-#ifdef PSCHED_WATCHER
 	psched_tick(0);
-#endif
 	stop = jiffies + HZ/10;
 	PSCHED_GET_TIME(stamp);
 	do_gettimeofday(&tv);
@@ -1179,15 +1168,12 @@
 {
 	struct rtnetlink_link *link_p;
 
-#if PSCHED_CLOCK_SOURCE == PSCHED_CPU
+#ifdef CONFIG_NET_SCH_CLK_CPU
 	if (psched_calibrate_clock() < 0)
 		return -1;
-#elif PSCHED_CLOCK_SOURCE == PSCHED_JIFFIES
+#elif defined(CONFIG_NET_SCH_CLK_JIFFIES)
 	psched_tick_per_us = HZ<<PSCHED_JSCALE;
 	psched_us_per_tick = 1000000;
-#ifdef PSCHED_WATCHER
-	psched_tick(0);
-#endif
 #endif
 
 	link_p = rtnetlink_links[PF_UNSPEC];
diff -urN linux-2.6.8-rc2/net/sched/sch_generic.c linux-2.6.8-rc3/net/sched/sch_generic.c
--- linux-2.6.8-rc2/net/sched/sch_generic.c	2004-08-03 15:21:17.761948590 -0700
+++ linux-2.6.8-rc3/net/sched/sch_generic.c	2004-08-03 15:22:19.510481669 -0700
@@ -54,6 +54,18 @@
  */
 rwlock_t qdisc_tree_lock = RW_LOCK_UNLOCKED;
 
+void qdisc_lock_tree(struct net_device *dev)
+{
+	write_lock(&qdisc_tree_lock);
+	spin_lock_bh(&dev->queue_lock);
+}
+
+void qdisc_unlock_tree(struct net_device *dev)
+{
+	spin_unlock_bh(&dev->queue_lock);
+	write_unlock(&qdisc_tree_lock);
+}
+
 /* 
    dev->queue_lock serializes queue accesses for this device
    AND dev->qdisc pointer itself.
@@ -513,13 +525,11 @@
 
 void dev_init_scheduler(struct net_device *dev)
 {
-	write_lock(&qdisc_tree_lock);
-	spin_lock_bh(&dev->queue_lock);
+	qdisc_lock_tree(dev);
 	dev->qdisc = &noop_qdisc;
-	spin_unlock_bh(&dev->queue_lock);
 	dev->qdisc_sleeping = &noop_qdisc;
 	dev->qdisc_list = NULL;
-	write_unlock(&qdisc_tree_lock);
+	qdisc_unlock_tree(dev);
 
 	dev_watchdog_init(dev);
 }
@@ -528,8 +538,7 @@
 {
 	struct Qdisc *qdisc;
 
-	write_lock(&qdisc_tree_lock);
-	spin_lock_bh(&dev->queue_lock);
+	qdisc_lock_tree(dev);
 	qdisc = dev->qdisc_sleeping;
 	dev->qdisc = &noop_qdisc;
 	dev->qdisc_sleeping = &noop_qdisc;
@@ -543,8 +552,7 @@
 	BUG_TRAP(dev->qdisc_list == NULL);
 	BUG_TRAP(!timer_pending(&dev->watchdog_timer));
 	dev->qdisc_list = NULL;
-	spin_unlock_bh(&dev->queue_lock);
-	write_unlock(&qdisc_tree_lock);
+	qdisc_unlock_tree(dev);
 }
 
 EXPORT_SYMBOL(__netdev_watchdog_up);
@@ -554,4 +562,5 @@
 EXPORT_SYMBOL(qdisc_destroy);
 EXPORT_SYMBOL(qdisc_reset);
 EXPORT_SYMBOL(qdisc_restart);
-EXPORT_SYMBOL(qdisc_tree_lock);
+EXPORT_SYMBOL(qdisc_lock_tree);
+EXPORT_SYMBOL(qdisc_unlock_tree);
diff -urN linux-2.6.8-rc2/net/sched/sch_hfsc.c linux-2.6.8-rc3/net/sched/sch_hfsc.c
--- linux-2.6.8-rc2/net/sched/sch_hfsc.c	2004-08-03 15:21:17.764948713 -0700
+++ linux-2.6.8-rc3/net/sched/sch_hfsc.c	2004-08-03 15:22:19.535482695 -0700
@@ -193,7 +193,7 @@
 /*
  * macros
  */
-#if PSCHED_CLOCK_SOURCE == PSCHED_GETTIMEOFDAY
+#ifdef CONFIG_NET_SCH_CLK_GETTIMEOFDAY
 #include <linux/time.h>
 #undef PSCHED_GET_TIME
 #define PSCHED_GET_TIME(stamp)						\
@@ -429,10 +429,10 @@
  *	ism: (psched_us/byte) << ISM_SHIFT
  *	dx: psched_us
  *
- * Time source resolution
- *  PSCHED_JIFFIES: for 48<=HZ<=1534 resolution is between 0.63us and 1.27us.
- *  PSCHED_CPU: resolution is between 0.5us and 1us.
- *  PSCHED_GETTIMEOFDAY: resolution is exactly 1us.
+ * Clock source resolution (CONFIG_NET_SCH_CLK_*)
+ *  JIFFIES: for 48<=HZ<=1534 resolution is between 0.63us and 1.27us.
+ *  CPU: resolution is between 0.5us and 1us.
+ *  GETTIMEOFDAY: resolution is exactly 1us.
  *
  * sm and ism are scaled in order to keep effective digits.
  * SM_SHIFT and ISM_SHIFT are selected to keep at least 4 effective
diff -urN linux-2.6.8-rc2/net/sched/sch_htb.c linux-2.6.8-rc3/net/sched/sch_htb.c
--- linux-2.6.8-rc2/net/sched/sch_htb.c	2004-08-03 15:21:17.766948795 -0700
+++ linux-2.6.8-rc3/net/sched/sch_htb.c	2004-08-03 15:22:19.537482777 -0700
@@ -856,8 +856,13 @@
 			if (net_ratelimit())
 				printk(KERN_ERR "HTB: bad diff in charge, cl=%X diff=%lX now=%Lu then=%Lu j=%lu\n",
 				       cl->classid, diff,
+#ifdef CONFIG_NET_SCH_CLK_GETTIMEOFDAY
+				       q->now.tv_sec * 1000000ULL + q->now.tv_usec,
+				       cl->t_c.tv_sec * 1000000ULL + cl->t_c.tv_usec,
+#else
 				       (unsigned long long) q->now,
 				       (unsigned long long) cl->t_c,
+#endif
 				       q->jiffies);
 			diff = 1000;
 		}
@@ -927,8 +932,13 @@
 			if (net_ratelimit())
 				printk(KERN_ERR "HTB: bad diff in events, cl=%X diff=%lX now=%Lu then=%Lu j=%lu\n",
 				       cl->classid, diff,
+#ifdef CONFIG_NET_SCH_CLK_GETTIMEOFDAY
+				       q->now.tv_sec * 1000000ULL + q->now.tv_usec,
+				       cl->t_c.tv_sec * 1000000ULL + cl->t_c.tv_usec,
+#else
 				       (unsigned long long) q->now,
 				       (unsigned long long) cl->t_c,
+#endif
 				       q->jiffies);
 			diff = 1000;
 		}
diff -urN linux-2.6.8-rc2/net/sched/sch_netem.c linux-2.6.8-rc3/net/sched/sch_netem.c
--- linux-2.6.8-rc2/net/sched/sch_netem.c	2004-08-03 15:21:17.768948877 -0700
+++ linux-2.6.8-rc3/net/sched/sch_netem.c	2004-08-03 15:22:19.540482900 -0700
@@ -643,11 +643,17 @@
 	PSCHED_TADD2(now, delay, cb->time_to_send);
 	
 	/* Always queue at tail to keep packets in order */
-	__skb_queue_tail(&q->delayed, skb);
-	sch->q.qlen++;
-	sch->stats.bytes += skb->len;
-	sch->stats.packets++;
-	return 0;
+	if (likely(q->delayed.qlen < q->limit)) {
+		__skb_queue_tail(&q->delayed, skb);
+		sch->q.qlen++;
+		sch->stats.bytes += skb->len;
+		sch->stats.packets++;
+		return 0;
+	}
+
+	sch->stats.drops++;
+	kfree_skb(skb);
+	return NET_XMIT_DROP;
 }
 
 /* Requeue packets but don't change time stamp */
@@ -806,6 +812,9 @@
 	struct netem_sched_data *q = (struct netem_sched_data *)sch->data;
 
 	del_timer_sync(&q->timer);
+
+	qdisc_destroy(q->qdisc);
+	q->qdisc = &noop_qdisc;
 }
 
 static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)
@@ -829,8 +838,95 @@
 	return -1;
 }
 
+static int netem_dump_class(struct Qdisc *sch, unsigned long cl,
+			  struct sk_buff *skb, struct tcmsg *tcm)
+{
+	struct netem_sched_data *q = (struct netem_sched_data*)sch->data;
+
+	if (cl != 1) 	/* only one class */
+		return -ENOENT;
+
+	tcm->tcm_handle |= TC_H_MIN(1);
+	tcm->tcm_info = q->qdisc->handle;
+
+	return 0;
+}
+
+static int netem_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
+		     struct Qdisc **old)
+{
+	struct netem_sched_data *q = (struct netem_sched_data *)sch->data;
+
+	if (new == NULL)
+		new = &noop_qdisc;
+
+	sch_tree_lock(sch);
+	*old = xchg(&q->qdisc, new);
+	qdisc_reset(*old);
+	sch->q.qlen = 0;
+	sch_tree_unlock(sch);
+
+	return 0;
+}
+
+static struct Qdisc *netem_leaf(struct Qdisc *sch, unsigned long arg)
+{
+	struct netem_sched_data *q = (struct netem_sched_data *)sch->data;
+	return q->qdisc;
+}
+
+static unsigned long netem_get(struct Qdisc *sch, u32 classid)
+{
+	return 1;
+}
+
+static void netem_put(struct Qdisc *sch, unsigned long arg)
+{
+}
+
+static int netem_change_class(struct Qdisc *sch, u32 classid, u32 parentid, 
+			    struct rtattr **tca, unsigned long *arg)
+{
+	return -ENOSYS;
+}
+
+static int netem_delete(struct Qdisc *sch, unsigned long arg)
+{
+	return -ENOSYS;
+}
+
+static void netem_walk(struct Qdisc *sch, struct qdisc_walker *walker)
+{
+	if (!walker->stop) {
+		if (walker->count >= walker->skip)
+			if (walker->fn(sch, 1, walker) < 0) {
+				walker->stop = 1;
+				return;
+			}
+		walker->count++;
+	}
+}
+
+static struct tcf_proto **netem_find_tcf(struct Qdisc *sch, unsigned long cl)
+{
+	return NULL;
+}
+
+static struct Qdisc_class_ops netem_class_ops = {
+	.graft		=	netem_graft,
+	.leaf		=	netem_leaf,
+	.get		=	netem_get,
+	.put		=	netem_put,
+	.change		=	netem_change_class,
+	.delete		=	netem_delete,
+	.walk		=	netem_walk,
+	.tcf_chain	=	netem_find_tcf,
+	.dump		=	netem_dump_class,
+};
+
 static struct Qdisc_ops netem_qdisc_ops = {
 	.id		=	"netem",
+	.cl_ops		=	&netem_class_ops,
 	.priv_size	=	sizeof(struct netem_sched_data),
 	.enqueue	=	netem_enqueue,
 	.dequeue	=	netem_dequeue,
diff -urN linux-2.6.8-rc2/net/sctp/Kconfig linux-2.6.8-rc3/net/sctp/Kconfig
--- linux-2.6.8-rc2/net/sctp/Kconfig	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/net/sctp/Kconfig	2004-08-03 15:22:19.553483434 -0700
@@ -8,6 +8,10 @@
 config IP_SCTP
 	tristate "The SCTP Protocol (EXPERIMENTAL)"
 	depends on IPV6 || IPV6=n
+	select CRYPTO if SCTP_HMAC_SHA1 || SCTP_HMAC_MD5
+	select CRYPTO_HMAC if SCTP_HMAC_SHA1 || SCTP_HMAC_MD5
+	select CRYPTO_SHA1 if SCTP_HMAC_SHA1
+	select CRYPTO_MD5 if SCTP_HMAC_MD5
 	---help---
 	  Stream Control Transmission Protocol
 
@@ -71,18 +75,12 @@
 
 config SCTP_HMAC_SHA1
 	bool "HMAC-SHA1"
-	select CRYPTO
-	select CRYPTO_HMAC
-	select CRYPTO_SHA1
 	help 
 	  Enable the use of HMAC-SHA1 during association establishment.  It 
 	  is advised to use either HMAC-MD5 or HMAC-SHA1.
 
 config SCTP_HMAC_MD5
 	bool "HMAC-MD5"
-	select CRYPTO
-	select CRYPTO_HMAC
-	select CRYPTO_MD5
 	help
 	  Enable the use of HMAC-MD5 during association establishment.  It is 
 	  advised to use either HMAC-MD5 or HMAC-SHA1.
diff -urN linux-2.6.8-rc2/net/sctp/associola.c linux-2.6.8-rc3/net/sctp/associola.c
--- linux-2.6.8-rc2/net/sctp/associola.c	2004-06-15 22:18:55.000000000 -0700
+++ linux-2.6.8-rc3/net/sctp/associola.c	2004-08-03 15:22:19.554483475 -0700
@@ -879,7 +879,7 @@
 		if (sctp_chunk_is_data(chunk))
 			asoc->peer.last_data_from = chunk->transport;
 		else
-			SCTP_INC_STATS(SctpInCtrlChunks);
+			SCTP_INC_STATS(SCTP_MIB_INCTRLCHUNKS);
 
 		if (chunk->transport)
 			chunk->transport->last_time_heard = jiffies;
@@ -1093,6 +1093,7 @@
 	case SCTP_STATE_ESTABLISHED:
 	case SCTP_STATE_SHUTDOWN_PENDING:
 	case SCTP_STATE_SHUTDOWN_RECEIVED:
+	case SCTP_STATE_SHUTDOWN_SENT:
 		if ((asoc->rwnd > asoc->a_rwnd) &&
 		    ((asoc->rwnd - asoc->a_rwnd) >=
 		     min_t(__u32, (asoc->base.sk->sk_rcvbuf >> 1), asoc->pmtu)))
diff -urN linux-2.6.8-rc2/net/sctp/chunk.c linux-2.6.8-rc3/net/sctp/chunk.c
--- linux-2.6.8-rc2/net/sctp/chunk.c	2004-06-15 22:19:44.000000000 -0700
+++ linux-2.6.8-rc3/net/sctp/chunk.c	2004-08-03 15:22:19.554483475 -0700
@@ -215,7 +215,7 @@
 	offset = 0;
 
 	if ((whole > 1) || (whole && over))
-		SCTP_INC_STATS_USER(SctpFragUsrMsgs);
+		SCTP_INC_STATS_USER(SCTP_MIB_FRAGUSRMSGS);
 
 	/* Create chunks for all the full sized DATA chunks. */
 	for (i=0, len=first_len; i < whole; i++) {
diff -urN linux-2.6.8-rc2/net/sctp/endpointola.c linux-2.6.8-rc3/net/sctp/endpointola.c
--- linux-2.6.8-rc2/net/sctp/endpointola.c	2004-06-15 22:18:58.000000000 -0700
+++ linux-2.6.8-rc3/net/sctp/endpointola.c	2004-08-03 15:22:19.583484664 -0700
@@ -369,7 +369,7 @@
 		if (asoc && sctp_chunk_is_data(chunk))
 			asoc->peer.last_data_from = chunk->transport;
 		else
-			SCTP_INC_STATS(SctpInCtrlChunks);
+			SCTP_INC_STATS(SCTP_MIB_INCTRLCHUNKS);
 
 		if (chunk->transport)
 			chunk->transport->last_time_heard = jiffies;
diff -urN linux-2.6.8-rc2/net/sctp/input.c linux-2.6.8-rc3/net/sctp/input.c
--- linux-2.6.8-rc2/net/sctp/input.c	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/net/sctp/input.c	2004-08-03 15:22:19.619486141 -0700
@@ -90,7 +90,7 @@
 
 	if (val != cmp) {
 		/* CRC failure, dump it. */
-		SCTP_INC_STATS_BH(SctpChecksumErrors);
+		SCTP_INC_STATS_BH(SCTP_MIB_CHECKSUMERRORS);
 		return -1;
 	}
 	return 0;
@@ -117,7 +117,7 @@
 	if (skb->pkt_type!=PACKET_HOST)
 		goto discard_it;
 
-	SCTP_INC_STATS_BH(SctpInSCTPPacks);
+	SCTP_INC_STATS_BH(SCTP_MIB_INSCTPPACKS);
 
 	sh = (struct sctphdr *) skb->h.raw;
 
@@ -166,7 +166,7 @@
 	if (!asoc) {
 		ep = __sctp_rcv_lookup_endpoint(&dest);
 		if (sctp_rcv_ootb(skb)) {
-			SCTP_INC_STATS_BH(SctpOutOfBlues);
+			SCTP_INC_STATS_BH(SCTP_MIB_OUTOFBLUES);
 			goto discard_release;
 		}
 	}
@@ -327,7 +327,7 @@
 
 	if (asoc) {
 		if (ntohl(sctphdr->vtag) != asoc->c.peer_vtag) {
-			ICMP_INC_STATS_BH(IcmpInErrors);
+			ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
 			goto out;
 		}
 		sk = asoc->base.sk;
@@ -340,7 +340,7 @@
 	 * servers this needs to be solved differently.
 	 */
 	if (sock_owned_by_user(sk))
-		NET_INC_STATS_BH(LockDroppedIcmps);
+		NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
 
 	*epp = ep;
 	*app = asoc;
@@ -398,7 +398,7 @@
 	int err;
 
 	if (skb->len < ((iph->ihl << 2) + 8)) {
-		ICMP_INC_STATS_BH(IcmpInErrors);
+		ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
 		return;
 	}
 
@@ -412,7 +412,7 @@
 	skb->nh.raw = saveip;
 	skb->h.raw = savesctp;
 	if (!sk) {
-		ICMP_INC_STATS_BH(IcmpInErrors);
+		ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
 		return;
 	}
 	/* Warning:  The sock lock is held.  Remember to call
diff -urN linux-2.6.8-rc2/net/sctp/ipv6.c linux-2.6.8-rc3/net/sctp/ipv6.c
--- linux-2.6.8-rc2/net/sctp/ipv6.c	2004-08-03 15:21:17.828951338 -0700
+++ linux-2.6.8-rc3/net/sctp/ipv6.c	2004-08-03 15:22:19.649487372 -0700
@@ -107,7 +107,7 @@
 	skb->nh.raw = saveip;
 	skb->h.raw = savesctp;
 	if (!sk) {
-		ICMP6_INC_STATS_BH(idev, Icmp6InErrors);
+		ICMP6_INC_STATS_BH(idev, ICMP6_MIB_INERRORS);
 		goto out;
 	}
 
@@ -177,7 +177,7 @@
 			  __FUNCTION__, skb, skb->len,
 			  NIP6(fl.fl6_src), NIP6(fl.fl6_dst));
 
-	SCTP_INC_STATS(SctpOutSCTPPacks);
+	SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
 
 	return ip6_xmit(sk, skb, &fl, np->opt, ipfragok);
 }
diff -urN linux-2.6.8-rc2/net/sctp/output.c linux-2.6.8-rc3/net/sctp/output.c
--- linux-2.6.8-rc2/net/sctp/output.c	2004-08-03 15:21:17.876953307 -0700
+++ linux-2.6.8-rc3/net/sctp/output.c	2004-08-03 15:22:19.653487536 -0700
@@ -496,7 +496,7 @@
 	return err;
 no_route:
 	kfree_skb(nskb);
-	IP_INC_STATS_BH(OutNoRoutes);
+	IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
 
 	/* FIXME: Returning the 'err' will effect all the associations
 	 * associated with a socket, although only one of the paths of the
diff -urN linux-2.6.8-rc2/net/sctp/outqueue.c linux-2.6.8-rc3/net/sctp/outqueue.c
--- linux-2.6.8-rc2/net/sctp/outqueue.c	2004-08-03 15:21:17.878953390 -0700
+++ linux-2.6.8-rc3/net/sctp/outqueue.c	2004-08-03 15:22:19.673488356 -0700
@@ -349,15 +349,15 @@
 
 			sctp_outq_tail_data(q, chunk);
 			if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED)
-				SCTP_INC_STATS(SctpOutUnorderChunks);
+				SCTP_INC_STATS(SCTP_MIB_OUTUNORDERCHUNKS);
 			else
-				SCTP_INC_STATS(SctpOutOrderChunks);
+				SCTP_INC_STATS(SCTP_MIB_OUTORDERCHUNKS);
 			q->empty = 0;
 			break;
 		};
 	} else {
 		__skb_queue_tail(&q->control, (struct sk_buff *) chunk);
-		SCTP_INC_STATS(SctpOutCtrlChunks);
+		SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
 	}
 
 	if (error < 0)
@@ -525,10 +525,10 @@
 			       int rtx_timeout, int *start_timer)
 {
 	struct list_head *lqueue;
-	struct list_head *lchunk;
+	struct list_head *lchunk, *lchunk1;
 	struct sctp_transport *transport = pkt->transport;
 	sctp_xmit_t status;
-	struct sctp_chunk *chunk;
+	struct sctp_chunk *chunk, *chunk1;
 	struct sctp_association *asoc;
 	int error = 0;
 
@@ -615,6 +615,12 @@
 			 * the transmitted list.
 			 */
 			list_add_tail(lchunk, &transport->transmitted);
+
+			/* Mark the chunk as ineligible for fast retransmit 
+			 * after it is retransmitted.
+			 */
+			chunk->fast_retransmit = 0;
+
 			*start_timer = 1;
 			q->empty = 0;
 
@@ -622,6 +628,18 @@
 			lchunk = sctp_list_dequeue(lqueue);
 			break;
 		};
+
+		/* If we are here due to a retransmit timeout or a fast
+		 * retransmit and if there are any chunks left in the retransmit
+		 * queue that could not fit in the PMTU sized packet, they need			 * to be marked as ineligible for a subsequent fast retransmit.
+		 */
+		if (rtx_timeout && !lchunk) {
+			list_for_each(lchunk1, lqueue) {
+				chunk1 = list_entry(lchunk1, struct sctp_chunk,
+						    transmitted_list);
+				chunk1->fast_retransmit = 0;
+			}
+		}
 	}
 
 	return error;
@@ -1725,6 +1743,6 @@
 
 	if (ftsn_chunk) {
 		__skb_queue_tail(&q->control, (struct sk_buff *)ftsn_chunk);
-		SCTP_INC_STATS(SctpOutCtrlChunks);
+		SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
 	}
 }
diff -urN linux-2.6.8-rc2/net/sctp/proc.c linux-2.6.8-rc3/net/sctp/proc.c
--- linux-2.6.8-rc2/net/sctp/proc.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/net/sctp/proc.c	2004-08-03 15:22:19.673488356 -0700
@@ -39,26 +39,24 @@
 #include <linux/init.h>
 #include <net/sctp/sctp.h>
 
-static char *sctp_snmp_list[] = {
-#define SCTP_SNMP_ENTRY(x) #x 
-	SCTP_SNMP_ENTRY(SctpCurrEstab),
-	SCTP_SNMP_ENTRY(SctpActiveEstabs),
-	SCTP_SNMP_ENTRY(SctpPassiveEstabs),
-	SCTP_SNMP_ENTRY(SctpAborteds),
-	SCTP_SNMP_ENTRY(SctpShutdowns),
-	SCTP_SNMP_ENTRY(SctpOutOfBlues),
-	SCTP_SNMP_ENTRY(SctpChecksumErrors),
-	SCTP_SNMP_ENTRY(SctpOutCtrlChunks),
-	SCTP_SNMP_ENTRY(SctpOutOrderChunks),
-	SCTP_SNMP_ENTRY(SctpOutUnorderChunks),
-	SCTP_SNMP_ENTRY(SctpInCtrlChunks),
-	SCTP_SNMP_ENTRY(SctpInOrderChunks),
-	SCTP_SNMP_ENTRY(SctpInUnorderChunks),
-	SCTP_SNMP_ENTRY(SctpFragUsrMsgs),
-	SCTP_SNMP_ENTRY(SctpReasmUsrMsgs),
-	SCTP_SNMP_ENTRY(SctpOutSCTPPacks),
-	SCTP_SNMP_ENTRY(SctpInSCTPPacks),
-#undef SCTP_SNMP_ENTRY
+struct snmp_mib sctp_snmp_list[] = {
+	SNMP_MIB_ITEM("SctpCurrEstab", SCTP_MIB_CURRESTAB),
+	SNMP_MIB_ITEM("SctpActiveEstabs", SCTP_MIB_ACTIVEESTABS),
+	SNMP_MIB_ITEM("SctpPassiveEstabs", SCTP_MIB_PASSIVEESTABS),
+	SNMP_MIB_ITEM("SctpAborteds", SCTP_MIB_ABORTEDS),
+	SNMP_MIB_ITEM("SctpShutdowns", SCTP_MIB_SHUTDOWNS),
+	SNMP_MIB_ITEM("SctpOutOfBlues", SCTP_MIB_OUTOFBLUES),
+	SNMP_MIB_ITEM("SctpChecksumErrors", SCTP_MIB_CHECKSUMERRORS),
+	SNMP_MIB_ITEM("SctpOutCtrlChunks", SCTP_MIB_OUTCTRLCHUNKS),
+	SNMP_MIB_ITEM("SctpOutOrderChunks", SCTP_MIB_OUTORDERCHUNKS),
+	SNMP_MIB_ITEM("SctpOutUnorderChunks", SCTP_MIB_OUTUNORDERCHUNKS),
+	SNMP_MIB_ITEM("SctpInCtrlChunks", SCTP_MIB_INCTRLCHUNKS),
+	SNMP_MIB_ITEM("SctpInOrderChunks", SCTP_MIB_INORDERCHUNKS),
+	SNMP_MIB_ITEM("SctpInUnorderChunks", SCTP_MIB_INUNORDERCHUNKS),
+	SNMP_MIB_ITEM("SctpFragUsrMsgs", SCTP_MIB_FRAGUSRMSGS),
+	SNMP_MIB_ITEM("SctpReasmUsrMsgs", SCTP_MIB_REASMUSRMSGS),
+	SNMP_MIB_ITEM("SctpOutSCTPPacks", SCTP_MIB_OUTSCTPPACKS),
+	SNMP_MIB_ITEM("SctpInSCTPPacks", SCTP_MIB_INSCTPPACKS),
 };
 
 /* Return the current value of a particular entry in the mib by adding its
@@ -88,9 +86,10 @@
 {
 	int i;
 
-	for (i = 0; i < sizeof(sctp_snmp_list) / sizeof(char *); i++)
-		seq_printf(seq, "%-32s\t%ld\n", sctp_snmp_list[i],
-			   fold_field((void **)sctp_statistics, i));
+	for (i = 0; sctp_snmp_list[i].name != NULL; i++)
+		seq_printf(seq, "%-32s\t%ld\n", sctp_snmp_list[i].name,
+			   fold_field((void **)sctp_statistics, 
+				      sctp_snmp_list[i].entry));
 
 	return 0;
 }
diff -urN linux-2.6.8-rc2/net/sctp/protocol.c linux-2.6.8-rc3/net/sctp/protocol.c
--- linux-2.6.8-rc2/net/sctp/protocol.c	2004-08-03 15:21:17.880953472 -0700
+++ linux-2.6.8-rc3/net/sctp/protocol.c	2004-08-03 15:22:19.675488438 -0700
@@ -808,7 +808,7 @@
 			  NIPQUAD(((struct rtable *)skb->dst)->rt_src),
 			  NIPQUAD(((struct rtable *)skb->dst)->rt_dst));
 
-	SCTP_INC_STATS(SctpOutSCTPPacks);
+	SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
 	return ip_queue_xmit(skb, ipfragok);
 }
 
diff -urN linux-2.6.8-rc2/net/sctp/sm_make_chunk.c linux-2.6.8-rc3/net/sctp/sm_make_chunk.c
--- linux-2.6.8-rc2/net/sctp/sm_make_chunk.c	2004-08-03 15:21:17.888953800 -0700
+++ linux-2.6.8-rc3/net/sctp/sm_make_chunk.c	2004-08-03 15:22:19.703489587 -0700
@@ -1846,9 +1846,8 @@
 		if (unlikely(!idr_pre_get(&sctp_assocs_id, gfp)))
 			goto clean_up;
 		spin_lock_bh(&sctp_assocs_id_lock);
-		error = idr_get_new(&sctp_assocs_id,
-				    (void *)asoc,
-				    &assoc_id);
+		error = idr_get_new_above(&sctp_assocs_id, (void *)asoc, 1,
+					  &assoc_id);
 		spin_unlock_bh(&sctp_assocs_id_lock);
 		if (error == -EAGAIN)
 			goto retry;
diff -urN linux-2.6.8-rc2/net/sctp/sm_sideeffect.c linux-2.6.8-rc3/net/sctp/sm_sideeffect.c
--- linux-2.6.8-rc2/net/sctp/sm_sideeffect.c	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/net/sctp/sm_sideeffect.c	2004-08-03 15:22:19.705489669 -0700
@@ -529,6 +529,23 @@
 	}
 }
 
+/* Helper function to stop any pending T3-RTX timers */
+static void sctp_cmd_t3_rtx_timers_stop(sctp_cmd_seq_t *cmds,
+				        struct sctp_association *asoc)
+{
+	struct sctp_transport *t;
+	struct list_head *pos;
+
+	list_for_each(pos, &asoc->peer.transport_addr_list) {
+		t = list_entry(pos, struct sctp_transport, transports);
+		if (timer_pending(&t->T3_rtx_timer) &&
+		    del_timer(&t->T3_rtx_timer)) {
+			sctp_transport_put(t);
+		}
+	}
+}
+
+
 /* Helper function to update the heartbeat timer. */
 static void sctp_cmd_hb_timer_update(sctp_cmd_seq_t *cmds,
 				     struct sctp_association *asoc,
@@ -749,6 +766,26 @@
 	return;
 }
 
+/* Helper function to remove the association non-primary peer 
+ * transports.
+ */ 
+static void sctp_cmd_del_non_primary(struct sctp_association *asoc)
+{
+	struct sctp_transport *t;
+	struct list_head *pos;
+	struct list_head *temp;
+
+	list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
+		t = list_entry(pos, struct sctp_transport, transports);
+		if (!sctp_cmp_addr_exact(&t->ipaddr,
+		                         &asoc->peer.primary_addr)) {
+			sctp_assoc_del_peer(asoc, &t->ipaddr);
+		}
+	}
+
+	return;
+}
+
 /* These three macros allow us to pull the debugging code out of the
  * main flow of sctp_do_sm() to keep attention focused on the real
  * functionality there.
@@ -1048,6 +1085,27 @@
 			if (cmd->obj.ptr)
 				sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
 						SCTP_CHUNK(cmd->obj.ptr));
+
+			/* FIXME - Eventually come up with a cleaner way to
+			 * enabling COOKIE-ECHO + DATA bundling during 
+			 * multihoming stale cookie scenarios, the following 
+			 * command plays with asoc->peer.retran_path to 
+			 * avoid the problem of sending the COOKIE-ECHO and 
+			 * DATA in different paths, which could result 
+			 * in the association being ABORTed if the DATA chunk 
+			 * is processed first by the server.  Checking the
+			 * init error counter simply causes this command
+			 * to be executed only during failed attempts of
+			 * association establishment.
+			 */
+			if ((asoc->peer.retran_path != 
+			     asoc->peer.primary_path) && 
+			    (asoc->counters[SCTP_COUNTER_INIT_ERROR] > 0)) {
+				sctp_add_cmd_sf(commands, 
+				                SCTP_CMD_FORCE_PRIM_RETRAN,
+						SCTP_NULL());
+			}
+
 			break;
 
 		case SCTP_CMD_GEN_SHUTDOWN:
@@ -1282,6 +1340,19 @@
 		case SCTP_CMD_CLEAR_INIT_TAG:
 			asoc->peer.i.init_tag = 0;
 			break;
+		case SCTP_CMD_DEL_NON_PRIMARY:
+			sctp_cmd_del_non_primary(asoc);
+			break;
+		case SCTP_CMD_T3_RTX_TIMERS_STOP:
+			sctp_cmd_t3_rtx_timers_stop(commands, asoc);
+			break;
+		case SCTP_CMD_FORCE_PRIM_RETRAN:
+			t = asoc->peer.retran_path;
+			asoc->peer.retran_path = asoc->peer.primary_path;
+			error = sctp_outq_uncork(&asoc->outqueue);
+			local_cork = 0;
+			asoc->peer.retran_path = t;
+			break;
 		default:
 			printk(KERN_WARNING "Impossible command: %u, %p\n",
 			       cmd->verb, cmd->obj.ptr);
diff -urN linux-2.6.8-rc2/net/sctp/sm_statefuns.c linux-2.6.8-rc3/net/sctp/sm_statefuns.c
--- linux-2.6.8-rc2/net/sctp/sm_statefuns.c	2004-08-03 15:21:17.984957738 -0700
+++ linux-2.6.8-rc3/net/sctp/sm_statefuns.c	2004-08-03 15:22:19.740491105 -0700
@@ -148,8 +148,8 @@
 	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
 			SCTP_STATE(SCTP_STATE_CLOSED));
 
-	SCTP_INC_STATS(SctpShutdowns);
-	SCTP_DEC_STATS(SctpCurrEstab);
+	SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
+	SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
 
 	sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
 
@@ -245,7 +245,7 @@
 			if (packet) {
 				sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
 						SCTP_PACKET(packet));
-				SCTP_INC_STATS(SctpOutCtrlChunks);
+				SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
 				return SCTP_DISPOSITION_CONSUME;
 			} else {
 				return SCTP_DISPOSITION_NOMEM;
@@ -404,7 +404,7 @@
 		sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
 		sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
 				SCTP_STATE(SCTP_STATE_CLOSED));
-		SCTP_INC_STATS(SctpAborteds);
+		SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
 		sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
 		return SCTP_DISPOSITION_DELETE_TCB;
 	}
@@ -415,7 +415,7 @@
 			      (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
 			      &err_chunk)) {
 
-		SCTP_INC_STATS(SctpAborteds);
+		SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
 
 		/* This chunk contains fatal error. It is to be discarded.
 		 * Send an ABORT, with causes if there is any.
@@ -432,7 +432,7 @@
 			if (packet) {
 				sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
 						SCTP_PACKET(packet));
-				SCTP_INC_STATS(SctpOutCtrlChunks);
+				SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
 				sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
 						SCTP_STATE(SCTP_STATE_CLOSED));
 				sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB,
@@ -472,8 +472,6 @@
 	 */
 	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
 			SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
-	sctp_add_cmd_sf(commands, SCTP_CMD_COUNTER_RESET,
-			SCTP_COUNTER(SCTP_COUNTER_INIT_ERROR));
 	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
 			SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
 	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
@@ -587,8 +585,8 @@
 	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
 	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
 			SCTP_STATE(SCTP_STATE_ESTABLISHED));
-	SCTP_INC_STATS(SctpCurrEstab);
-	SCTP_INC_STATS(SctpPassiveEstabs);
+	SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
+	SCTP_INC_STATS(SCTP_MIB_PASSIVEESTABS);
 	sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
 
 	if (new_asoc->autoclose)
@@ -674,6 +672,15 @@
 	if (!sctp_vtag_verify(chunk, asoc))
 		return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 
+	/* Reset init error count upon receipt of COOKIE-ACK,
+	 * to avoid problems with the managemement of this
+	 * counter in stale cookie situations when a transition back
+	 * from the COOKIE-ECHOED state to the COOKIE-WAIT
+	 * state is performed.
+	 */
+	sctp_add_cmd_sf(commands, SCTP_CMD_COUNTER_RESET,
+	                SCTP_COUNTER(SCTP_COUNTER_INIT_ERROR));
+
 	/* RFC 2960 5.1 Normal Establishment of an Association
 	 *
 	 * E) Upon reception of the COOKIE ACK, endpoint "A" will move
@@ -684,8 +691,8 @@
 			SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
 	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
 			SCTP_STATE(SCTP_STATE_ESTABLISHED));
-	SCTP_INC_STATS(SctpCurrEstab);
-	SCTP_INC_STATS(SctpActiveEstabs);
+	SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
+	SCTP_INC_STATS(SCTP_MIB_ACTIVEESTABS);
 	sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
 	if (asoc->autoclose)
 		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
@@ -757,8 +764,8 @@
 		/* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
 		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
 				SCTP_U32(SCTP_ERROR_NO_ERROR));
-		SCTP_INC_STATS(SctpAborteds);
-		SCTP_DEC_STATS(SctpCurrEstab);
+		SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+		SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
 		return SCTP_DISPOSITION_DELETE_TCB;
 	}
 
@@ -960,7 +967,7 @@
 		goto out;
 	sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT, SCTP_PACKET(pkt));
 
-	SCTP_INC_STATS(SctpOutCtrlChunks);
+	SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
 
 	/* Discard the rest of the inbound packet. */
 	sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
@@ -1163,7 +1170,7 @@
 			if (packet) {
 				sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
 						SCTP_PACKET(packet));
-				SCTP_INC_STATS(SctpOutCtrlChunks);
+				SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
 				retval = SCTP_DISPOSITION_CONSUME;
 			} else {
 				retval = SCTP_DISPOSITION_NOMEM;
@@ -1501,7 +1508,7 @@
 	sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
 	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
 			SCTP_STATE(SCTP_STATE_ESTABLISHED));
-	SCTP_INC_STATS(SctpCurrEstab);
+	SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
 	sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
 
 	repl = sctp_make_cookie_ack(new_asoc, chunk);
@@ -1585,7 +1592,7 @@
 				SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
 		sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
 				SCTP_STATE(SCTP_STATE_ESTABLISHED));
-		SCTP_INC_STATS(SctpCurrEstab);
+		SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
 		sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START,
 				SCTP_NULL());
 
@@ -1872,8 +1879,6 @@
 	time_t stale;
 	sctp_cookie_preserve_param_t bht;
 	sctp_errhdr_t *err;
-	struct list_head *pos;
-	struct sctp_transport *t;
 	struct sctp_chunk *reply;
 	struct sctp_bind_addr *bp;
 	int attempts;
@@ -1920,20 +1925,27 @@
 	/* Clear peer's init_tag cached in assoc as we are sending a new INIT */
 	sctp_add_cmd_sf(commands, SCTP_CMD_CLEAR_INIT_TAG, SCTP_NULL());
 
+	/* Stop pending T3-rtx and heartbeat timers */
+	sctp_add_cmd_sf(commands, SCTP_CMD_T3_RTX_TIMERS_STOP, SCTP_NULL());
+	sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_STOP, SCTP_NULL());
+
+	/* Delete non-primary peer ip addresses since we are transitioning
+	 * back to the COOKIE-WAIT state
+	 */
+	sctp_add_cmd_sf(commands, SCTP_CMD_DEL_NON_PRIMARY, SCTP_NULL());
+
+	/* If we've sent any data bundled with COOKIE-ECHO we will need to 
+	 * resend 
+	 */
+	sctp_add_cmd_sf(commands, SCTP_CMD_RETRAN, 
+			SCTP_TRANSPORT(asoc->peer.primary_path));
+
 	/* Cast away the const modifier, as we want to just
 	 * rerun it through as a sideffect.
 	 */
 	sctp_add_cmd_sf(commands, SCTP_CMD_COUNTER_INC,
 			SCTP_COUNTER(SCTP_COUNTER_INIT_ERROR));
 
-	/* If we've sent any data bundled with COOKIE-ECHO we need to
-	 * resend.
-	 */
-	list_for_each(pos, &asoc->peer.transport_addr_list) {
-		t = list_entry(pos, struct sctp_transport, transports);
-		sctp_add_cmd_sf(commands, SCTP_CMD_RETRAN, SCTP_TRANSPORT(t));
-	}
-
 	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
 			SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
 	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
@@ -2001,8 +2013,8 @@
 
  	/* ASSOC_FAILED will DELETE_TCB. */
 	sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_U32(error));
-	SCTP_INC_STATS(SctpAborteds);
-	SCTP_DEC_STATS(SctpCurrEstab);
+	SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+	SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
 
 	return SCTP_DISPOSITION_ABORT;
 }
@@ -2027,7 +2039,7 @@
 
 	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
 			SCTP_STATE(SCTP_STATE_CLOSED));
-	SCTP_INC_STATS(SctpAborteds);
+	SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
 	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
 			SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
 
@@ -2321,12 +2333,7 @@
 					sctp_cmd_seq_t *commands)
 {
 	struct sctp_chunk *chunk = arg;
-	sctp_datahdr_t *data_hdr;
-	struct sctp_chunk *err;
-	size_t datalen;
-	sctp_verb_t deliver;
-	int tmp;
-	__u32 tsn;
+	int error;
 
 	if (!sctp_vtag_verify(chunk, asoc)) {
 		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
@@ -2334,158 +2341,22 @@
 		return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
         }
 
-	data_hdr = chunk->subh.data_hdr = (sctp_datahdr_t *)chunk->skb->data;
-	skb_pull(chunk->skb, sizeof(sctp_datahdr_t));
-
-	tsn = ntohl(data_hdr->tsn);
-	SCTP_DEBUG_PRINTK("eat_data: TSN 0x%x.\n", tsn);
-
-	/* ASSERT:  Now skb->data is really the user data.  */
-
-	/* Process ECN based congestion.
-	 *
-	 * Since the chunk structure is reused for all chunks within
-	 * a packet, we use ecn_ce_done to track if we've already
-	 * done CE processing for this packet.
-	 *
-	 * We need to do ECN processing even if we plan to discard the
-	 * chunk later.
-	 */
-
-	if (!chunk->ecn_ce_done) {
-		struct sctp_af *af;
-		chunk->ecn_ce_done = 1;
-
-		af = sctp_get_af_specific(
-			ipver2af(chunk->skb->nh.iph->version));
-
-		if (af && af->is_ce(chunk->skb) && asoc->peer.ecn_capable) {
-			/* Do real work as sideffect. */
-			sctp_add_cmd_sf(commands, SCTP_CMD_ECN_CE,
-					SCTP_U32(tsn));
-		}
-	}
-
-	tmp = sctp_tsnmap_check(&asoc->peer.tsn_map, tsn);
-	if (tmp < 0) {
-		/* The TSN is too high--silently discard the chunk and
-		 * count on it getting retransmitted later.
-		 */
+	error = sctp_eat_data(asoc, chunk, commands );
+	switch (error) {
+	case SCTP_IERROR_NO_ERROR:
+		break;
+	case SCTP_IERROR_HIGH_TSN:
+	case SCTP_IERROR_BAD_STREAM:
 		goto discard_noforce;
-	} else if (tmp > 0) {
-		/* This is a duplicate.  Record it.  */
-		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_DUP, SCTP_U32(tsn));
+	case SCTP_IERROR_DUP_TSN:
+	case SCTP_IERROR_IGNORE_TSN:
 		goto discard_force;
+	case SCTP_IERROR_NO_DATA:
+		goto consume;
+	default:
+		BUG();
 	}
 
-	/* This is a new TSN.  */
-
-	/* Discard if there is no room in the receive window.
-	 * Actually, allow a little bit of overflow (up to a MTU).
-	 */
-	datalen = ntohs(chunk->chunk_hdr->length);
-	datalen -= sizeof(sctp_data_chunk_t);
-
-	deliver = SCTP_CMD_CHUNK_ULP;
-
-	/* Think about partial delivery. */
-	if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) {
-
-		/* Even if we don't accept this chunk there is
-		 * memory pressure.
-		 */
-		sctp_add_cmd_sf(commands, SCTP_CMD_PART_DELIVER, SCTP_NULL());
-	}
-
-        /* Spill over rwnd a little bit.  Note: While allowed, this spill over
-	 * seems a bit troublesome in that frag_point varies based on
-	 * PMTU.  In cases, such as loopback, this might be a rather
-	 * large spill over.
-	 */
-	if (!asoc->rwnd || asoc->rwnd_over ||
-	    (datalen > asoc->rwnd + asoc->frag_point)) {
-
-		/* If this is the next TSN, consider reneging to make
-		 * room.   Note: Playing nice with a confused sender.  A
-		 * malicious sender can still eat up all our buffer
-		 * space and in the future we may want to detect and
-		 * do more drastic reneging.
-		 */
-		if (sctp_tsnmap_has_gap(&asoc->peer.tsn_map) &&
-		    (sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map) + 1) == tsn) {
-			SCTP_DEBUG_PRINTK("Reneging for tsn:%u\n", tsn);
-			deliver = SCTP_CMD_RENEGE;
-		} else {
-			SCTP_DEBUG_PRINTK("Discard tsn: %u len: %Zd, "
-					  "rwnd: %d\n", tsn, datalen,
-					  asoc->rwnd);
-			goto discard_force;
-		}
-	}
-
-	/*
-	 * Section 3.3.10.9 No User Data (9)
-	 *
-	 * Cause of error
-	 * ---------------
-	 * No User Data:  This error cause is returned to the originator of a
-	 * DATA chunk if a received DATA chunk has no user data.
-	 */
-	if (unlikely(0 == datalen)) {
-		err = sctp_make_abort_no_data(asoc, chunk, tsn);
-		if (err) {
-			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
-					SCTP_CHUNK(err));
-		}
-		/* We are going to ABORT, so we might as well stop
-		 * processing the rest of the chunks in the packet.
-		 */
-		sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
-		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
-				SCTP_U32(SCTP_ERROR_NO_DATA));
-		SCTP_INC_STATS(SctpAborteds);
-		SCTP_DEC_STATS(SctpCurrEstab);
-		return SCTP_DISPOSITION_CONSUME;
-	}
-
-	/* If definately accepting the DATA chunk, record its TSN, otherwise
-	 * wait for renege processing.
-	 */
-	if (SCTP_CMD_CHUNK_ULP == deliver)
-		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
-
-	/* Note: Some chunks may get overcounted (if we drop) or overcounted
-	 * if we renege and the chunk arrives again.
-	 */
-	if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED)
-		SCTP_INC_STATS(SctpInUnorderChunks);
-	else
-		SCTP_INC_STATS(SctpInOrderChunks);
-
-	/* RFC 2960 6.5 Stream Identifier and Stream Sequence Number
-	 *
-	 * If an endpoint receive a DATA chunk with an invalid stream
-	 * identifier, it shall acknowledge the reception of the DATA chunk
-	 * following the normal procedure, immediately send an ERROR chunk
-	 * with cause set to "Invalid Stream Identifier" (See Section 3.3.10)
-	 * and discard the DATA chunk.
-	 */
-	if (ntohs(data_hdr->stream) >= asoc->c.sinit_max_instreams) {
-		err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
-					 &data_hdr->stream,
-					 sizeof(data_hdr->stream));
-		if (err)
-			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
-					SCTP_CHUNK(err));
-		goto discard_noforce;
-	}
-
-	/* Send the data up to the user.  Note:  Schedule  the
-	 * SCTP_CMD_CHUNK_ULP cmd before the SCTP_CMD_GEN_SACK, as the SACK
-	 * chunk needs the updated rwnd.
-	 */
-	sctp_add_cmd_sf(commands, deliver, SCTP_CHUNK(chunk));
-
 	if (asoc->autoclose) {
 		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
 				SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
@@ -2551,6 +2422,9 @@
 				SCTP_TO(SCTP_EVENT_TIMEOUT_SACK));
 	}
 	return SCTP_DISPOSITION_DISCARD;
+consume:
+	return SCTP_DISPOSITION_CONSUME;
+	
 }
 
 /*
@@ -2576,11 +2450,7 @@
 				     sctp_cmd_seq_t *commands)
 {
 	struct sctp_chunk *chunk = arg;
-	sctp_datahdr_t *data_hdr;
-	struct sctp_chunk *err;
-	size_t datalen;
-	int tmp;
-	__u32 tsn;
+	int error;
 
 	if (!sctp_vtag_verify(chunk, asoc)) {
 		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
@@ -2588,110 +2458,22 @@
 		return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 	}
 
-	data_hdr = chunk->subh.data_hdr = (sctp_datahdr_t *) chunk->skb->data;
-	skb_pull(chunk->skb, sizeof(sctp_datahdr_t));
-
-	tsn = ntohl(data_hdr->tsn);
-
-	SCTP_DEBUG_PRINTK("eat_data: TSN 0x%x.\n", tsn);
-
-	/* ASSERT:  Now skb->data is really the user data.  */
-
-	/* Process ECN based congestion.
-	 *
-	 * Since the chunk structure is reused for all chunks within
-	 * a packet, we use ecn_ce_done to track if we've already
-	 * done CE processing for this packet.
-	 *
-	 * We need to do ECN processing even if we plan to discard the
-	 * chunk later.
-	 */
-	if (!chunk->ecn_ce_done) {
-		struct sctp_af *af;
-		chunk->ecn_ce_done = 1;
-
-		af = sctp_get_af_specific(
-			ipver2af(chunk->skb->nh.iph->version));
-
-		if (af && af->is_ce(chunk->skb) && asoc->peer.ecn_capable) {
-			/* Do real work as sideffect. */
-			sctp_add_cmd_sf(commands, SCTP_CMD_ECN_CE,
-					SCTP_U32(tsn));
-		}
-	}
-
-	tmp = sctp_tsnmap_check(&asoc->peer.tsn_map, tsn);
-	if (tmp < 0) {
-		/* The TSN is too high--silently discard the chunk and
-		 * count on it getting retransmitted later.
-		 */
-		goto gen_shutdown;
-	} else if (tmp > 0) {
-		/* This is a duplicate.  Record it.  */
-		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_DUP, SCTP_U32(tsn));
-		goto gen_shutdown;
-	}
-
-	/* This is a new TSN.  */
-
-	datalen = ntohs(chunk->chunk_hdr->length);
-	datalen -= sizeof(sctp_data_chunk_t);
-
-	/*
-	 * Section 3.3.10.9 No User Data (9)
-	 *
-	 * Cause of error
-	 * ---------------
-	 * No User Data:  This error cause is returned to the originator of a
-	 * DATA chunk if a received DATA chunk has no user data.
-	 */
-	if (unlikely(0 == datalen)) {
-		err = sctp_make_abort_no_data(asoc, chunk, tsn);
-		if (err) {
-			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
-					SCTP_CHUNK(err));
-		}
-		/* We are going to ABORT, so we might as well stop
-		 * processing the rest of the chunks in the packet.
-		 */
-		sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
-		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
-				SCTP_U32(SCTP_ERROR_NO_DATA));
-		SCTP_INC_STATS(SctpAborteds);
-		SCTP_DEC_STATS(SctpCurrEstab);
-		return SCTP_DISPOSITION_CONSUME;
-	}
-
-	/* We are accepting this DATA chunk. */
-
-	/* Record the fact that we have received this TSN.  */
-	sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
-
-	if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED)
-		SCTP_INC_STATS(SctpInUnorderChunks);
-	else
-		SCTP_INC_STATS(SctpInOrderChunks);
-
-	/* RFC 2960 6.5 Stream Identifier and Stream Sequence Number
-	 *
-	 * If an endpoint receive a DATA chunk with an invalid stream
-	 * identifier, it shall acknowledge the reception of the DATA chunk
-	 * following the normal procedure, immediately send an ERROR chunk
-	 * with cause set to "Invalid Stream Identifier" (See Section 3.3.10)
-	 * and discard the DATA chunk.
-	 */
-	if (ntohs(data_hdr->stream) >= asoc->c.sinit_max_instreams) {
-		err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
-					 &data_hdr->stream,
-					 sizeof(data_hdr->stream));
-		if (err) {
-			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
-					SCTP_CHUNK(err));
-		}
+	error = sctp_eat_data(asoc, chunk, commands );
+	switch (error) {
+	case SCTP_IERROR_NO_ERROR:
+	case SCTP_IERROR_HIGH_TSN:
+	case SCTP_IERROR_DUP_TSN:
+	case SCTP_IERROR_IGNORE_TSN:
+	case SCTP_IERROR_BAD_STREAM:
+		break;
+	case SCTP_IERROR_NO_DATA:
+		goto consume;
+	default:
+		BUG();
 	}
 
 	/* Go a head and force a SACK, since we are shutting down. */
-gen_shutdown:
+
 	/* Implementor's Guide.
 	 *
 	 * While in SHUTDOWN-SENT state, the SHUTDOWN sender MUST immediately
@@ -2707,6 +2489,8 @@
 		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
 				SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
 	}
+
+consume:
 	return SCTP_DISPOSITION_CONSUME;
 }
 
@@ -2832,7 +2616,7 @@
 		sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
 				SCTP_PACKET(packet));
 
-		SCTP_INC_STATS(SctpOutCtrlChunks);
+		SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
 
 		return SCTP_DISPOSITION_CONSUME;
 	}
@@ -2929,8 +2713,8 @@
 
 	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
 			SCTP_STATE(SCTP_STATE_CLOSED));
-	SCTP_INC_STATS(SctpShutdowns);
-	SCTP_DEC_STATS(SctpCurrEstab);
+	SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
+	SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
 	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
 
 	/* ...and remove all record of the association. */
@@ -2971,7 +2755,7 @@
 	__u8 *ch_end;
 	int ootb_shut_ack = 0;
 
-	SCTP_INC_STATS(SctpOutOfBlues);
+	SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
 
 	ch = (sctp_chunkhdr_t *) chunk->chunk_hdr;
 	do {
@@ -3040,7 +2824,7 @@
 		sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
 				SCTP_PACKET(packet));
 
-		SCTP_INC_STATS(SctpOutCtrlChunks);
+		SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
 
 		return SCTP_DISPOSITION_CONSUME;
 	}
@@ -3176,8 +2960,8 @@
 		sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
 		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
 				SCTP_U32(SCTP_ERROR_ASCONF_ACK));
-		SCTP_INC_STATS(SctpAborteds);
-		SCTP_DEC_STATS(SctpCurrEstab);
+		SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+		SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
 		return SCTP_DISPOSITION_ABORT;
 	}
 
@@ -3202,8 +2986,8 @@
 		sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
 		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
 				SCTP_U32(SCTP_ERROR_ASCONF_ACK));
-		SCTP_INC_STATS(SctpAborteds);
-		SCTP_DEC_STATS(SctpCurrEstab);
+		SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+		SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
 		return SCTP_DISPOSITION_ABORT;
 	}
 
@@ -3797,8 +3581,8 @@
 	sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
 			SCTP_U32(SCTP_ERROR_USER_ABORT));
 
-	SCTP_INC_STATS(SctpAborteds);
-	SCTP_DEC_STATS(SctpCurrEstab);
+	SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+	SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
 
 	return retval;
 }
@@ -3855,7 +3639,7 @@
 	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
 			SCTP_STATE(SCTP_STATE_CLOSED));
 
-	SCTP_INC_STATS(SctpShutdowns);
+	SCTP_INC_STATS(SCTP_MIB_SHUTDOWNS);
 
 	sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
 
@@ -3928,7 +3712,7 @@
 	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
 			SCTP_STATE(SCTP_STATE_CLOSED));
 
-	SCTP_INC_STATS(SctpAborteds);
+	SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
 
 	/* Even if we can't send the ABORT due to low memory delete the
 	 * TCB.  This is a departure from our typical NOMEM handling.
@@ -4288,8 +4072,8 @@
 		/* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
 		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
 				SCTP_U32(SCTP_ERROR_NO_ERROR));
-		SCTP_INC_STATS(SctpAborteds);
-		SCTP_DEC_STATS(SctpCurrEstab);
+		SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+		SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
 		return SCTP_DISPOSITION_DELETE_TCB;
 	}
 
@@ -4458,8 +4242,8 @@
 		/* Note:  CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
 		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
 				SCTP_U32(SCTP_ERROR_NO_ERROR));
-		SCTP_INC_STATS(SctpAborteds);
-		SCTP_DEC_STATS(SctpCurrEstab);
+		SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+		SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
 		return SCTP_DISPOSITION_DELETE_TCB;
 	}
 
@@ -4532,8 +4316,8 @@
 				SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
 		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
 				SCTP_U32(SCTP_ERROR_NO_ERROR));
-		SCTP_INC_STATS(SctpAborteds);
-		SCTP_INC_STATS(SctpCurrEstab);
+		SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+		SCTP_INC_STATS(SCTP_MIB_CURRESTAB);
 		return SCTP_DISPOSITION_ABORT;
 	}
 
@@ -4709,7 +4493,7 @@
 	num_blocks = ntohs(sack->num_gap_ack_blocks);
 	num_dup_tsns = ntohs(sack->num_dup_tsns);
 	len = sizeof(struct sctp_sackhdr);
-	len = (num_blocks + num_dup_tsns) * sizeof(__u32);
+	len += (num_blocks + num_dup_tsns) * sizeof(__u32);
 	if (len > chunk->skb->len)
 		return NULL;
 
@@ -4843,8 +4627,176 @@
 			sctp_packet_append_chunk(packet, err_chunk);
 			sctp_add_cmd_sf(commands, SCTP_CMD_SEND_PKT,
 					SCTP_PACKET(packet));
-			SCTP_INC_STATS(SctpOutCtrlChunks);
+			SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
 		} else
 			sctp_chunk_free (err_chunk);
 	}
 }
+
+
+/* Process a data chunk */
+int sctp_eat_data(const struct sctp_association *asoc,
+		  struct sctp_chunk *chunk,
+		  sctp_cmd_seq_t *commands)
+{
+	sctp_datahdr_t *data_hdr;
+	struct sctp_chunk *err;
+	size_t datalen;
+	sctp_verb_t deliver;
+	int tmp;
+	__u32 tsn;
+
+	data_hdr = chunk->subh.data_hdr = (sctp_datahdr_t *)chunk->skb->data;
+	skb_pull(chunk->skb, sizeof(sctp_datahdr_t));
+
+	tsn = ntohl(data_hdr->tsn);
+	SCTP_DEBUG_PRINTK("eat_data: TSN 0x%x.\n", tsn);
+
+	/* ASSERT:  Now skb->data is really the user data.  */
+
+	/* Process ECN based congestion.
+	 *
+	 * Since the chunk structure is reused for all chunks within
+	 * a packet, we use ecn_ce_done to track if we've already
+	 * done CE processing for this packet.
+	 *
+	 * We need to do ECN processing even if we plan to discard the
+	 * chunk later.
+	 */
+
+	if (!chunk->ecn_ce_done) {
+		struct sctp_af *af;
+		chunk->ecn_ce_done = 1;
+
+		af = sctp_get_af_specific(
+			ipver2af(chunk->skb->nh.iph->version));
+
+		if (af && af->is_ce(chunk->skb) && asoc->peer.ecn_capable) {
+			/* Do real work as sideffect. */
+			sctp_add_cmd_sf(commands, SCTP_CMD_ECN_CE,
+					SCTP_U32(tsn));
+		}
+	}
+
+	tmp = sctp_tsnmap_check(&asoc->peer.tsn_map, tsn);
+	if (tmp < 0) {
+		/* The TSN is too high--silently discard the chunk and
+		 * count on it getting retransmitted later.
+		 */
+		return SCTP_IERROR_HIGH_TSN;
+	} else if (tmp > 0) {
+		/* This is a duplicate.  Record it.  */
+		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_DUP, SCTP_U32(tsn));
+		return SCTP_IERROR_DUP_TSN;
+	}
+
+	/* This is a new TSN.  */
+
+	/* Discard if there is no room in the receive window.
+	 * Actually, allow a little bit of overflow (up to a MTU).
+	 */
+	datalen = ntohs(chunk->chunk_hdr->length);
+	datalen -= sizeof(sctp_data_chunk_t);
+
+	deliver = SCTP_CMD_CHUNK_ULP;
+
+	/* Think about partial delivery. */
+	if ((datalen >= asoc->rwnd) && (!asoc->ulpq.pd_mode)) {
+
+		/* Even if we don't accept this chunk there is
+		 * memory pressure.
+		 */
+		sctp_add_cmd_sf(commands, SCTP_CMD_PART_DELIVER, SCTP_NULL());
+	}
+
+        /* Spill over rwnd a little bit.  Note: While allowed, this spill over
+	 * seems a bit troublesome in that frag_point varies based on
+	 * PMTU.  In cases, such as loopback, this might be a rather
+	 * large spill over.
+	 */
+	if (!asoc->rwnd || asoc->rwnd_over ||
+	    (datalen > asoc->rwnd + asoc->frag_point)) {
+
+		/* If this is the next TSN, consider reneging to make
+		 * room.   Note: Playing nice with a confused sender.  A
+		 * malicious sender can still eat up all our buffer
+		 * space and in the future we may want to detect and
+		 * do more drastic reneging.
+		 */
+		if (sctp_tsnmap_has_gap(&asoc->peer.tsn_map) &&
+		    (sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map) + 1) == tsn) {
+			SCTP_DEBUG_PRINTK("Reneging for tsn:%u\n", tsn);
+			deliver = SCTP_CMD_RENEGE;
+		} else {
+			SCTP_DEBUG_PRINTK("Discard tsn: %u len: %Zd, "
+					  "rwnd: %d\n", tsn, datalen,
+					  asoc->rwnd);
+			return SCTP_IERROR_IGNORE_TSN;
+		}
+	}
+
+	/*
+	 * Section 3.3.10.9 No User Data (9)
+	 *
+	 * Cause of error
+	 * ---------------
+	 * No User Data:  This error cause is returned to the originator of a
+	 * DATA chunk if a received DATA chunk has no user data.
+	 */
+	if (unlikely(0 == datalen)) {
+		err = sctp_make_abort_no_data(asoc, chunk, tsn);
+		if (err) {
+			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
+					SCTP_CHUNK(err));
+		}
+		/* We are going to ABORT, so we might as well stop
+		 * processing the rest of the chunks in the packet.
+		 */
+		sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
+		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
+				SCTP_U32(SCTP_ERROR_NO_DATA));
+		SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+		SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+		return SCTP_IERROR_NO_DATA;
+	}
+
+	/* If definately accepting the DATA chunk, record its TSN, otherwise
+	 * wait for renege processing.
+	 */
+	if (SCTP_CMD_CHUNK_ULP == deliver)
+		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_TSN, SCTP_U32(tsn));
+
+	/* Note: Some chunks may get overcounted (if we drop) or overcounted
+	 * if we renege and the chunk arrives again.
+	 */
+	if (chunk->chunk_hdr->flags & SCTP_DATA_UNORDERED)
+		SCTP_INC_STATS(SCTP_MIB_INUNORDERCHUNKS);
+	else
+		SCTP_INC_STATS(SCTP_MIB_INORDERCHUNKS);
+
+	/* RFC 2960 6.5 Stream Identifier and Stream Sequence Number
+	 *
+	 * If an endpoint receive a DATA chunk with an invalid stream
+	 * identifier, it shall acknowledge the reception of the DATA chunk
+	 * following the normal procedure, immediately send an ERROR chunk
+	 * with cause set to "Invalid Stream Identifier" (See Section 3.3.10)
+	 * and discard the DATA chunk.
+	 */
+	if (ntohs(data_hdr->stream) >= asoc->c.sinit_max_instreams) {
+		err = sctp_make_op_error(asoc, chunk, SCTP_ERROR_INV_STRM,
+					 &data_hdr->stream,
+					 sizeof(data_hdr->stream));
+		if (err)
+			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
+					SCTP_CHUNK(err));
+		return SCTP_IERROR_BAD_STREAM;
+	}
+
+	/* Send the data up to the user.  Note:  Schedule  the
+	 * SCTP_CMD_CHUNK_ULP cmd before the SCTP_CMD_GEN_SACK, as the SACK
+	 * chunk needs the updated rwnd.
+	 */
+	sctp_add_cmd_sf(commands, deliver, SCTP_CHUNK(chunk));
+
+	return SCTP_IERROR_NO_ERROR;
+}
diff -urN linux-2.6.8-rc2/net/sctp/socket.c linux-2.6.8-rc3/net/sctp/socket.c
--- linux-2.6.8-rc2/net/sctp/socket.c	2004-08-03 15:21:18.019959174 -0700
+++ linux-2.6.8-rc3/net/sctp/socket.c	2004-08-03 15:22:19.821494428 -0700
@@ -1697,6 +1697,32 @@
 	if (copy_from_user(&params, optval, optlen))
 		return -EFAULT;
 
+	/*
+	 * API 7. Socket Options (setting the default value for the endpoint)
+	 * All options that support specific settings on an association by
+	 * filling in either an association id variable or a sockaddr_storage
+	 * SHOULD also support setting of the same value for the entire endpoint
+	 * (i.e. future associations). To accomplish this the following logic is
+	 * used when setting one of these options:
+
+	 * c) If neither the sockaddr_storage or association identification is
+	 *    set i.e. the sockaddr_storage is set to all 0's (INADDR_ANY) and
+	 *    the association identification is 0, the settings are a default
+	 *    and to be applied to the endpoint (all future associations).
+	 */
+
+	/* update default value for endpoint (all future associations) */
+	if (!params.spp_assoc_id && 
+	    sctp_is_any(( union sctp_addr *)&params.spp_address)) {
+		if (params.spp_hbinterval)
+			sctp_sk(sk)->paddrparam.spp_hbinterval =
+						params.spp_hbinterval;
+		if (sctp_max_retrans_path)
+			sctp_sk(sk)->paddrparam.spp_pathmaxrxt =
+						params.spp_pathmaxrxt;
+		return 0;
+	}
+
 	trans = sctp_addr_id2transport(sk, &params.spp_address,
 				       params.spp_assoc_id);
 	if (!trans)
@@ -2864,6 +2890,17 @@
 	if (copy_from_user(&params, optval, len))
 		return -EFAULT;
 
+	/* If no association id is specified retrieve the default value
+	 * for the endpoint that will be used for all future associations
+	 */
+	if (!params.spp_assoc_id &&
+	    sctp_is_any(( union sctp_addr *)&params.spp_address)) {
+		params.spp_hbinterval = sctp_sk(sk)->paddrparam.spp_hbinterval;
+		params.spp_pathmaxrxt = sctp_sk(sk)->paddrparam.spp_pathmaxrxt;
+
+		goto done;
+	}
+
 	trans = sctp_addr_id2transport(sk, &params.spp_address,
 				       params.spp_assoc_id);
 	if (!trans)
@@ -2883,6 +2920,7 @@
 	 */
 	params.spp_pathmaxrxt = trans->error_threshold;
 
+done:
 	if (copy_to_user(optval, &params, len))
 		return -EFAULT;
 
diff -urN linux-2.6.8-rc2/net/sctp/ulpqueue.c linux-2.6.8-rc3/net/sctp/ulpqueue.c
--- linux-2.6.8-rc2/net/sctp/ulpqueue.c	2004-08-03 15:21:18.022959297 -0700
+++ linux-2.6.8-rc3/net/sctp/ulpqueue.c	2004-08-03 15:22:19.824494551 -0700
@@ -334,7 +334,7 @@
 	};
 
 	event = sctp_skb2event(f_frag);
-	SCTP_INC_STATS(SctpReasmUsrMsgs);
+	SCTP_INC_STATS(SCTP_MIB_REASMUSRMSGS);
 
 	return event;
 }
diff -urN linux-2.6.8-rc2/net/sunrpc/xprt.c linux-2.6.8-rc3/net/sunrpc/xprt.c
--- linux-2.6.8-rc2/net/sunrpc/xprt.c	2004-08-03 15:21:18.356972999 -0700
+++ linux-2.6.8-rc3/net/sunrpc/xprt.c	2004-08-03 15:22:20.106506119 -0700
@@ -1296,21 +1296,6 @@
 /*
  * Reserve an RPC call slot.
  */
-void
-xprt_reserve(struct rpc_task *task)
-{
-	struct rpc_xprt	*xprt = task->tk_xprt;
-
-	task->tk_status = -EIO;
-	if (!xprt->shutdown) {
-		spin_lock(&xprt->xprt_lock);
-		do_xprt_reserve(task);
-		spin_unlock(&xprt->xprt_lock);
-		if (task->tk_rqstp)
-			del_timer_sync(&xprt->timer);
-	}
-}
-
 static inline void
 do_xprt_reserve(struct rpc_task *task)
 {
@@ -1332,6 +1317,21 @@
 	rpc_sleep_on(&xprt->backlog, task, NULL, NULL);
 }
 
+void
+xprt_reserve(struct rpc_task *task)
+{
+	struct rpc_xprt	*xprt = task->tk_xprt;
+
+	task->tk_status = -EIO;
+	if (!xprt->shutdown) {
+		spin_lock(&xprt->xprt_lock);
+		do_xprt_reserve(task);
+		spin_unlock(&xprt->xprt_lock);
+		if (task->tk_rqstp)
+			del_timer_sync(&xprt->timer);
+	}
+}
+
 /*
  * Allocate a 'unique' XID
  */
diff -urN linux-2.6.8-rc2/net/xfrm/xfrm_export.c linux-2.6.8-rc3/net/xfrm/xfrm_export.c
--- linux-2.6.8-rc2/net/xfrm/xfrm_export.c	2004-08-03 15:21:18.470977676 -0700
+++ linux-2.6.8-rc3/net/xfrm/xfrm_export.c	2004-08-03 15:22:20.156508171 -0700
@@ -35,7 +35,6 @@
 EXPORT_SYMBOL(xfrm4_rcv);
 EXPORT_SYMBOL(xfrm4_tunnel_register);
 EXPORT_SYMBOL(xfrm4_tunnel_deregister);
-EXPORT_SYMBOL(xfrm4_tunnel_check_size);
 EXPORT_SYMBOL(xfrm_register_type);
 EXPORT_SYMBOL(xfrm_unregister_type);
 EXPORT_SYMBOL(xfrm_get_type);
diff -urN linux-2.6.8-rc2/net/xfrm/xfrm_policy.c linux-2.6.8-rc3/net/xfrm/xfrm_policy.c
--- linux-2.6.8-rc2/net/xfrm/xfrm_policy.c	2004-06-15 22:19:23.000000000 -0700
+++ linux-2.6.8-rc3/net/xfrm/xfrm_policy.c	2004-08-03 15:22:20.175508950 -0700
@@ -204,6 +204,7 @@
 	return;
 
 expired:
+	read_unlock(&xp->lock);
 	km_policy_expired(xp, dir, 1);
 	xfrm_policy_delete(xp, dir);
 	xfrm_pol_put(xp);
diff -urN linux-2.6.8-rc2/net/xfrm/xfrm_state.c linux-2.6.8-rc3/net/xfrm/xfrm_state.c
--- linux-2.6.8-rc2/net/xfrm/xfrm_state.c	2004-08-03 15:21:18.472977758 -0700
+++ linux-2.6.8-rc3/net/xfrm/xfrm_state.c	2004-08-03 15:22:20.176508991 -0700
@@ -65,7 +65,6 @@
 		xfrm_put_type(x->type);
 	}
 	kfree(x);
-	wake_up(&km_waitq);
 }
 
 static void xfrm_state_gc_task(void *data)
@@ -82,6 +81,7 @@
 		x = list_entry(entry, struct xfrm_state, bydst);
 		xfrm_state_gc_destroy(x);
 	}
+	wake_up(&km_waitq);
 }
 
 static inline unsigned long make_jiffies(long secs)
@@ -400,23 +400,17 @@
 	spin_lock_bh(&xfrm_state_lock);
 
 	x1 = afinfo->state_lookup(&x->id.daddr, x->id.spi, x->id.proto);
-	if (!x1) {
-		x1 = afinfo->find_acq(
-			x->props.mode, x->props.reqid, x->id.proto,
-			&x->id.daddr, &x->props.saddr, 0);
-		if (x1 && x1->id.spi != x->id.spi && x1->id.spi) {
-			xfrm_state_put(x1);
-			x1 = NULL;
-		}
-	}
-
-	if (x1 && x1->id.spi) {
+	if (x1) {
 		xfrm_state_put(x1);
 		x1 = NULL;
 		err = -EEXIST;
 		goto out;
 	}
 
+	x1 = afinfo->find_acq(
+		x->props.mode, x->props.reqid, x->id.proto,
+		&x->id.daddr, &x->props.saddr, 0);
+
 	__xfrm_state_insert(x);
 	err = 0;
 
@@ -630,11 +624,12 @@
 		for (h=0; h<maxspi-minspi+1; h++) {
 			spi = minspi + net_random()%(maxspi-minspi+1);
 			x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
-			if (x0 == NULL)
+			if (x0 == NULL) {
+				x->id.spi = htonl(spi);
 				break;
+			}
 			xfrm_state_put(x0);
 		}
-		x->id.spi = htonl(spi);
 	}
 	if (x->id.spi) {
 		spin_lock_bh(&xfrm_state_lock);
diff -urN linux-2.6.8-rc2/net/xfrm/xfrm_user.c linux-2.6.8-rc3/net/xfrm/xfrm_user.c
--- linux-2.6.8-rc2/net/xfrm/xfrm_user.c	2004-08-03 15:21:18.474977840 -0700
+++ linux-2.6.8-rc3/net/xfrm/xfrm_user.c	2004-08-03 15:22:20.177509032 -0700
@@ -267,6 +267,8 @@
 	if (err)
 		return err;
 
+	xfrm_probe_algs();
+
 	x = xfrm_state_construct(p, (struct rtattr **) xfrma, &err);
 	if (!x)
 		return err;
diff -urN linux-2.6.8-rc2/scripts/Makefile linux-2.6.8-rc3/scripts/Makefile
--- linux-2.6.8-rc2/scripts/Makefile	2004-08-03 15:21:18.500978907 -0700
+++ linux-2.6.8-rc3/scripts/Makefile	2004-08-03 15:22:20.177509032 -0700
@@ -5,24 +5,11 @@
 # docproc: 	 Preprocess .tmpl file in order to generate .sgml docs
 # conmakehash:	 Create arrays for initializing the kernel console tables
 
-host-progs	:= conmakehash kallsyms modpost mk_elfconfig pnmtologo bin2c
-always		:= $(host-progs) empty.o
-
-modpost-objs	:= modpost.o file2alias.o sumversion.o
+host-progs	:= conmakehash kallsyms pnmtologo bin2c
+always		:= $(host-progs)
 
 subdir-$(CONFIG_MODVERSIONS)	+= genksyms
+subdir-y	+= mod
 
 # Let clean descend into subdirs
 subdir-	+= basic lxdialog kconfig package
-
-# dependencies on generated files need to be listed explicitly
-
-$(obj)/modpost.o $(obj)/file2alias.o $(obj)/sumversion.o: $(obj)/elfconfig.h
-
-quiet_cmd_elfconfig = MKELF   $@
-      cmd_elfconfig = $(obj)/mk_elfconfig $(ARCH) < $< > $@
-
-$(obj)/elfconfig.h: $(obj)/empty.o $(obj)/mk_elfconfig FORCE
-	$(call if_changed,elfconfig)
-
-targets += elfconfig.h
diff -urN linux-2.6.8-rc2/scripts/Makefile.modpost linux-2.6.8-rc3/scripts/Makefile.modpost
--- linux-2.6.8-rc2/scripts/Makefile.modpost	2004-08-03 15:21:18.513979440 -0700
+++ linux-2.6.8-rc3/scripts/Makefile.modpost	2004-08-03 15:22:20.178509073 -0700
@@ -50,7 +50,7 @@
 # Step 2), invoke modpost
 #  Includes step 3,4
 quiet_cmd_modpost = MODPOST
-      cmd_modpost = scripts/modpost \
+      cmd_modpost = scripts/mod/modpost \
 	$(if $(KBUILD_EXTMOD),-i,-o) $(symverfile) \
 	$(filter-out FORCE,$^)
 
diff -urN linux-2.6.8-rc2/scripts/empty.c linux-2.6.8-rc3/scripts/empty.c
--- linux-2.6.8-rc2/scripts/empty.c	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/scripts/empty.c	1969-12-31 16:00:00.000000000 -0800
@@ -1 +0,0 @@
-/* empty file to figure out endianness / word size */
diff -urN linux-2.6.8-rc2/scripts/file2alias.c linux-2.6.8-rc3/scripts/file2alias.c
--- linux-2.6.8-rc2/scripts/file2alias.c	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/scripts/file2alias.c	1969-12-31 16:00:00.000000000 -0800
@@ -1,282 +0,0 @@
-/* Simple code to turn various tables in an ELF file into alias definitions.
- * This deals with kernel datastructures where they should be
- * dealt with: in the kernel source.
- *
- * Copyright 2002-2003  Rusty Russell, IBM Corporation
- *           2003       Kai Germaschewski
- *           
- *
- * This software may be used and distributed according to the terms
- * of the GNU General Public License, incorporated herein by reference.
- */
-
-#include "modpost.h"
-
-/* We use the ELF typedefs, since we can't rely on stdint.h being present. */
-
-#if KERNEL_ELFCLASS == ELFCLASS32
-typedef Elf32_Addr     kernel_ulong_t;
-#else
-typedef Elf64_Addr     kernel_ulong_t;
-#endif
-
-typedef Elf32_Word     __u32;
-typedef Elf32_Half     __u16;
-typedef unsigned char  __u8;
-
-/* Big exception to the "don't include kernel headers into userspace, which
- * even potentially has different endianness and word sizes, since 
- * we handle those differences explicitly below */
-#include "../include/linux/mod_devicetable.h"
-
-#define ADD(str, sep, cond, field)                              \
-do {                                                            \
-        strcat(str, sep);                                       \
-        if (cond)                                               \
-                sprintf(str + strlen(str),                      \
-                        sizeof(field) == 1 ? "%02X" :           \
-                        sizeof(field) == 2 ? "%04X" :           \
-                        sizeof(field) == 4 ? "%08X" : "",       \
-                        field);                                 \
-        else                                                    \
-                sprintf(str + strlen(str), "*");                \
-} while(0)
-
-/* Looks like "usb:vNpNdlNdhNdcNdscNdpNicNiscNipN" */
-static int do_usb_entry(const char *filename,
-			struct usb_device_id *id, char *alias)
-{
-	id->match_flags = TO_NATIVE(id->match_flags);
-	id->idVendor = TO_NATIVE(id->idVendor);
-	id->idProduct = TO_NATIVE(id->idProduct);
-	id->bcdDevice_lo = TO_NATIVE(id->bcdDevice_lo);
-	id->bcdDevice_hi = TO_NATIVE(id->bcdDevice_hi);
-
-	/*
-	 * Some modules (visor) have empty slots as placeholder for
-	 * run-time specification that results in catch-all alias
-	 */
-	if (!(id->idVendor | id->bDeviceClass | id->bInterfaceClass))
-		return 1;
-
-	strcpy(alias, "usb:");
-	ADD(alias, "v", id->match_flags&USB_DEVICE_ID_MATCH_VENDOR,
-	    id->idVendor);
-	ADD(alias, "p", id->match_flags&USB_DEVICE_ID_MATCH_PRODUCT,
-	    id->idProduct);
-	ADD(alias, "dl", id->match_flags&USB_DEVICE_ID_MATCH_DEV_LO,
-	    id->bcdDevice_lo);
-	ADD(alias, "dh", id->match_flags&USB_DEVICE_ID_MATCH_DEV_HI,
-	    id->bcdDevice_hi);
-	ADD(alias, "dc", id->match_flags&USB_DEVICE_ID_MATCH_DEV_CLASS,
-	    id->bDeviceClass);
-	ADD(alias, "dsc",
-	    id->match_flags&USB_DEVICE_ID_MATCH_DEV_SUBCLASS,
-	    id->bDeviceSubClass);
-	ADD(alias, "dp",
-	    id->match_flags&USB_DEVICE_ID_MATCH_DEV_PROTOCOL,
-	    id->bDeviceProtocol);
-	ADD(alias, "ic",
-	    id->match_flags&USB_DEVICE_ID_MATCH_INT_CLASS,
-	    id->bInterfaceClass);
-	ADD(alias, "isc",
-	    id->match_flags&USB_DEVICE_ID_MATCH_INT_SUBCLASS,
-	    id->bInterfaceSubClass);
-	ADD(alias, "ip",
-	    id->match_flags&USB_DEVICE_ID_MATCH_INT_PROTOCOL,
-	    id->bInterfaceProtocol);
-	return 1;
-}
-
-/* Looks like: ieee1394:venNmoNspNverN */
-static int do_ieee1394_entry(const char *filename,
-			     struct ieee1394_device_id *id, char *alias)
-{
-	id->match_flags = TO_NATIVE(id->match_flags);
-	id->vendor_id = TO_NATIVE(id->vendor_id);
-	id->model_id = TO_NATIVE(id->model_id);
-	id->specifier_id = TO_NATIVE(id->specifier_id);
-	id->version = TO_NATIVE(id->version);
-
-	strcpy(alias, "ieee1394:");
-	ADD(alias, "ven", id->match_flags & IEEE1394_MATCH_VENDOR_ID,
-	    id->vendor_id);
-	ADD(alias, "mo", id->match_flags & IEEE1394_MATCH_MODEL_ID,
-	    id->model_id);
-	ADD(alias, "sp", id->match_flags & IEEE1394_MATCH_SPECIFIER_ID,
-	    id->specifier_id);
-	ADD(alias, "ver", id->match_flags & IEEE1394_MATCH_VERSION,
-	    id->version);
-
-	return 1;
-}
-
-/* Looks like: pci:vNdNsvNsdNbcNscNiN. */
-static int do_pci_entry(const char *filename,
-			struct pci_device_id *id, char *alias)
-{
-	/* Class field can be divided into these three. */
-	unsigned char baseclass, subclass, interface,
-		baseclass_mask, subclass_mask, interface_mask;
-
-	id->vendor = TO_NATIVE(id->vendor);
-	id->device = TO_NATIVE(id->device);
-	id->subvendor = TO_NATIVE(id->subvendor);
-	id->subdevice = TO_NATIVE(id->subdevice);
-	id->class = TO_NATIVE(id->class);
-	id->class_mask = TO_NATIVE(id->class_mask);
-
-	strcpy(alias, "pci:");
-	ADD(alias, "v", id->vendor != PCI_ANY_ID, id->vendor);
-	ADD(alias, "d", id->device != PCI_ANY_ID, id->device);
-	ADD(alias, "sv", id->subvendor != PCI_ANY_ID, id->subvendor);
-	ADD(alias, "sd", id->subdevice != PCI_ANY_ID, id->subdevice);
-
-	baseclass = (id->class) >> 16;
-	baseclass_mask = (id->class_mask) >> 16;
-	subclass = (id->class) >> 8;
-	subclass_mask = (id->class_mask) >> 8;
-	interface = id->class;
-	interface_mask = id->class_mask;
-
-	if ((baseclass_mask != 0 && baseclass_mask != 0xFF)
-	    || (subclass_mask != 0 && subclass_mask != 0xFF)
-	    || (interface_mask != 0 && interface_mask != 0xFF)) {
-		fprintf(stderr,
-			"*** Warning: Can't handle masks in %s:%04X\n",
-			filename, id->class_mask);
-		return 0;
-	}
-
-	ADD(alias, "bc", baseclass_mask == 0xFF, baseclass);
-	ADD(alias, "sc", subclass_mask == 0xFF, subclass);
-	ADD(alias, "i", interface_mask == 0xFF, interface);
-	return 1;
-}
-
-/* looks like: "ccw:tNmNdtNdmN" */ 
-static int do_ccw_entry(const char *filename,
-			struct ccw_device_id *id, char *alias)
-{
-	id->match_flags = TO_NATIVE(id->match_flags);
-	id->cu_type = TO_NATIVE(id->cu_type);
-	id->cu_model = TO_NATIVE(id->cu_model);
-	id->dev_type = TO_NATIVE(id->dev_type);
-	id->dev_model = TO_NATIVE(id->dev_model);
-
-	strcpy(alias, "ccw:");
-	ADD(alias, "t", id->match_flags&CCW_DEVICE_ID_MATCH_CU_TYPE,
-	    id->cu_type);
-	ADD(alias, "m", id->match_flags&CCW_DEVICE_ID_MATCH_CU_MODEL,
-	    id->cu_model);
-	ADD(alias, "dt", id->match_flags&CCW_DEVICE_ID_MATCH_DEVICE_TYPE,
-	    id->dev_type);
-	ADD(alias, "dm", id->match_flags&CCW_DEVICE_ID_MATCH_DEVICE_TYPE,
-	    id->dev_model);
-	return 1;
-}
-
-/* looks like: "pnp:dD" */
-static int do_pnp_entry(const char *filename,
-			struct pnp_device_id *id, char *alias)
-{
-	sprintf(alias, "pnp:d%s", id->id);
-	return 1;
-}
-
-/* looks like: "pnp:cCdD..." */
-static int do_pnp_card_entry(const char *filename,
-			struct pnp_card_device_id *id, char *alias)
-{
-	int i;
-
-	sprintf(alias, "pnp:c%s", id->id);
-	for (i = 0; i < PNP_MAX_DEVICES; i++) {
-		if (! *id->devs[i].id)
-			break;
-		sprintf(alias + strlen(alias), "d%s", id->devs[i].id);
-	}
-	return 1;
-}
-
-/* Ignore any prefix, eg. v850 prepends _ */
-static inline int sym_is(const char *symbol, const char *name)
-{
-	const char *match;
-
-	match = strstr(symbol, name);
-	if (!match)
-		return 0;
-	return match[strlen(symbol)] == '\0';
-}
-
-static void do_table(void *symval, unsigned long size,
-		     unsigned long id_size,
-		     void *function,
-		     struct module *mod)
-{
-	unsigned int i;
-	char alias[500];
-	int (*do_entry)(const char *, void *entry, char *alias) = function;
-
-	if (size % id_size || size < id_size) {
-		fprintf(stderr, "*** Warning: %s ids %lu bad size "
-			"(each on %lu)\n", mod->name, size, id_size);
-	}
-	/* Leave last one: it's the terminator. */
-	size -= id_size;
-
-	for (i = 0; i < size; i += id_size) {
-		if (do_entry(mod->name, symval+i, alias)) {
-			/* Always end in a wildcard, for future extension */
-			if (alias[strlen(alias)-1] != '*')
-				strcat(alias, "*");
-			buf_printf(&mod->dev_table_buf,
-				   "MODULE_ALIAS(\"%s\");\n", alias);
-		}
-	}
-}
-
-/* Create MODULE_ALIAS() statements.
- * At this time, we cannot write the actual output C source yet,
- * so we write into the mod->dev_table_buf buffer. */
-void handle_moddevtable(struct module *mod, struct elf_info *info,
-			Elf_Sym *sym, const char *symname)
-{
-	void *symval;
-
-	/* We're looking for a section relative symbol */
-	if (!sym->st_shndx || sym->st_shndx >= info->hdr->e_shnum)
-		return;
-
-	symval = (void *)info->hdr
-		+ info->sechdrs[sym->st_shndx].sh_offset
-		+ sym->st_value;
-
-	if (sym_is(symname, "__mod_pci_device_table"))
-		do_table(symval, sym->st_size, sizeof(struct pci_device_id),
-			 do_pci_entry, mod);
-	else if (sym_is(symname, "__mod_usb_device_table"))
-		do_table(symval, sym->st_size, sizeof(struct usb_device_id),
-			 do_usb_entry, mod);
-	else if (sym_is(symname, "__mod_ieee1394_device_table"))
-		do_table(symval, sym->st_size, sizeof(struct ieee1394_device_id),
-			 do_ieee1394_entry, mod);
-	else if (sym_is(symname, "__mod_ccw_device_table"))
-		do_table(symval, sym->st_size, sizeof(struct ccw_device_id),
-			 do_ccw_entry, mod);
-	else if (sym_is(symname, "__mod_pnp_device_table"))
-		do_table(symval, sym->st_size, sizeof(struct pnp_device_id),
-			 do_pnp_entry, mod);
-	else if (sym_is(symname, "__mod_pnp_card_device_table"))
-		do_table(symval, sym->st_size, sizeof(struct pnp_card_device_id),
-			 do_pnp_card_entry, mod);
-}
-
-/* Now add out buffered information to the generated C source */
-void add_moddevtable(struct buffer *buf, struct module *mod)
-{
-	buf_printf(buf, "\n");
-	buf_write(buf, mod->dev_table_buf.p, mod->dev_table_buf.pos);
-	free(mod->dev_table_buf.p);
-}
diff -urN linux-2.6.8-rc2/scripts/genksyms/parse.c_shipped linux-2.6.8-rc3/scripts/genksyms/parse.c_shipped
--- linux-2.6.8-rc2/scripts/genksyms/parse.c_shipped	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/scripts/genksyms/parse.c_shipped	2004-08-03 15:22:20.262512519 -0700
@@ -156,7 +156,7 @@
     71,    94,    92,    82,     0,     0,    62,     0,    63,     0,
     62,    63,     0,    64,     0,    65,     0,     5,     0,    16,
      0,    20,     0,    11,     0,    13,     0,    66,     0,    70,
-     0,    27,    46,    65,    47,     0,    21,    36,     0,    23,
+     0,    27,    46,    62,    47,     0,    21,    36,     0,    23,
     36,     0,    10,    36,     0,    21,    36,    84,     0,    23,
     36,    84,     0,    10,    36,    31,     0,    10,    31,     0,
     21,    84,     0,    23,    84,     0,     7,     0,    18,     0,
@@ -291,142 +291,150 @@
 };
 
 static const short yypact[] = {-32768,
-    19,-32768,   175,-32768,    32,-32768,-32768,-32768,-32768,-32768,
+    15,-32768,   197,-32768,    23,-32768,-32768,-32768,-32768,-32768,
    -18,-32768,-32768,-32768,-32768,-32768,-32768,-32768,-32768,-32768,
--32768,   -30,-32768,   -26,-32768,-32768,-32768,   -32,   -10,    -2,
--32768,-32768,-32768,-32768,     2,   428,-32768,-32768,-32768,-32768,
--32768,-32768,-32768,-32768,-32768,-32768,-32768,    34,    12,    79,
--32768,   428,    12,-32768,   455,    33,-32768,-32768,    15,    14,
-    35,    29,-32768,     2,   -14,   -21,-32768,-32768,-32768,    67,
-    31,    37,   127,-32768,-32768,     2,-32768,    54,    60,    66,
-    69,-32768,    14,-32768,-32768,     2,-32768,-32768,-32768,    84,
--32768,   219,-32768,-32768,    70,-32768,    20,    91,    72,    84,
-   -20,    74,    81,-32768,-32768,-32768,    86,-32768,   102,-32768,
-   106,-32768,-32768,-32768,-32768,-32768,   109,   108,   348,   112,
-   126,   117,-32768,-32768,   118,-32768,   122,-32768,-32768,-32768,
--32768,   262,-32768,    31,-32768,   131,-32768,-32768,-32768,-32768,
--32768,     7,   120,-32768,    -9,-32768,-32768,   392,-32768,-32768,
-   125,   130,-32768,-32768,   132,-32768,   159,-32768,-32768,   305,
--32768,-32768,-32768,-32768,-32768,-32768,   160,   161,-32768,-32768,
-   174,-32768
+-32768,   -28,-32768,   -25,-32768,-32768,-32768,   -26,   -22,   -12,
+-32768,-32768,-32768,-32768,    49,   493,-32768,-32768,-32768,-32768,
+-32768,-32768,-32768,-32768,-32768,-32768,-32768,    27,    -8,   101,
+-32768,   493,    -8,-32768,   493,    10,-32768,-32768,    11,     9,
+    18,    26,-32768,    49,   -15,   -13,-32768,-32768,-32768,    25,
+    24,    48,   149,-32768,-32768,    49,-32768,   414,    39,    40,
+    47,-32768,     9,-32768,-32768,    49,-32768,-32768,-32768,    66,
+-32768,   241,-32768,-32768,    50,-32768,     5,    65,    42,    66,
+    17,    56,    55,-32768,-32768,-32768,    60,-32768,    75,-32768,
+    80,-32768,-32768,-32768,-32768,-32768,    81,    82,   370,    85,
+    98,    89,-32768,-32768,    88,-32768,    91,-32768,-32768,-32768,
+-32768,   284,-32768,    24,-32768,   103,-32768,-32768,-32768,-32768,
+-32768,     8,    43,-32768,    30,-32768,-32768,   457,-32768,-32768,
+    92,    93,-32768,-32768,    95,-32768,    96,-32768,-32768,   327,
+-32768,-32768,-32768,-32768,-32768,-32768,    99,   104,-32768,-32768,
+   148,-32768
 };
 
 static const short yypgoto[] = {-32768,
-   208,-32768,-32768,-32768,   158,-32768,-32768,   128,     0,   -90,
-   -36,-32768,   157,-32768,   -70,-32768,-32768,   -51,   -31,-32768,
-   -40,-32768,  -125,-32768,-32768,    65,   -97,-32768,-32768,-32768,
--32768,   -19,-32768,-32768,   143,-32768,-32768,    83,   124,   141,
+   152,-32768,-32768,-32768,   119,-32768,-32768,    94,     0,   -55,
+   -35,-32768,-32768,-32768,   -69,-32768,-32768,   -56,   -30,-32768,
+   -76,-32768,  -122,-32768,-32768,    29,   -62,-32768,-32768,-32768,
+-32768,   -17,-32768,-32768,   105,-32768,-32768,    52,    86,    83,
 -32768,-32768,-32768
 };
 
 
-#define	YYLAST		495
+#define	YYLAST		533
 
 
-static const short yytable[] = {    67,
-    99,   119,    35,    65,    54,    49,   152,   155,    84,    53,
-    91,   131,    47,    55,    88,    80,    89,    48,   171,    50,
-   125,     9,   159,    50,    92,   132,    99,    81,    99,    69,
-    18,   114,    87,    77,   168,    56,   160,    58,   -89,    27,
-    57,   119,   140,    31,   157,   158,   156,    59,   143,    60,
-    58,    76,   142,   -89,    60,   126,   127,   119,   129,    96,
-    59,    50,    60,    99,    68,    97,    95,    60,    79,   119,
-    96,   143,   143,    86,    45,    46,    97,    85,    60,    70,
-   106,    98,    67,     6,     7,     8,     9,    10,    11,    12,
+static const short yytable[] = {    78,
+    67,    99,    35,    84,    65,   125,    54,    49,   155,   152,
+    53,    80,    47,    88,   171,    89,     9,    48,    91,    55,
+   127,    50,   129,    56,    50,    18,   114,    99,    81,    99,
+    57,    69,    92,    87,    27,    77,   119,   168,    31,   -89,
+   126,    50,    67,   140,    96,    79,    58,   156,   131,   143,
+    97,    76,    60,   142,   -89,    60,    59,    68,    60,    95,
+    85,   159,   132,    96,    99,    45,    46,    93,    94,    97,
+    86,    60,   143,   143,    98,   160,   119,   126,   140,   157,
+   158,    96,   156,    67,    58,   111,   112,    97,   142,    60,
+    60,   106,   119,   113,    59,   116,    60,   128,   133,   134,
+    98,    70,    93,    88,   119,     6,     7,     8,     9,    10,
+    11,    12,    13,    14,    15,    16,    17,    18,    19,    20,
+    21,    22,   135,    24,    25,    26,    27,    28,   139,   136,
+    31,   146,   147,   148,   149,   154,   -19,   150,   163,   164,
+    32,   165,   166,   -19,  -103,   169,   -19,   172,   -19,   107,
+   170,   -19,     4,     6,     7,     8,     9,    10,    11,    12,
     13,    14,    15,    16,    17,    18,    19,    20,    21,    22,
-   110,    24,    25,    26,    27,    28,   111,   126,    31,    93,
-    94,    96,   112,   116,   -19,   113,   133,    97,    32,    60,
-    98,   -19,  -103,   128,   -19,   134,   -19,   107,    93,   -19,
-    88,     6,     7,     8,     9,    10,    11,    12,    13,    14,
-    15,    16,    17,    18,    19,    20,    21,    22,   135,    24,
-    25,    26,    27,    28,   139,   140,    31,   136,   146,   156,
-   147,   148,   -19,   154,   149,   142,    32,    60,   150,   -19,
-  -104,   163,   -19,   172,   -19,     5,   164,   -19,   165,     6,
-     7,     8,     9,    10,    11,    12,    13,    14,    15,    16,
-    17,    18,    19,    20,    21,    22,    23,    24,    25,    26,
-    27,    28,    29,    30,    31,   166,   169,   170,     4,    75,
-   -19,    78,   162,   115,    32,   108,   153,   -19,   124,   118,
-   -19,     0,   -19,     6,     7,     8,     9,    10,    11,    12,
-    13,    14,    15,    16,    17,    18,    19,    20,    21,    22,
-   130,    24,    25,    26,    27,    28,     0,     0,    31,     0,
-     0,     0,     0,   -82,     0,     0,     0,     0,    32,     0,
-     0,     0,   151,     0,     0,   -82,     6,     7,     8,     9,
-    10,    11,    12,    13,    14,    15,    16,    17,    18,    19,
-    20,    21,    22,     0,    24,    25,    26,    27,    28,     0,
-     0,    31,     0,     0,     0,     0,   -82,     0,     0,     0,
-     0,    32,     0,     0,     0,   167,     0,     0,   -82,     6,
-     7,     8,     9,    10,    11,    12,    13,    14,    15,    16,
-    17,    18,    19,    20,    21,    22,     0,    24,    25,    26,
-    27,    28,     0,     0,    31,     0,     0,     0,     0,   -82,
-     0,     0,     0,     0,    32,     0,     0,     0,     0,     0,
-     0,   -82,     6,     7,     8,     9,    10,    11,    12,    13,
-    14,    15,    16,    17,    18,    19,    20,    21,    22,     0,
-    24,    25,    26,    27,    28,     0,     0,    31,     0,     0,
-     0,     0,     0,   140,     0,     0,     0,   141,     0,     0,
-     0,     0,     0,   142,     0,    60,     6,     7,     8,     9,
-    10,    11,    12,    13,    14,    15,    16,    17,    18,    19,
-    20,    21,    22,     0,    24,    25,    26,    27,    28,     0,
-     0,    31,     0,     0,     0,     0,   161,     0,     0,     0,
-     0,    32,     6,     7,     8,     9,    10,    11,    12,    13,
-    14,    15,    16,    17,    18,    19,    20,    21,    22,     0,
-    24,    25,    26,    27,    28,     0,     0,    31,     0,     0,
-     7,     8,     9,    10,    11,     0,    13,    32,    15,    16,
-     0,    18,    19,    20,     0,    22,     0,    24,    25,    26,
-    27,    28,     0,     0,    31,     0,     0,     0,     0,     0,
-     0,     0,     0,     0,    32
+    75,    24,    25,    26,    27,    28,   162,   108,    31,   115,
+   124,     0,   130,     0,   -19,   153,     0,     0,    32,     0,
+     0,   -19,  -104,     0,   -19,     0,   -19,     5,     0,   -19,
+     0,     6,     7,     8,     9,    10,    11,    12,    13,    14,
+    15,    16,    17,    18,    19,    20,    21,    22,    23,    24,
+    25,    26,    27,    28,    29,    30,    31,     0,     0,     0,
+     0,     0,   -19,     0,     0,     0,    32,     0,     0,   -19,
+     0,   118,   -19,     0,   -19,     6,     7,     8,     9,    10,
+    11,    12,    13,    14,    15,    16,    17,    18,    19,    20,
+    21,    22,     0,    24,    25,    26,    27,    28,     0,     0,
+    31,     0,     0,     0,     0,   -82,     0,     0,     0,     0,
+    32,     0,     0,     0,   151,     0,     0,   -82,     6,     7,
+     8,     9,    10,    11,    12,    13,    14,    15,    16,    17,
+    18,    19,    20,    21,    22,     0,    24,    25,    26,    27,
+    28,     0,     0,    31,     0,     0,     0,     0,   -82,     0,
+     0,     0,     0,    32,     0,     0,     0,   167,     0,     0,
+   -82,     6,     7,     8,     9,    10,    11,    12,    13,    14,
+    15,    16,    17,    18,    19,    20,    21,    22,     0,    24,
+    25,    26,    27,    28,     0,     0,    31,     0,     0,     0,
+     0,   -82,     0,     0,     0,     0,    32,     0,     0,     0,
+     0,     0,     0,   -82,     6,     7,     8,     9,    10,    11,
+    12,    13,    14,    15,    16,    17,    18,    19,    20,    21,
+    22,     0,    24,    25,    26,    27,    28,     0,     0,    31,
+     0,     0,     0,     0,     0,   140,     0,     0,     0,   141,
+     0,     0,     0,     0,     0,   142,     0,    60,     6,     7,
+     8,     9,    10,    11,    12,    13,    14,    15,    16,    17,
+    18,    19,    20,    21,    22,     0,    24,    25,    26,    27,
+    28,     0,     0,    31,     0,     0,     0,     0,     0,     0,
+     0,     0,     0,    32,     0,     0,     0,     0,     0,     0,
+   110,     6,     7,     8,     9,    10,    11,    12,    13,    14,
+    15,    16,    17,    18,    19,    20,    21,    22,     0,    24,
+    25,    26,    27,    28,     0,     0,    31,     0,     0,     0,
+     0,   161,     0,     0,     0,     0,    32,     6,     7,     8,
+     9,    10,    11,    12,    13,    14,    15,    16,    17,    18,
+    19,    20,    21,    22,     0,    24,    25,    26,    27,    28,
+     0,     0,    31,     0,     0,     0,     0,     0,     0,     0,
+     0,     0,    32
 };
 
-static const short yycheck[] = {    36,
-    71,    92,     3,    35,    24,    36,   132,     1,    60,    36,
-    32,    32,    31,    46,    29,     1,    31,    36,     0,    50,
-     1,     8,    32,    50,    46,    46,    97,    59,    99,    49,
-    17,    83,    64,    53,   160,    46,    46,    36,    32,    26,
-    43,   132,    36,    30,   142,   143,    40,    46,   119,    48,
-    36,    52,    46,    47,    48,    36,    97,   148,    99,    40,
-    46,    50,    48,   134,    31,    46,    36,    48,    36,   160,
-    40,   142,   143,    45,    43,    44,    46,    43,    48,     1,
-    44,    51,   119,     5,     6,     7,     8,     9,    10,    11,
-    12,    13,    14,    15,    16,    17,    18,    19,    20,    21,
-    47,    23,    24,    25,    26,    27,    47,    36,    30,    43,
-    44,    40,    47,    30,    36,    47,    43,    46,    40,    48,
-    51,    43,    44,    33,    46,    45,    48,     1,    43,    51,
-    29,     5,     6,     7,     8,     9,    10,    11,    12,    13,
-    14,    15,    16,    17,    18,    19,    20,    21,    43,    23,
-    24,    25,    26,    27,    47,    36,    30,    49,    47,    40,
-    35,    45,    36,    33,    47,    46,    40,    48,    47,    43,
-    44,    47,    46,     0,    48,     1,    47,    51,    47,     5,
-     6,     7,     8,     9,    10,    11,    12,    13,    14,    15,
-    16,    17,    18,    19,    20,    21,    22,    23,    24,    25,
-    26,    27,    28,    29,    30,    47,    47,    47,     1,    52,
-    36,    55,   148,    86,    40,    73,   134,    43,    95,     1,
-    46,    -1,    48,     5,     6,     7,     8,     9,    10,    11,
+static const short yycheck[] = {    55,
+    36,    71,     3,    60,    35,     1,    24,    36,     1,   132,
+    36,     1,    31,    29,     0,    31,     8,    36,    32,    46,
+    97,    50,    99,    46,    50,    17,    83,    97,    59,    99,
+    43,    49,    46,    64,    26,    53,    92,   160,    30,    32,
+    36,    50,    78,    36,    40,    36,    36,    40,    32,   119,
+    46,    52,    48,    46,    47,    48,    46,    31,    48,    36,
+    43,    32,    46,    40,   134,    43,    44,    43,    44,    46,
+    45,    48,   142,   143,    51,    46,   132,    36,    36,   142,
+   143,    40,    40,   119,    36,    47,    47,    46,    46,    48,
+    48,    44,   148,    47,    46,    30,    48,    33,    43,    45,
+    51,     1,    43,    29,   160,     5,     6,     7,     8,     9,
+    10,    11,    12,    13,    14,    15,    16,    17,    18,    19,
+    20,    21,    43,    23,    24,    25,    26,    27,    47,    49,
+    30,    47,    35,    45,    47,    33,    36,    47,    47,    47,
+    40,    47,    47,    43,    44,    47,    46,     0,    48,     1,
+    47,    51,     1,     5,     6,     7,     8,     9,    10,    11,
     12,    13,    14,    15,    16,    17,    18,    19,    20,    21,
-   100,    23,    24,    25,    26,    27,    -1,    -1,    30,    -1,
-    -1,    -1,    -1,    35,    -1,    -1,    -1,    -1,    40,    -1,
-    -1,    -1,     1,    -1,    -1,    47,     5,     6,     7,     8,
-     9,    10,    11,    12,    13,    14,    15,    16,    17,    18,
-    19,    20,    21,    -1,    23,    24,    25,    26,    27,    -1,
-    -1,    30,    -1,    -1,    -1,    -1,    35,    -1,    -1,    -1,
-    -1,    40,    -1,    -1,    -1,     1,    -1,    -1,    47,     5,
-     6,     7,     8,     9,    10,    11,    12,    13,    14,    15,
-    16,    17,    18,    19,    20,    21,    -1,    23,    24,    25,
-    26,    27,    -1,    -1,    30,    -1,    -1,    -1,    -1,    35,
-    -1,    -1,    -1,    -1,    40,    -1,    -1,    -1,    -1,    -1,
-    -1,    47,     5,     6,     7,     8,     9,    10,    11,    12,
-    13,    14,    15,    16,    17,    18,    19,    20,    21,    -1,
-    23,    24,    25,    26,    27,    -1,    -1,    30,    -1,    -1,
-    -1,    -1,    -1,    36,    -1,    -1,    -1,    40,    -1,    -1,
-    -1,    -1,    -1,    46,    -1,    48,     5,     6,     7,     8,
-     9,    10,    11,    12,    13,    14,    15,    16,    17,    18,
-    19,    20,    21,    -1,    23,    24,    25,    26,    27,    -1,
-    -1,    30,    -1,    -1,    -1,    -1,    35,    -1,    -1,    -1,
-    -1,    40,     5,     6,     7,     8,     9,    10,    11,    12,
-    13,    14,    15,    16,    17,    18,    19,    20,    21,    -1,
-    23,    24,    25,    26,    27,    -1,    -1,    30,    -1,    -1,
-     6,     7,     8,     9,    10,    -1,    12,    40,    14,    15,
-    -1,    17,    18,    19,    -1,    21,    -1,    23,    24,    25,
-    26,    27,    -1,    -1,    30,    -1,    -1,    -1,    -1,    -1,
-    -1,    -1,    -1,    -1,    40
+    52,    23,    24,    25,    26,    27,   148,    73,    30,    86,
+    95,    -1,   100,    -1,    36,   134,    -1,    -1,    40,    -1,
+    -1,    43,    44,    -1,    46,    -1,    48,     1,    -1,    51,
+    -1,     5,     6,     7,     8,     9,    10,    11,    12,    13,
+    14,    15,    16,    17,    18,    19,    20,    21,    22,    23,
+    24,    25,    26,    27,    28,    29,    30,    -1,    -1,    -1,
+    -1,    -1,    36,    -1,    -1,    -1,    40,    -1,    -1,    43,
+    -1,     1,    46,    -1,    48,     5,     6,     7,     8,     9,
+    10,    11,    12,    13,    14,    15,    16,    17,    18,    19,
+    20,    21,    -1,    23,    24,    25,    26,    27,    -1,    -1,
+    30,    -1,    -1,    -1,    -1,    35,    -1,    -1,    -1,    -1,
+    40,    -1,    -1,    -1,     1,    -1,    -1,    47,     5,     6,
+     7,     8,     9,    10,    11,    12,    13,    14,    15,    16,
+    17,    18,    19,    20,    21,    -1,    23,    24,    25,    26,
+    27,    -1,    -1,    30,    -1,    -1,    -1,    -1,    35,    -1,
+    -1,    -1,    -1,    40,    -1,    -1,    -1,     1,    -1,    -1,
+    47,     5,     6,     7,     8,     9,    10,    11,    12,    13,
+    14,    15,    16,    17,    18,    19,    20,    21,    -1,    23,
+    24,    25,    26,    27,    -1,    -1,    30,    -1,    -1,    -1,
+    -1,    35,    -1,    -1,    -1,    -1,    40,    -1,    -1,    -1,
+    -1,    -1,    -1,    47,     5,     6,     7,     8,     9,    10,
+    11,    12,    13,    14,    15,    16,    17,    18,    19,    20,
+    21,    -1,    23,    24,    25,    26,    27,    -1,    -1,    30,
+    -1,    -1,    -1,    -1,    -1,    36,    -1,    -1,    -1,    40,
+    -1,    -1,    -1,    -1,    -1,    46,    -1,    48,     5,     6,
+     7,     8,     9,    10,    11,    12,    13,    14,    15,    16,
+    17,    18,    19,    20,    21,    -1,    23,    24,    25,    26,
+    27,    -1,    -1,    30,    -1,    -1,    -1,    -1,    -1,    -1,
+    -1,    -1,    -1,    40,    -1,    -1,    -1,    -1,    -1,    -1,
+    47,     5,     6,     7,     8,     9,    10,    11,    12,    13,
+    14,    15,    16,    17,    18,    19,    20,    21,    -1,    23,
+    24,    25,    26,    27,    -1,    -1,    30,    -1,    -1,    -1,
+    -1,    35,    -1,    -1,    -1,    -1,    40,     5,     6,     7,
+     8,     9,    10,    11,    12,    13,    14,    15,    16,    17,
+    18,    19,    20,    21,    -1,    23,    24,    25,    26,    27,
+    -1,    -1,    30,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+    -1,    -1,    40
 };
 /* -*-C-*-  Note some compilers choke on comments on `#line' lines.  */
 #line 3 "/usr/lib/bison.simple"
diff -urN linux-2.6.8-rc2/scripts/lxdialog/menubox.c linux-2.6.8-rc3/scripts/lxdialog/menubox.c
--- linux-2.6.8-rc2/scripts/lxdialog/menubox.c	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/scripts/lxdialog/menubox.c	2004-08-03 15:22:20.299514037 -0700
@@ -71,7 +71,7 @@
 
     strncpy(menu_item, item, menu_width);
     menu_item[menu_width] = 0;
-    j = first_alpha(menu_item, "YyNnMm");
+    j = first_alpha(menu_item, "YyNnMmHh");
 
     /* Clear 'residue' of last item */
     wattrset (win, menubox_attr);
@@ -279,17 +279,17 @@
 
 	if (key < 256 && isalpha(key)) key = tolower(key);
 
-	if (strchr("ynm", key))
+	if (strchr("ynmh", key))
 		i = max_choice;
 	else {
         for (i = choice+1; i < max_choice; i++) {
-		j = first_alpha(items[(scroll+i)*2+1], "YyNnMm");
+		j = first_alpha(items[(scroll+i)*2+1], "YyNnMmHh");
 		if (key == tolower(items[(scroll+i)*2+1][j]))
                 	break;
 	}
 	if (i == max_choice)
        		for (i = 0; i < max_choice; i++) {
-			j = first_alpha(items[(scroll+i)*2+1], "YyNnMm");
+			j = first_alpha(items[(scroll+i)*2+1], "YyNnMmHh");
 			if (key == tolower(items[(scroll+i)*2+1][j]))
                 		break;
 		}
diff -urN linux-2.6.8-rc2/scripts/mk_elfconfig.c linux-2.6.8-rc3/scripts/mk_elfconfig.c
--- linux-2.6.8-rc2/scripts/mk_elfconfig.c	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/scripts/mk_elfconfig.c	1969-12-31 16:00:00.000000000 -0800
@@ -1,65 +0,0 @@
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <elf.h>
-
-int
-main(int argc, char **argv)
-{
-	unsigned char ei[EI_NIDENT];	
-	union { short s; char c[2]; } endian_test;
-
-	if (argc != 2) {
-		fprintf(stderr, "Error: no arch\n");
-	}
-	if (fread(ei, 1, EI_NIDENT, stdin) != EI_NIDENT) {
-		fprintf(stderr, "Error: input truncated\n");
-		return 1;
-	}
-	if (memcmp(ei, ELFMAG, SELFMAG) != 0) {
-		fprintf(stderr, "Error: not ELF\n");
-		return 1;
-	}
-	switch (ei[EI_CLASS]) {
-	case ELFCLASS32:
-		printf("#define KERNEL_ELFCLASS ELFCLASS32\n");
-		break;
-	case ELFCLASS64:
-		printf("#define KERNEL_ELFCLASS ELFCLASS64\n");
-		break;
-	default:
-		abort();
-	}
-	switch (ei[EI_DATA]) {
-	case ELFDATA2LSB:
-		printf("#define KERNEL_ELFDATA ELFDATA2LSB\n");
-		break;
-	case ELFDATA2MSB:
-		printf("#define KERNEL_ELFDATA ELFDATA2MSB\n");
-		break;
-	default:
-		abort();
-	}
-
-	if (sizeof(unsigned long) == 4) {
-		printf("#define HOST_ELFCLASS ELFCLASS32\n");
-	} else if (sizeof(unsigned long) == 8) {
-		printf("#define HOST_ELFCLASS ELFCLASS64\n");
-	}
-
-	endian_test.s = 0x0102;
-	if (memcmp(endian_test.c, "\x01\x02", 2) == 0)
-		printf("#define HOST_ELFDATA ELFDATA2MSB\n");
-	else if (memcmp(endian_test.c, "\x02\x01", 2) == 0)
-		printf("#define HOST_ELFDATA ELFDATA2LSB\n");
-	else
-		abort();
-
-	if ((strcmp(argv[1], "v850") == 0) || (strcmp(argv[1], "h8300") == 0))
-		printf("#define MODULE_SYMBOL_PREFIX \"_\"\n");
-	else 
-		printf("#define MODULE_SYMBOL_PREFIX \"\"\n");
-
-	return 0;
-}
-
diff -urN linux-2.6.8-rc2/scripts/mkconfigs linux-2.6.8-rc3/scripts/mkconfigs
--- linux-2.6.8-rc2/scripts/mkconfigs	2004-08-03 15:21:18.633984363 -0700
+++ linux-2.6.8-rc3/scripts/mkconfigs	1969-12-31 16:00:00.000000000 -0800
@@ -1,67 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) 2002 Khalid Aziz <khalid_aziz@hp.com>
-# Copyright (C) 2002 Randy Dunlap <rddunlap@osdl.org>
-# Copyright (C) 2002 Al Stone <ahs3@fc.hp.com>
-# Copyright (C) 2002 Hewlett-Packard Company
-#
-#   This program is free software; you can redistribute it and/or modify
-#   it under the terms of the GNU General Public License as published by
-#   the Free Software Foundation; either version 2 of the License, or
-#   (at your option) any later version.
-#
-#   This program is distributed in the hope that it will be useful,
-#   but WITHOUT ANY WARRANTY; without even the implied warranty of
-#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#   GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public License
-#   along with this program; if not, write to the Free Software
-#   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-#
-# 
-# Rules to generate ikconfig.h from linux/.config:
-#	- Retain lines that begin with "CONFIG_"
-#	- Retain lines that begin with "# CONFIG_"
-#	- lines that use double-quotes must \\-escape-quote them
-
-if [ $# -lt 2 ]
-then
-	echo "Usage: `basename $0` <configuration_file> <Makefile>"
-	exit 1
-fi
-
-config=$1
-makefile=$2
-
-cat << EOF
-#ifndef _IKCONFIG_H
-#define _IKCONFIG_H
-/*
- * 
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
- * NON INFRINGEMENT.  See the GNU General Public License for more
- * details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- *
- * 
- * This file is generated automatically by scripts/mkconfigs. Do not edit.
- *
- */
-static char const ikconfig_config[] __attribute__((unused)) =
-"CONFIG_BEGIN=n\\n\\
-$(sed < $config -n 's/"/\\"/g;/^#\? \?CONFIG_/s/.*/&\\n\\/p')
-CONFIG_END=n\\n";
-#endif /* _IKCONFIG_H */
-EOF
diff -urN linux-2.6.8-rc2/scripts/mkmakefile linux-2.6.8-rc3/scripts/mkmakefile
--- linux-2.6.8-rc2/scripts/mkmakefile	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/scripts/mkmakefile	2004-08-03 15:22:20.325515104 -0700
@@ -0,0 +1,31 @@
+#!/bin/sh
+# Generates a small Makefile used in the root of the output
+# directory, to allow make to be started from there.
+# The Makefile also allow for more convinient build of external modules
+
+# Usage
+# $1 - Kernel src directory
+# $2 - Output directory
+# $3 - version
+# $4 - patchlevel
+
+
+cat << EOF
+# Automatically generated by $0: don't edit
+
+VERSION = $3
+PATCHLEVEL = $4
+
+KERNELSRC    := $1
+KERNELOUTPUT := $2
+
+MAKEFLAGS += --no-print-directory
+
+all:
+	\$(MAKE) -C \$(KERNELSRC) O=\$(KERNELOUTPUT)
+
+%::
+	\$(MAKE) -C \$(KERNELSRC) O=\$(KERNELOUTPUT) \$@
+
+EOF
+
diff -urN linux-2.6.8-rc2/scripts/mod/Makefile linux-2.6.8-rc3/scripts/mod/Makefile
--- linux-2.6.8-rc2/scripts/mod/Makefile	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/scripts/mod/Makefile	2004-08-03 15:22:20.355516334 -0700
@@ -0,0 +1,16 @@
+host-progs	:= modpost mk_elfconfig
+always		:= $(host-progs) empty.o
+
+modpost-objs	:= modpost.o file2alias.o sumversion.o
+
+# dependencies on generated files need to be listed explicitly
+
+$(obj)/modpost.o $(obj)/file2alias.o $(obj)/sumversion.o: $(obj)/elfconfig.h
+
+quiet_cmd_elfconfig = MKELF   $@
+      cmd_elfconfig = $(obj)/mk_elfconfig $(ARCH) < $< > $@
+
+$(obj)/elfconfig.h: $(obj)/empty.o $(obj)/mk_elfconfig FORCE
+	$(call if_changed,elfconfig)
+
+targets += elfconfig.h
diff -urN linux-2.6.8-rc2/scripts/mod/empty.c linux-2.6.8-rc3/scripts/mod/empty.c
--- linux-2.6.8-rc2/scripts/mod/empty.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/scripts/mod/empty.c	2004-08-03 15:22:20.356516375 -0700
@@ -0,0 +1 @@
+/* empty file to figure out endianness / word size */
diff -urN linux-2.6.8-rc2/scripts/mod/file2alias.c linux-2.6.8-rc3/scripts/mod/file2alias.c
--- linux-2.6.8-rc2/scripts/mod/file2alias.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/scripts/mod/file2alias.c	2004-08-03 15:22:20.357516416 -0700
@@ -0,0 +1,282 @@
+/* Simple code to turn various tables in an ELF file into alias definitions.
+ * This deals with kernel datastructures where they should be
+ * dealt with: in the kernel source.
+ *
+ * Copyright 2002-2003  Rusty Russell, IBM Corporation
+ *           2003       Kai Germaschewski
+ *           
+ *
+ * This software may be used and distributed according to the terms
+ * of the GNU General Public License, incorporated herein by reference.
+ */
+
+#include "modpost.h"
+
+/* We use the ELF typedefs, since we can't rely on stdint.h being present. */
+
+#if KERNEL_ELFCLASS == ELFCLASS32
+typedef Elf32_Addr     kernel_ulong_t;
+#else
+typedef Elf64_Addr     kernel_ulong_t;
+#endif
+
+typedef Elf32_Word     __u32;
+typedef Elf32_Half     __u16;
+typedef unsigned char  __u8;
+
+/* Big exception to the "don't include kernel headers into userspace, which
+ * even potentially has different endianness and word sizes, since 
+ * we handle those differences explicitly below */
+#include "../../include/linux/mod_devicetable.h"
+
+#define ADD(str, sep, cond, field)                              \
+do {                                                            \
+        strcat(str, sep);                                       \
+        if (cond)                                               \
+                sprintf(str + strlen(str),                      \
+                        sizeof(field) == 1 ? "%02X" :           \
+                        sizeof(field) == 2 ? "%04X" :           \
+                        sizeof(field) == 4 ? "%08X" : "",       \
+                        field);                                 \
+        else                                                    \
+                sprintf(str + strlen(str), "*");                \
+} while(0)
+
+/* Looks like "usb:vNpNdlNdhNdcNdscNdpNicNiscNipN" */
+static int do_usb_entry(const char *filename,
+			struct usb_device_id *id, char *alias)
+{
+	id->match_flags = TO_NATIVE(id->match_flags);
+	id->idVendor = TO_NATIVE(id->idVendor);
+	id->idProduct = TO_NATIVE(id->idProduct);
+	id->bcdDevice_lo = TO_NATIVE(id->bcdDevice_lo);
+	id->bcdDevice_hi = TO_NATIVE(id->bcdDevice_hi);
+
+	/*
+	 * Some modules (visor) have empty slots as placeholder for
+	 * run-time specification that results in catch-all alias
+	 */
+	if (!(id->idVendor | id->bDeviceClass | id->bInterfaceClass))
+		return 1;
+
+	strcpy(alias, "usb:");
+	ADD(alias, "v", id->match_flags&USB_DEVICE_ID_MATCH_VENDOR,
+	    id->idVendor);
+	ADD(alias, "p", id->match_flags&USB_DEVICE_ID_MATCH_PRODUCT,
+	    id->idProduct);
+	ADD(alias, "dl", id->match_flags&USB_DEVICE_ID_MATCH_DEV_LO,
+	    id->bcdDevice_lo);
+	ADD(alias, "dh", id->match_flags&USB_DEVICE_ID_MATCH_DEV_HI,
+	    id->bcdDevice_hi);
+	ADD(alias, "dc", id->match_flags&USB_DEVICE_ID_MATCH_DEV_CLASS,
+	    id->bDeviceClass);
+	ADD(alias, "dsc",
+	    id->match_flags&USB_DEVICE_ID_MATCH_DEV_SUBCLASS,
+	    id->bDeviceSubClass);
+	ADD(alias, "dp",
+	    id->match_flags&USB_DEVICE_ID_MATCH_DEV_PROTOCOL,
+	    id->bDeviceProtocol);
+	ADD(alias, "ic",
+	    id->match_flags&USB_DEVICE_ID_MATCH_INT_CLASS,
+	    id->bInterfaceClass);
+	ADD(alias, "isc",
+	    id->match_flags&USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+	    id->bInterfaceSubClass);
+	ADD(alias, "ip",
+	    id->match_flags&USB_DEVICE_ID_MATCH_INT_PROTOCOL,
+	    id->bInterfaceProtocol);
+	return 1;
+}
+
+/* Looks like: ieee1394:venNmoNspNverN */
+static int do_ieee1394_entry(const char *filename,
+			     struct ieee1394_device_id *id, char *alias)
+{
+	id->match_flags = TO_NATIVE(id->match_flags);
+	id->vendor_id = TO_NATIVE(id->vendor_id);
+	id->model_id = TO_NATIVE(id->model_id);
+	id->specifier_id = TO_NATIVE(id->specifier_id);
+	id->version = TO_NATIVE(id->version);
+
+	strcpy(alias, "ieee1394:");
+	ADD(alias, "ven", id->match_flags & IEEE1394_MATCH_VENDOR_ID,
+	    id->vendor_id);
+	ADD(alias, "mo", id->match_flags & IEEE1394_MATCH_MODEL_ID,
+	    id->model_id);
+	ADD(alias, "sp", id->match_flags & IEEE1394_MATCH_SPECIFIER_ID,
+	    id->specifier_id);
+	ADD(alias, "ver", id->match_flags & IEEE1394_MATCH_VERSION,
+	    id->version);
+
+	return 1;
+}
+
+/* Looks like: pci:vNdNsvNsdNbcNscNiN. */
+static int do_pci_entry(const char *filename,
+			struct pci_device_id *id, char *alias)
+{
+	/* Class field can be divided into these three. */
+	unsigned char baseclass, subclass, interface,
+		baseclass_mask, subclass_mask, interface_mask;
+
+	id->vendor = TO_NATIVE(id->vendor);
+	id->device = TO_NATIVE(id->device);
+	id->subvendor = TO_NATIVE(id->subvendor);
+	id->subdevice = TO_NATIVE(id->subdevice);
+	id->class = TO_NATIVE(id->class);
+	id->class_mask = TO_NATIVE(id->class_mask);
+
+	strcpy(alias, "pci:");
+	ADD(alias, "v", id->vendor != PCI_ANY_ID, id->vendor);
+	ADD(alias, "d", id->device != PCI_ANY_ID, id->device);
+	ADD(alias, "sv", id->subvendor != PCI_ANY_ID, id->subvendor);
+	ADD(alias, "sd", id->subdevice != PCI_ANY_ID, id->subdevice);
+
+	baseclass = (id->class) >> 16;
+	baseclass_mask = (id->class_mask) >> 16;
+	subclass = (id->class) >> 8;
+	subclass_mask = (id->class_mask) >> 8;
+	interface = id->class;
+	interface_mask = id->class_mask;
+
+	if ((baseclass_mask != 0 && baseclass_mask != 0xFF)
+	    || (subclass_mask != 0 && subclass_mask != 0xFF)
+	    || (interface_mask != 0 && interface_mask != 0xFF)) {
+		fprintf(stderr,
+			"*** Warning: Can't handle masks in %s:%04X\n",
+			filename, id->class_mask);
+		return 0;
+	}
+
+	ADD(alias, "bc", baseclass_mask == 0xFF, baseclass);
+	ADD(alias, "sc", subclass_mask == 0xFF, subclass);
+	ADD(alias, "i", interface_mask == 0xFF, interface);
+	return 1;
+}
+
+/* looks like: "ccw:tNmNdtNdmN" */ 
+static int do_ccw_entry(const char *filename,
+			struct ccw_device_id *id, char *alias)
+{
+	id->match_flags = TO_NATIVE(id->match_flags);
+	id->cu_type = TO_NATIVE(id->cu_type);
+	id->cu_model = TO_NATIVE(id->cu_model);
+	id->dev_type = TO_NATIVE(id->dev_type);
+	id->dev_model = TO_NATIVE(id->dev_model);
+
+	strcpy(alias, "ccw:");
+	ADD(alias, "t", id->match_flags&CCW_DEVICE_ID_MATCH_CU_TYPE,
+	    id->cu_type);
+	ADD(alias, "m", id->match_flags&CCW_DEVICE_ID_MATCH_CU_MODEL,
+	    id->cu_model);
+	ADD(alias, "dt", id->match_flags&CCW_DEVICE_ID_MATCH_DEVICE_TYPE,
+	    id->dev_type);
+	ADD(alias, "dm", id->match_flags&CCW_DEVICE_ID_MATCH_DEVICE_TYPE,
+	    id->dev_model);
+	return 1;
+}
+
+/* looks like: "pnp:dD" */
+static int do_pnp_entry(const char *filename,
+			struct pnp_device_id *id, char *alias)
+{
+	sprintf(alias, "pnp:d%s", id->id);
+	return 1;
+}
+
+/* looks like: "pnp:cCdD..." */
+static int do_pnp_card_entry(const char *filename,
+			struct pnp_card_device_id *id, char *alias)
+{
+	int i;
+
+	sprintf(alias, "pnp:c%s", id->id);
+	for (i = 0; i < PNP_MAX_DEVICES; i++) {
+		if (! *id->devs[i].id)
+			break;
+		sprintf(alias + strlen(alias), "d%s", id->devs[i].id);
+	}
+	return 1;
+}
+
+/* Ignore any prefix, eg. v850 prepends _ */
+static inline int sym_is(const char *symbol, const char *name)
+{
+	const char *match;
+
+	match = strstr(symbol, name);
+	if (!match)
+		return 0;
+	return match[strlen(symbol)] == '\0';
+}
+
+static void do_table(void *symval, unsigned long size,
+		     unsigned long id_size,
+		     void *function,
+		     struct module *mod)
+{
+	unsigned int i;
+	char alias[500];
+	int (*do_entry)(const char *, void *entry, char *alias) = function;
+
+	if (size % id_size || size < id_size) {
+		fprintf(stderr, "*** Warning: %s ids %lu bad size "
+			"(each on %lu)\n", mod->name, size, id_size);
+	}
+	/* Leave last one: it's the terminator. */
+	size -= id_size;
+
+	for (i = 0; i < size; i += id_size) {
+		if (do_entry(mod->name, symval+i, alias)) {
+			/* Always end in a wildcard, for future extension */
+			if (alias[strlen(alias)-1] != '*')
+				strcat(alias, "*");
+			buf_printf(&mod->dev_table_buf,
+				   "MODULE_ALIAS(\"%s\");\n", alias);
+		}
+	}
+}
+
+/* Create MODULE_ALIAS() statements.
+ * At this time, we cannot write the actual output C source yet,
+ * so we write into the mod->dev_table_buf buffer. */
+void handle_moddevtable(struct module *mod, struct elf_info *info,
+			Elf_Sym *sym, const char *symname)
+{
+	void *symval;
+
+	/* We're looking for a section relative symbol */
+	if (!sym->st_shndx || sym->st_shndx >= info->hdr->e_shnum)
+		return;
+
+	symval = (void *)info->hdr
+		+ info->sechdrs[sym->st_shndx].sh_offset
+		+ sym->st_value;
+
+	if (sym_is(symname, "__mod_pci_device_table"))
+		do_table(symval, sym->st_size, sizeof(struct pci_device_id),
+			 do_pci_entry, mod);
+	else if (sym_is(symname, "__mod_usb_device_table"))
+		do_table(symval, sym->st_size, sizeof(struct usb_device_id),
+			 do_usb_entry, mod);
+	else if (sym_is(symname, "__mod_ieee1394_device_table"))
+		do_table(symval, sym->st_size, sizeof(struct ieee1394_device_id),
+			 do_ieee1394_entry, mod);
+	else if (sym_is(symname, "__mod_ccw_device_table"))
+		do_table(symval, sym->st_size, sizeof(struct ccw_device_id),
+			 do_ccw_entry, mod);
+	else if (sym_is(symname, "__mod_pnp_device_table"))
+		do_table(symval, sym->st_size, sizeof(struct pnp_device_id),
+			 do_pnp_entry, mod);
+	else if (sym_is(symname, "__mod_pnp_card_device_table"))
+		do_table(symval, sym->st_size, sizeof(struct pnp_card_device_id),
+			 do_pnp_card_entry, mod);
+}
+
+/* Now add out buffered information to the generated C source */
+void add_moddevtable(struct buffer *buf, struct module *mod)
+{
+	buf_printf(buf, "\n");
+	buf_write(buf, mod->dev_table_buf.p, mod->dev_table_buf.pos);
+	free(mod->dev_table_buf.p);
+}
diff -urN linux-2.6.8-rc2/scripts/mod/mk_elfconfig.c linux-2.6.8-rc3/scripts/mod/mk_elfconfig.c
--- linux-2.6.8-rc2/scripts/mod/mk_elfconfig.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/scripts/mod/mk_elfconfig.c	2004-08-03 15:22:20.357516416 -0700
@@ -0,0 +1,65 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <elf.h>
+
+int
+main(int argc, char **argv)
+{
+	unsigned char ei[EI_NIDENT];	
+	union { short s; char c[2]; } endian_test;
+
+	if (argc != 2) {
+		fprintf(stderr, "Error: no arch\n");
+	}
+	if (fread(ei, 1, EI_NIDENT, stdin) != EI_NIDENT) {
+		fprintf(stderr, "Error: input truncated\n");
+		return 1;
+	}
+	if (memcmp(ei, ELFMAG, SELFMAG) != 0) {
+		fprintf(stderr, "Error: not ELF\n");
+		return 1;
+	}
+	switch (ei[EI_CLASS]) {
+	case ELFCLASS32:
+		printf("#define KERNEL_ELFCLASS ELFCLASS32\n");
+		break;
+	case ELFCLASS64:
+		printf("#define KERNEL_ELFCLASS ELFCLASS64\n");
+		break;
+	default:
+		abort();
+	}
+	switch (ei[EI_DATA]) {
+	case ELFDATA2LSB:
+		printf("#define KERNEL_ELFDATA ELFDATA2LSB\n");
+		break;
+	case ELFDATA2MSB:
+		printf("#define KERNEL_ELFDATA ELFDATA2MSB\n");
+		break;
+	default:
+		abort();
+	}
+
+	if (sizeof(unsigned long) == 4) {
+		printf("#define HOST_ELFCLASS ELFCLASS32\n");
+	} else if (sizeof(unsigned long) == 8) {
+		printf("#define HOST_ELFCLASS ELFCLASS64\n");
+	}
+
+	endian_test.s = 0x0102;
+	if (memcmp(endian_test.c, "\x01\x02", 2) == 0)
+		printf("#define HOST_ELFDATA ELFDATA2MSB\n");
+	else if (memcmp(endian_test.c, "\x02\x01", 2) == 0)
+		printf("#define HOST_ELFDATA ELFDATA2LSB\n");
+	else
+		abort();
+
+	if ((strcmp(argv[1], "v850") == 0) || (strcmp(argv[1], "h8300") == 0))
+		printf("#define MODULE_SYMBOL_PREFIX \"_\"\n");
+	else 
+		printf("#define MODULE_SYMBOL_PREFIX \"\"\n");
+
+	return 0;
+}
+
diff -urN linux-2.6.8-rc2/scripts/mod/modpost.c linux-2.6.8-rc3/scripts/mod/modpost.c
--- linux-2.6.8-rc2/scripts/mod/modpost.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/scripts/mod/modpost.c	2004-08-03 15:22:20.359516498 -0700
@@ -0,0 +1,739 @@
+/* Postprocess module symbol versions
+ *
+ * Copyright 2003       Kai Germaschewski
+ *           2002-2003  Rusty Russell, IBM Corporation
+ *
+ * Based in part on module-init-tools/depmod.c,file2alias
+ *
+ * This software may be used and distributed according to the terms
+ * of the GNU General Public License, incorporated herein by reference.
+ *
+ * Usage: modpost vmlinux module1.o module2.o ...
+ */
+
+#include <ctype.h>
+#include "modpost.h"
+
+/* Are we using CONFIG_MODVERSIONS? */
+int modversions = 0;
+/* Warn about undefined symbols? (do so if we have vmlinux) */
+int have_vmlinux = 0;
+
+void
+fatal(const char *fmt, ...)
+{
+	va_list arglist;
+
+	fprintf(stderr, "FATAL: ");
+
+	va_start(arglist, fmt);
+	vfprintf(stderr, fmt, arglist);
+	va_end(arglist);
+
+	exit(1);
+}
+
+void
+warn(const char *fmt, ...)
+{
+	va_list arglist;
+
+	fprintf(stderr, "WARNING: ");
+
+	va_start(arglist, fmt);
+	vfprintf(stderr, fmt, arglist);
+	va_end(arglist);
+}
+
+void *do_nofail(void *ptr, const char *file, int line, const char *expr)
+{
+	if (!ptr) {
+		fatal("Memory allocation failure %s line %d: %s.\n",
+		      file, line, expr);
+	}
+	return ptr;
+}
+
+/* A list of all modules we processed */
+
+static struct module *modules;
+
+struct module *
+find_module(char *modname)
+{
+	struct module *mod;
+
+	for (mod = modules; mod; mod = mod->next)
+		if (strcmp(mod->name, modname) == 0)
+			break;
+	return mod;
+}
+
+struct module *
+new_module(char *modname)
+{
+	struct module *mod;
+	char *p, *s;
+	
+	mod = NOFAIL(malloc(sizeof(*mod)));
+	memset(mod, 0, sizeof(*mod));
+	p = NOFAIL(strdup(modname));
+
+	/* strip trailing .o */
+	if ((s = strrchr(p, '.')) != NULL)
+		if (strcmp(s, ".o") == 0)
+			*s = '\0';
+
+	/* add to list */
+	mod->name = p;
+	mod->next = modules;
+	modules = mod;
+
+	return mod;
+}
+
+/* A hash of all exported symbols,
+ * struct symbol is also used for lists of unresolved symbols */
+
+#define SYMBOL_HASH_SIZE 1024
+
+struct symbol {
+	struct symbol *next;
+	struct module *module;
+	unsigned int crc;
+	int crc_valid;
+	char name[0];
+};
+
+static struct symbol *symbolhash[SYMBOL_HASH_SIZE];
+
+/* This is based on the hash agorithm from gdbm, via tdb */
+static inline unsigned int tdb_hash(const char *name)
+{
+	unsigned value;	/* Used to compute the hash value.  */
+	unsigned   i;	/* Used to cycle through random values. */
+
+	/* Set the initial value from the key size. */
+	for (value = 0x238F13AF * strlen(name), i=0; name[i]; i++)
+		value = (value + (((unsigned char *)name)[i] << (i*5 % 24)));
+
+	return (1103515243 * value + 12345);
+}
+
+/* Allocate a new symbols for use in the hash of exported symbols or
+ * the list of unresolved symbols per module */
+
+struct symbol *
+alloc_symbol(const char *name, struct symbol *next)
+{
+	struct symbol *s = NOFAIL(malloc(sizeof(*s) + strlen(name) + 1));
+
+	memset(s, 0, sizeof(*s));
+	strcpy(s->name, name);
+	s->next = next;
+	return s;
+}
+
+/* For the hash of exported symbols */
+
+void
+new_symbol(const char *name, struct module *module, unsigned int *crc)
+{
+	unsigned int hash;
+	struct symbol *new;
+
+	hash = tdb_hash(name) % SYMBOL_HASH_SIZE;
+	new = symbolhash[hash] = alloc_symbol(name, symbolhash[hash]);
+	new->module = module;
+	if (crc) {
+		new->crc = *crc;
+		new->crc_valid = 1;
+	}
+}
+
+struct symbol *
+find_symbol(const char *name)
+{
+	struct symbol *s;
+
+	/* For our purposes, .foo matches foo.  PPC64 needs this. */
+	if (name[0] == '.')
+		name++;
+
+	for (s = symbolhash[tdb_hash(name) % SYMBOL_HASH_SIZE]; s; s=s->next) {
+		if (strcmp(s->name, name) == 0)
+			return s;
+	}
+	return NULL;
+}
+
+/* Add an exported symbol - it may have already been added without a
+ * CRC, in this case just update the CRC */
+void
+add_exported_symbol(const char *name, struct module *module, unsigned int *crc)
+{
+	struct symbol *s = find_symbol(name);
+
+	if (!s) {
+		new_symbol(name, module, crc);
+		return;
+	}
+	if (crc) {
+		s->crc = *crc;
+		s->crc_valid = 1;
+	}
+}
+
+void *
+grab_file(const char *filename, unsigned long *size)
+{
+	struct stat st;
+	void *map;
+	int fd;
+
+	fd = open(filename, O_RDONLY);
+	if (fd < 0 || fstat(fd, &st) != 0)
+		return NULL;
+
+	*size = st.st_size;
+	map = mmap(NULL, *size, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
+	close(fd);
+
+	if (map == MAP_FAILED)
+		return NULL;
+	return map;
+}
+
+/*
+   Return a copy of the next line in a mmap'ed file.
+   spaces in the beginning of the line is trimmed away.
+   Return a pointer to a static buffer.
+*/
+char*
+get_next_line(unsigned long *pos, void *file, unsigned long size)
+{
+	static char line[4096];
+	int skip = 1;
+	size_t len = 0;
+	char *p = (char *)file + *pos;
+	char *s = line;
+
+	for (; *pos < size ; (*pos)++)
+	{
+		if (skip && isspace(*p)) {
+			p++;
+			continue;
+		}
+		skip = 0;
+		if (*p != '\n' && (*pos < size)) {
+			len++;
+			*s++ = *p++;
+			if (len > 4095)
+				break; /* Too long, stop */
+		} else {
+			/* End of string */
+			*s = '\0';
+			return line;
+		}
+	}
+	/* End of buffer */
+	return NULL;
+}
+
+void
+release_file(void *file, unsigned long size)
+{
+	munmap(file, size);
+}
+
+void
+parse_elf(struct elf_info *info, const char *filename)
+{
+	unsigned int i;
+	Elf_Ehdr *hdr = info->hdr;
+	Elf_Shdr *sechdrs;
+	Elf_Sym  *sym;
+
+	hdr = grab_file(filename, &info->size);
+	if (!hdr) {
+		perror(filename);
+		abort();
+	}
+	info->hdr = hdr;
+	if (info->size < sizeof(*hdr))
+		goto truncated;
+
+	/* Fix endianness in ELF header */
+	hdr->e_shoff    = TO_NATIVE(hdr->e_shoff);
+	hdr->e_shstrndx = TO_NATIVE(hdr->e_shstrndx);
+	hdr->e_shnum    = TO_NATIVE(hdr->e_shnum);
+	hdr->e_machine  = TO_NATIVE(hdr->e_machine);
+	sechdrs = (void *)hdr + hdr->e_shoff;
+	info->sechdrs = sechdrs;
+
+	/* Fix endianness in section headers */
+	for (i = 0; i < hdr->e_shnum; i++) {
+		sechdrs[i].sh_type   = TO_NATIVE(sechdrs[i].sh_type);
+		sechdrs[i].sh_offset = TO_NATIVE(sechdrs[i].sh_offset);
+		sechdrs[i].sh_size   = TO_NATIVE(sechdrs[i].sh_size);
+		sechdrs[i].sh_link   = TO_NATIVE(sechdrs[i].sh_link);
+		sechdrs[i].sh_name   = TO_NATIVE(sechdrs[i].sh_name);
+	}
+	/* Find symbol table. */
+	for (i = 1; i < hdr->e_shnum; i++) {
+		const char *secstrings
+			= (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
+
+		if (sechdrs[i].sh_offset > info->size)
+			goto truncated;
+		if (strcmp(secstrings+sechdrs[i].sh_name, ".modinfo") == 0) {
+			info->modinfo = (void *)hdr + sechdrs[i].sh_offset;
+			info->modinfo_len = sechdrs[i].sh_size;
+		}
+		if (sechdrs[i].sh_type != SHT_SYMTAB)
+			continue;
+
+		info->symtab_start = (void *)hdr + sechdrs[i].sh_offset;
+		info->symtab_stop  = (void *)hdr + sechdrs[i].sh_offset 
+			                         + sechdrs[i].sh_size;
+		info->strtab       = (void *)hdr + 
+			             sechdrs[sechdrs[i].sh_link].sh_offset;
+	}
+	if (!info->symtab_start) {
+		fprintf(stderr, "modpost: %s no symtab?\n", filename);
+		abort();
+	}
+	/* Fix endianness in symbols */
+	for (sym = info->symtab_start; sym < info->symtab_stop; sym++) {
+		sym->st_shndx = TO_NATIVE(sym->st_shndx);
+		sym->st_name  = TO_NATIVE(sym->st_name);
+		sym->st_value = TO_NATIVE(sym->st_value);
+		sym->st_size  = TO_NATIVE(sym->st_size);
+	}
+	return;
+
+ truncated:
+	fprintf(stderr, "modpost: %s is truncated.\n", filename);
+	abort();
+}
+
+void
+parse_elf_finish(struct elf_info *info)
+{
+	release_file(info->hdr, info->size);
+}
+
+#define CRC_PFX     MODULE_SYMBOL_PREFIX "__crc_"
+#define KSYMTAB_PFX MODULE_SYMBOL_PREFIX "__ksymtab_"
+
+void
+handle_modversions(struct module *mod, struct elf_info *info,
+		   Elf_Sym *sym, const char *symname)
+{
+	unsigned int crc;
+
+	switch (sym->st_shndx) {
+	case SHN_COMMON:
+		fprintf(stderr, "*** Warning: \"%s\" [%s] is COMMON symbol\n",
+			symname, mod->name);
+		break;
+	case SHN_ABS:
+		/* CRC'd symbol */
+		if (memcmp(symname, CRC_PFX, strlen(CRC_PFX)) == 0) {
+			crc = (unsigned int) sym->st_value;
+			add_exported_symbol(symname + strlen(CRC_PFX),
+					    mod, &crc);
+			modversions = 1;
+		}
+		break;
+	case SHN_UNDEF:
+		/* undefined symbol */
+		if (ELF_ST_BIND(sym->st_info) != STB_GLOBAL)
+			break;
+		/* ignore global offset table */
+		if (strcmp(symname, "_GLOBAL_OFFSET_TABLE_") == 0)
+			break;
+		/* ignore __this_module, it will be resolved shortly */
+		if (strcmp(symname, MODULE_SYMBOL_PREFIX "__this_module") == 0)
+			break;
+#ifdef STT_REGISTER
+		if (info->hdr->e_machine == EM_SPARC ||
+		    info->hdr->e_machine == EM_SPARCV9) {
+			/* Ignore register directives. */
+			if (ELF_ST_TYPE(sym->st_info) == STT_REGISTER)
+				break;
+		}
+#endif
+		
+		if (memcmp(symname, MODULE_SYMBOL_PREFIX,
+			   strlen(MODULE_SYMBOL_PREFIX)) == 0)
+			mod->unres = alloc_symbol(symname +
+						  strlen(MODULE_SYMBOL_PREFIX),
+						  mod->unres);
+		break;
+	default:
+		/* All exported symbols */
+		if (memcmp(symname, KSYMTAB_PFX, strlen(KSYMTAB_PFX)) == 0) {
+			add_exported_symbol(symname + strlen(KSYMTAB_PFX),
+					    mod, NULL);
+		}
+		break;
+	}
+}
+
+int
+is_vmlinux(const char *modname)
+{
+	const char *myname;
+
+	if ((myname = strrchr(modname, '/')))
+		myname++;
+	else
+		myname = modname;
+
+	return strcmp(myname, "vmlinux") == 0;
+}
+
+void
+read_symbols(char *modname)
+{
+	const char *symname;
+	struct module *mod;
+	struct elf_info info = { };
+	Elf_Sym *sym;
+
+	parse_elf(&info, modname);
+
+	mod = new_module(modname);
+
+	/* When there's no vmlinux, don't print warnings about
+	 * unresolved symbols (since there'll be too many ;) */
+	if (is_vmlinux(modname)) {
+		unsigned int fake_crc = 0;
+		have_vmlinux = 1;
+		/* May not have this if !CONFIG_MODULE_UNLOAD: fake it.
+		   If it appears, we'll get the real CRC. */
+		add_exported_symbol("cleanup_module", mod, &fake_crc);
+		add_exported_symbol("struct_module", mod, &fake_crc);
+		mod->skip = 1;
+	}
+
+	for (sym = info.symtab_start; sym < info.symtab_stop; sym++) {
+		symname = info.strtab + sym->st_name;
+
+		handle_modversions(mod, &info, sym, symname);
+		handle_moddevtable(mod, &info, sym, symname);
+	}
+	maybe_frob_version(modname, info.modinfo, info.modinfo_len,
+			   (void *)info.modinfo - (void *)info.hdr);
+	parse_elf_finish(&info);
+
+	/* Our trick to get versioning for struct_module - it's
+	 * never passed as an argument to an exported function, so
+	 * the automatic versioning doesn't pick it up, but it's really
+	 * important anyhow */
+	if (modversions) {
+		mod->unres = alloc_symbol("struct_module", mod->unres);
+
+		/* Always version init_module and cleanup_module, in
+		 * case module doesn't have its own. */
+		mod->unres = alloc_symbol("init_module", mod->unres);
+		mod->unres = alloc_symbol("cleanup_module", mod->unres);
+	}
+}
+
+#define SZ 500
+
+/* We first write the generated file into memory using the
+ * following helper, then compare to the file on disk and
+ * only update the later if anything changed */
+
+void __attribute__((format(printf, 2, 3)))
+buf_printf(struct buffer *buf, const char *fmt, ...)
+{
+	char tmp[SZ];
+	int len;
+	va_list ap;
+	
+	va_start(ap, fmt);
+	len = vsnprintf(tmp, SZ, fmt, ap);
+	if (buf->size - buf->pos < len + 1) {
+		buf->size += 128;
+		buf->p = realloc(buf->p, buf->size);
+	}
+	strncpy(buf->p + buf->pos, tmp, len + 1);
+	buf->pos += len;
+	va_end(ap);
+}
+
+void
+buf_write(struct buffer *buf, const char *s, int len)
+{
+	if (buf->size - buf->pos < len) {
+		buf->size += len;
+		buf->p = realloc(buf->p, buf->size);
+	}
+	strncpy(buf->p + buf->pos, s, len);
+	buf->pos += len;
+}
+
+/* Header for the generated file */
+
+void
+add_header(struct buffer *b)
+{
+	buf_printf(b, "#include <linux/module.h>\n");
+	buf_printf(b, "#include <linux/vermagic.h>\n");
+	buf_printf(b, "#include <linux/compiler.h>\n");
+	buf_printf(b, "\n");
+	buf_printf(b, "MODULE_INFO(vermagic, VERMAGIC_STRING);\n");
+	buf_printf(b, "\n");
+	buf_printf(b, "#undef unix\n"); /* We have a module called "unix" */
+	buf_printf(b, "struct module __this_module\n");
+	buf_printf(b, "__attribute__((section(\".gnu.linkonce.this_module\"))) = {\n");
+	buf_printf(b, " .name = __stringify(KBUILD_MODNAME),\n");
+	buf_printf(b, " .init = init_module,\n");
+	buf_printf(b, "#ifdef CONFIG_MODULE_UNLOAD\n");
+	buf_printf(b, " .exit = cleanup_module,\n");
+	buf_printf(b, "#endif\n");
+	buf_printf(b, "};\n");
+}
+
+/* Record CRCs for unresolved symbols */
+
+void
+add_versions(struct buffer *b, struct module *mod)
+{
+	struct symbol *s, *exp;
+
+	for (s = mod->unres; s; s = s->next) {
+		exp = find_symbol(s->name);
+		if (!exp || exp->module == mod) {
+			if (have_vmlinux)
+				fprintf(stderr, "*** Warning: \"%s\" [%s.ko] "
+				"undefined!\n",	s->name, mod->name);
+			continue;
+		}
+		s->module = exp->module;
+		s->crc_valid = exp->crc_valid;
+		s->crc = exp->crc;
+	}
+
+	if (!modversions)
+		return;
+
+	buf_printf(b, "\n");
+	buf_printf(b, "static const struct modversion_info ____versions[]\n");
+	buf_printf(b, "__attribute_used__\n");
+	buf_printf(b, "__attribute__((section(\"__versions\"))) = {\n");
+
+	for (s = mod->unres; s; s = s->next) {
+		if (!s->module) {
+			continue;
+		}
+		if (!s->crc_valid) {
+			fprintf(stderr, "*** Warning: \"%s\" [%s.ko] "
+				"has no CRC!\n",
+				s->name, mod->name);
+			continue;
+		}
+		buf_printf(b, "\t{ %#8x, \"%s\" },\n", s->crc, s->name);
+	}
+
+	buf_printf(b, "};\n");
+}
+
+void
+add_depends(struct buffer *b, struct module *mod, struct module *modules)
+{
+	struct symbol *s;
+	struct module *m;
+	int first = 1;
+
+	for (m = modules; m; m = m->next) {
+		m->seen = is_vmlinux(m->name);
+	}
+
+	buf_printf(b, "\n");
+	buf_printf(b, "static const char __module_depends[]\n");
+	buf_printf(b, "__attribute_used__\n");
+	buf_printf(b, "__attribute__((section(\".modinfo\"))) =\n");
+	buf_printf(b, "\"depends=");
+	for (s = mod->unres; s; s = s->next) {
+		if (!s->module)
+			continue;
+
+		if (s->module->seen)
+			continue;
+
+		s->module->seen = 1;
+		buf_printf(b, "%s%s", first ? "" : ",",
+			   strrchr(s->module->name, '/') + 1);
+		first = 0;
+	}
+	buf_printf(b, "\";\n");
+}
+
+void
+write_if_changed(struct buffer *b, const char *fname)
+{
+	char *tmp;
+	FILE *file;
+	struct stat st;
+
+	file = fopen(fname, "r");
+	if (!file)
+		goto write;
+
+	if (fstat(fileno(file), &st) < 0)
+		goto close_write;
+
+	if (st.st_size != b->pos)
+		goto close_write;
+
+	tmp = NOFAIL(malloc(b->pos));
+	if (fread(tmp, 1, b->pos, file) != b->pos)
+		goto free_write;
+
+	if (memcmp(tmp, b->p, b->pos) != 0)
+		goto free_write;
+
+	free(tmp);
+	fclose(file);
+	return;
+
+ free_write:
+	free(tmp);
+ close_write:
+	fclose(file);
+ write:
+	file = fopen(fname, "w");
+	if (!file) {
+		perror(fname);
+		exit(1);
+	}
+	if (fwrite(b->p, 1, b->pos, file) != b->pos) {
+		perror(fname);
+		exit(1);
+	}
+	fclose(file);
+}
+
+void
+read_dump(const char *fname)
+{
+	unsigned long size, pos = 0;
+	void *file = grab_file(fname, &size);
+	char *line;
+
+        if (!file)
+		/* No symbol versions, silently ignore */
+		return;
+
+	while ((line = get_next_line(&pos, file, size))) {
+		char *symname, *modname, *d;
+		unsigned int crc;
+		struct module *mod;
+
+		if (!(symname = strchr(line, '\t')))
+			goto fail;
+		*symname++ = '\0';
+		if (!(modname = strchr(symname, '\t')))
+			goto fail;
+		*modname++ = '\0';
+		if (strchr(modname, '\t'))
+			goto fail;
+		crc = strtoul(line, &d, 16);
+		if (*symname == '\0' || *modname == '\0' || *d != '\0')
+			goto fail;
+
+		if (!(mod = find_module(modname))) {
+			if (is_vmlinux(modname)) {
+				modversions = 1;
+				have_vmlinux = 1;
+			}
+			mod = new_module(NOFAIL(strdup(modname)));
+			mod->skip = 1;
+		}
+		add_exported_symbol(symname, mod, &crc);
+	}
+	return;
+fail:
+	fatal("parse error in symbol dump file\n");
+}
+
+void
+write_dump(const char *fname)
+{
+	struct buffer buf = { };
+	struct symbol *symbol;
+	int n;
+
+	for (n = 0; n < SYMBOL_HASH_SIZE ; n++) {
+		symbol = symbolhash[n];
+		while (symbol) {
+			symbol = symbol->next;
+		}
+	}
+
+	for (n = 0; n < SYMBOL_HASH_SIZE ; n++) {
+		symbol = symbolhash[n];
+		while (symbol) {
+			buf_printf(&buf, "0x%08x\t%s\t%s\n", symbol->crc,
+				symbol->name, symbol->module->name);
+			symbol = symbol->next;
+		}
+	}
+	write_if_changed(&buf, fname);
+}
+
+int
+main(int argc, char **argv)
+{
+	struct module *mod;
+	struct buffer buf = { };
+	char fname[SZ];
+	char *dump_read = NULL, *dump_write = NULL;
+	int opt;
+
+	while ((opt = getopt(argc, argv, "i:o:")) != -1) {
+		switch(opt) {
+			case 'i':
+				dump_read = optarg;
+				break;
+			case 'o':
+				dump_write = optarg;
+				break;
+			default:
+				exit(1);
+		}
+	}
+
+	if (dump_read)
+		read_dump(dump_read);
+
+	while (optind < argc) {
+		read_symbols(argv[optind++]);
+	}
+
+	for (mod = modules; mod; mod = mod->next) {
+		if (mod->skip)
+			continue;
+
+		buf.pos = 0;
+
+		add_header(&buf);
+		add_versions(&buf, mod);
+		add_depends(&buf, mod, modules);
+		add_moddevtable(&buf, mod);
+
+		sprintf(fname, "%s.mod.c", mod->name);
+		write_if_changed(&buf, fname);
+	}
+
+	if (dump_write)
+		write_dump(dump_write);
+
+	return 0;
+}
+
diff -urN linux-2.6.8-rc2/scripts/mod/modpost.h linux-2.6.8-rc3/scripts/mod/modpost.h
--- linux-2.6.8-rc2/scripts/mod/modpost.h	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/scripts/mod/modpost.h	2004-08-03 15:22:20.359516498 -0700
@@ -0,0 +1,103 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/mman.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <elf.h>
+
+#include "elfconfig.h"
+
+#if KERNEL_ELFCLASS == ELFCLASS32
+
+#define Elf_Ehdr    Elf32_Ehdr 
+#define Elf_Shdr    Elf32_Shdr 
+#define Elf_Sym     Elf32_Sym
+#define ELF_ST_BIND ELF32_ST_BIND
+#define ELF_ST_TYPE ELF32_ST_TYPE
+
+#else
+
+#define Elf_Ehdr    Elf64_Ehdr 
+#define Elf_Shdr    Elf64_Shdr 
+#define Elf_Sym     Elf64_Sym
+#define ELF_ST_BIND ELF64_ST_BIND
+#define ELF_ST_TYPE ELF64_ST_TYPE
+
+#endif
+
+#if KERNEL_ELFDATA != HOST_ELFDATA
+
+static inline void __endian(const void *src, void *dest, unsigned int size)
+{
+	unsigned int i;
+	for (i = 0; i < size; i++)
+		((unsigned char*)dest)[i] = ((unsigned char*)src)[size - i-1];
+}
+
+
+
+#define TO_NATIVE(x)						\
+({								\
+	typeof(x) __x;						\
+	__endian(&(x), &(__x), sizeof(__x));			\
+	__x;							\
+})
+
+#else /* endianness matches */
+
+#define TO_NATIVE(x) (x)
+
+#endif
+
+#define NOFAIL(ptr)   do_nofail((ptr), __FILE__, __LINE__, #ptr)
+void *do_nofail(void *ptr, const char *file, int line, const char *expr);
+
+struct buffer {
+	char *p;
+	int pos;
+	int size;
+};
+
+void __attribute__((format(printf, 2, 3)))
+buf_printf(struct buffer *buf, const char *fmt, ...);
+
+void
+buf_write(struct buffer *buf, const char *s, int len);
+
+struct module {
+	struct module *next;
+	const char *name;
+	struct symbol *unres;
+	int seen;
+	int skip;
+	struct buffer dev_table_buf;
+};
+
+struct elf_info {
+	unsigned long size;
+	Elf_Ehdr     *hdr;
+	Elf_Shdr     *sechdrs;
+	Elf_Sym      *symtab_start;
+	Elf_Sym      *symtab_stop;
+	const char   *strtab;
+	char	     *modinfo;
+	unsigned int modinfo_len;
+};
+
+void handle_moddevtable(struct module *mod, struct elf_info *info,
+			Elf_Sym *sym, const char *symname);
+
+void add_moddevtable(struct buffer *buf, struct module *mod);
+
+void maybe_frob_version(const char *modfilename,
+			void *modinfo,
+			unsigned long modinfo_len,
+			unsigned long modinfo_offset);
+
+void *grab_file(const char *filename, unsigned long *size);
+char* get_next_line(unsigned long *pos, void *file, unsigned long size);
+void release_file(void *file, unsigned long size);
diff -urN linux-2.6.8-rc2/scripts/mod/sumversion.c linux-2.6.8-rc3/scripts/mod/sumversion.c
--- linux-2.6.8-rc2/scripts/mod/sumversion.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.6.8-rc3/scripts/mod/sumversion.c	2004-08-03 15:22:20.361516580 -0700
@@ -0,0 +1,544 @@
+#include <netinet/in.h>
+#include <stdint.h>
+#include <ctype.h>
+#include <errno.h>
+#include <string.h>
+#include "modpost.h"
+
+/* Parse tag=value strings from .modinfo section */
+static char *next_string(char *string, unsigned long *secsize)
+{
+	/* Skip non-zero chars */
+	while (string[0]) {
+		string++;
+		if ((*secsize)-- <= 1)
+			return NULL;
+	}
+
+	/* Skip any zero padding. */
+	while (!string[0]) {
+		string++;
+		if ((*secsize)-- <= 1)
+			return NULL;
+	}
+	return string;
+}
+
+static char *get_modinfo(void *modinfo, unsigned long modinfo_len,
+			 const char *tag)
+{
+	char *p;
+	unsigned int taglen = strlen(tag);
+	unsigned long size = modinfo_len;
+
+	for (p = modinfo; p; p = next_string(p, &size)) {
+		if (strncmp(p, tag, taglen) == 0 && p[taglen] == '=')
+			return p + taglen + 1;
+	}
+	return NULL;
+}
+
+/*
+ * Stolen form Cryptographic API.
+ *
+ * MD4 Message Digest Algorithm (RFC1320).
+ *
+ * Implementation derived from Andrew Tridgell and Steve French's
+ * CIFS MD4 implementation, and the cryptoapi implementation
+ * originally based on the public domain implementation written
+ * by Colin Plumb in 1993.
+ *
+ * Copyright (c) Andrew Tridgell 1997-1998.
+ * Modified by Steve French (sfrench@us.ibm.com) 2002
+ * Copyright (c) Cryptoapi developers.
+ * Copyright (c) 2002 David S. Miller (davem@redhat.com)
+ * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ */
+#define MD4_DIGEST_SIZE		16
+#define MD4_HMAC_BLOCK_SIZE	64
+#define MD4_BLOCK_WORDS		16
+#define MD4_HASH_WORDS		4
+
+struct md4_ctx {
+	uint32_t hash[MD4_HASH_WORDS];
+	uint32_t block[MD4_BLOCK_WORDS];
+	uint64_t byte_count;
+};
+
+static inline uint32_t lshift(uint32_t x, unsigned int s)
+{
+	x &= 0xFFFFFFFF;
+	return ((x << s) & 0xFFFFFFFF) | (x >> (32 - s));
+}
+
+static inline uint32_t F(uint32_t x, uint32_t y, uint32_t z)
+{
+	return (x & y) | ((~x) & z);
+}
+
+static inline uint32_t G(uint32_t x, uint32_t y, uint32_t z)
+{
+	return (x & y) | (x & z) | (y & z);
+}
+
+static inline uint32_t H(uint32_t x, uint32_t y, uint32_t z)
+{
+	return x ^ y ^ z;
+}
+
+#define ROUND1(a,b,c,d,k,s) (a = lshift(a + F(b,c,d) + k, s))
+#define ROUND2(a,b,c,d,k,s) (a = lshift(a + G(b,c,d) + k + (uint32_t)0x5A827999,s))
+#define ROUND3(a,b,c,d,k,s) (a = lshift(a + H(b,c,d) + k + (uint32_t)0x6ED9EBA1,s))
+
+/* XXX: this stuff can be optimized */
+static inline void le32_to_cpu_array(uint32_t *buf, unsigned int words)
+{
+	while (words--) {
+		*buf = ntohl(*buf);
+		buf++;
+	}
+}
+
+static inline void cpu_to_le32_array(uint32_t *buf, unsigned int words)
+{
+	while (words--) {
+		*buf = htonl(*buf);
+		buf++;
+	}
+}
+
+static void md4_transform(uint32_t *hash, uint32_t const *in)
+{
+	uint32_t a, b, c, d;
+
+	a = hash[0];
+	b = hash[1];
+	c = hash[2];
+	d = hash[3];
+
+	ROUND1(a, b, c, d, in[0], 3);
+	ROUND1(d, a, b, c, in[1], 7);
+	ROUND1(c, d, a, b, in[2], 11);
+	ROUND1(b, c, d, a, in[3], 19);
+	ROUND1(a, b, c, d, in[4], 3);
+	ROUND1(d, a, b, c, in[5], 7);
+	ROUND1(c, d, a, b, in[6], 11);
+	ROUND1(b, c, d, a, in[7], 19);
+	ROUND1(a, b, c, d, in[8], 3);
+	ROUND1(d, a, b, c, in[9], 7);
+	ROUND1(c, d, a, b, in[10], 11);
+	ROUND1(b, c, d, a, in[11], 19);
+	ROUND1(a, b, c, d, in[12], 3);
+	ROUND1(d, a, b, c, in[13], 7);
+	ROUND1(c, d, a, b, in[14], 11);
+	ROUND1(b, c, d, a, in[15], 19);
+
+	ROUND2(a, b, c, d,in[ 0], 3);
+	ROUND2(d, a, b, c, in[4], 5);
+	ROUND2(c, d, a, b, in[8], 9);
+	ROUND2(b, c, d, a, in[12], 13);
+	ROUND2(a, b, c, d, in[1], 3);
+	ROUND2(d, a, b, c, in[5], 5);
+	ROUND2(c, d, a, b, in[9], 9);
+	ROUND2(b, c, d, a, in[13], 13);
+	ROUND2(a, b, c, d, in[2], 3);
+	ROUND2(d, a, b, c, in[6], 5);
+	ROUND2(c, d, a, b, in[10], 9);
+	ROUND2(b, c, d, a, in[14], 13);
+	ROUND2(a, b, c, d, in[3], 3);
+	ROUND2(d, a, b, c, in[7], 5);
+	ROUND2(c, d, a, b, in[11], 9);
+	ROUND2(b, c, d, a, in[15], 13);
+
+	ROUND3(a, b, c, d,in[ 0], 3);
+	ROUND3(d, a, b, c, in[8], 9);
+	ROUND3(c, d, a, b, in[4], 11);
+	ROUND3(b, c, d, a, in[12], 15);
+	ROUND3(a, b, c, d, in[2], 3);
+	ROUND3(d, a, b, c, in[10], 9);
+	ROUND3(c, d, a, b, in[6], 11);
+	ROUND3(b, c, d, a, in[14], 15);
+	ROUND3(a, b, c, d, in[1], 3);
+	ROUND3(d, a, b, c, in[9], 9);
+	ROUND3(c, d, a, b, in[5], 11);
+	ROUND3(b, c, d, a, in[13], 15);
+	ROUND3(a, b, c, d, in[3], 3);
+	ROUND3(d, a, b, c, in[11], 9);
+	ROUND3(c, d, a, b, in[7], 11);
+	ROUND3(b, c, d, a, in[15], 15);
+
+	hash[0] += a;
+	hash[1] += b;
+	hash[2] += c;
+	hash[3] += d;
+}
+
+static inline void md4_transform_helper(struct md4_ctx *ctx)
+{
+	le32_to_cpu_array(ctx->block, sizeof(ctx->block) / sizeof(uint32_t));
+	md4_transform(ctx->hash, ctx->block);
+}
+
+static void md4_init(struct md4_ctx *mctx)
+{
+	mctx->hash[0] = 0x67452301;
+	mctx->hash[1] = 0xefcdab89;
+	mctx->hash[2] = 0x98badcfe;
+	mctx->hash[3] = 0x10325476;
+	mctx->byte_count = 0;
+}
+
+static void md4_update(struct md4_ctx *mctx,
+		       const unsigned char *data, unsigned int len)
+{
+	const uint32_t avail = sizeof(mctx->block) - (mctx->byte_count & 0x3f);
+
+	mctx->byte_count += len;
+
+	if (avail > len) {
+		memcpy((char *)mctx->block + (sizeof(mctx->block) - avail),
+		       data, len);
+		return;
+	}
+
+	memcpy((char *)mctx->block + (sizeof(mctx->block) - avail),
+	       data, avail);
+
+	md4_transform_helper(mctx);
+	data += avail;
+	len -= avail;
+
+	while (len >= sizeof(mctx->block)) {
+		memcpy(mctx->block, data, sizeof(mctx->block));
+		md4_transform_helper(mctx);
+		data += sizeof(mctx->block);
+		len -= sizeof(mctx->block);
+	}
+
+	memcpy(mctx->block, data, len);
+}
+
+static void md4_final_ascii(struct md4_ctx *mctx, char *out, unsigned int len)
+{
+	const unsigned int offset = mctx->byte_count & 0x3f;
+	char *p = (char *)mctx->block + offset;
+	int padding = 56 - (offset + 1);
+
+	*p++ = 0x80;
+	if (padding < 0) {
+		memset(p, 0x00, padding + sizeof (uint64_t));
+		md4_transform_helper(mctx);
+		p = (char *)mctx->block;
+		padding = 56;
+	}
+
+	memset(p, 0, padding);
+	mctx->block[14] = mctx->byte_count << 3;
+	mctx->block[15] = mctx->byte_count >> 29;
+	le32_to_cpu_array(mctx->block, (sizeof(mctx->block) -
+	                  sizeof(uint64_t)) / sizeof(uint32_t));
+	md4_transform(mctx->hash, mctx->block);
+	cpu_to_le32_array(mctx->hash, sizeof(mctx->hash) / sizeof(uint32_t));
+
+	snprintf(out, len, "%08X%08X%08X%08X",
+		 mctx->hash[0], mctx->hash[1], mctx->hash[2], mctx->hash[3]);
+}
+
+static inline void add_char(unsigned char c, struct md4_ctx *md)
+{
+	md4_update(md, &c, 1);
+}
+
+static int parse_string(const char *file, unsigned long len,
+			struct md4_ctx *md)
+{
+	unsigned long i;
+
+	add_char(file[0], md);
+	for (i = 1; i < len; i++) {
+		add_char(file[i], md);
+		if (file[i] == '"' && file[i-1] != '\\')
+			break;
+	}
+	return i;
+}
+
+static int parse_comment(const char *file, unsigned long len)
+{
+	unsigned long i;
+
+	for (i = 2; i < len; i++) {
+		if (file[i-1] == '*' && file[i] == '/')
+			break;
+	}
+	return i;
+}
+
+/* FIXME: Handle .s files differently (eg. # starts comments) --RR */
+static int parse_file(const char *fname, struct md4_ctx *md)
+{
+	char *file;
+	unsigned long i, len;
+
+	file = grab_file(fname, &len);
+	if (!file)
+		return 0;
+
+	for (i = 0; i < len; i++) {
+		/* Collapse and ignore \ and CR. */
+		if (file[i] == '\\' && (i+1 < len) && file[i+1] == '\n') {
+			i++;
+			continue;
+		}
+
+		/* Ignore whitespace */
+		if (isspace(file[i]))
+			continue;
+
+		/* Handle strings as whole units */
+		if (file[i] == '"') {
+			i += parse_string(file+i, len - i, md);
+			continue;
+		}
+
+		/* Comments: ignore */
+		if (file[i] == '/' && file[i+1] == '*') {
+			i += parse_comment(file+i, len - i);
+			continue;
+		}
+
+		add_char(file[i], md);
+	}
+	release_file(file, len);
+	return 1;
+}
+
+/* We have dir/file.o.  Open dir/.file.o.cmd, look for deps_ line to
+ * figure out source file. */
+static int parse_source_files(const char *objfile, struct md4_ctx *md)
+{
+	char *cmd, *file, *line, *dir;
+	const char *base;
+	unsigned long flen, pos = 0;
+	int dirlen, ret = 0, check_files = 0;
+
+	cmd = NOFAIL(malloc(strlen(objfile) + sizeof("..cmd")));
+
+	base = strrchr(objfile, '/');
+	if (base) {
+		base++;
+		dirlen = base - objfile;
+		sprintf(cmd, "%.*s.%s.cmd", dirlen, objfile, base);
+	} else {
+		dirlen = 0;
+		sprintf(cmd, ".%s.cmd", objfile);
+	}
+	dir = NOFAIL(malloc(dirlen + 1));
+	strncpy(dir, objfile, dirlen);
+	dir[dirlen] = '\0';
+
+	file = grab_file(cmd, &flen);
+	if (!file) {
+		fprintf(stderr, "Warning: could not find %s for %s\n",
+			cmd, objfile);
+		goto out;
+	}
+
+	/* There will be a line like so:
+		deps_drivers/net/dummy.o := \
+		  drivers/net/dummy.c \
+		    $(wildcard include/config/net/fastroute.h) \
+		  include/linux/config.h \
+		    $(wildcard include/config/h.h) \
+		  include/linux/module.h \
+
+	   Sum all files in the same dir or subdirs.
+	*/
+	while ((line = get_next_line(&pos, file, flen)) != NULL) {
+		char* p = line;
+		if (strncmp(line, "deps_", sizeof("deps_")-1) == 0) {
+			check_files = 1;
+			continue;
+		}
+		if (!check_files)
+			continue;
+
+		/* Continue until line does not end with '\' */
+		if ( *(p + strlen(p)-1) != '\\')
+			break;
+		/* Terminate line at first space, to get rid of final ' \' */
+		while (*p) {
+                       if (isspace(*p)) {
+				*p = '\0';
+				break;
+			}
+			p++;
+		}
+
+		/* Check if this file is in same dir as objfile */
+		if ((strstr(line, dir)+strlen(dir)-1) == strrchr(line, '/')) {
+			if (!parse_file(line, md)) {
+				fprintf(stderr,
+					"Warning: could not open %s: %s\n",
+					line, strerror(errno));
+				goto out_file;
+			}
+
+		}
+
+	}
+
+	/* Everyone parsed OK */
+	ret = 1;
+out_file:
+	release_file(file, flen);
+out:
+	free(dir);
+	free(cmd);
+	return ret;
+}
+
+static int get_version(const char *modname, char sum[])
+{
+	void *file;
+	unsigned long len;
+	int ret = 0;
+	struct md4_ctx md;
+	char *sources, *end, *fname;
+	const char *basename;
+	char filelist[sizeof(".tmp_versions/%s.mod") + strlen(modname)];
+
+	/* Source files for module are in .tmp_versions/modname.mod,
+	   after the first line. */
+	if (strrchr(modname, '/'))
+		basename = strrchr(modname, '/') + 1;
+	else
+		basename = modname;
+	sprintf(filelist, ".tmp_versions/%s", basename);
+	/* Truncate .o, add .mod */
+	strcpy(filelist + strlen(filelist)-2, ".mod");
+
+	file = grab_file(filelist, &len);
+	if (!file) {
+		fprintf(stderr, "Warning: could not find versions for %s\n",
+			filelist);
+		return 0;
+	}
+
+	sources = strchr(file, '\n');
+	if (!sources) {
+		fprintf(stderr, "Warning: malformed versions file for %s\n",
+			modname);
+		goto release;
+	}
+
+	sources++;
+	end = strchr(sources, '\n');
+	if (!end) {
+		fprintf(stderr, "Warning: bad ending versions file for %s\n",
+			modname);
+		goto release;
+	}
+	*end = '\0';
+
+	md4_init(&md);
+	for (fname = strtok(sources, " "); fname; fname = strtok(NULL, " ")) {
+		if (!parse_source_files(fname, &md))
+			goto release;
+	}
+
+	/* sum is of form \0<padding>. */
+	md4_final_ascii(&md, sum, 1 + strlen(sum+1));
+	ret = 1;
+release:
+	release_file(file, len);
+	return ret;
+}
+
+static void write_version(const char *filename, const char *sum,
+			  unsigned long offset)
+{
+	int fd;
+
+	fd = open(filename, O_RDWR);
+	if (fd < 0) {
+		fprintf(stderr, "Warning: changing sum in %s failed: %s\n",
+			filename, strerror(errno));
+		return;
+	}
+
+	if (lseek(fd, offset, SEEK_SET) == (off_t)-1) {
+		fprintf(stderr, "Warning: changing sum in %s:%lu failed: %s\n",
+			filename, offset, strerror(errno));
+		goto out;
+	}
+
+	if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
+		fprintf(stderr, "Warning: writing sum in %s failed: %s\n",
+			filename, strerror(errno));
+		goto out;
+	}
+out:
+	close(fd);
+}
+
+void strip_rcs_crap(char *version)
+{
+	unsigned int len, full_len;
+
+	if (strncmp(version, "$Revision", strlen("$Revision")) != 0)
+		return;
+
+	/* Space for version string follows. */
+	full_len = strlen(version) + strlen(version + strlen(version) + 1) + 2;
+
+	/* Move string to start with version number: prefix will be
+	 * $Revision$ or $Revision: */
+	len = strlen("$Revision");
+	if (version[len] == ':' || version[len] == '$')
+		len++;
+	while (isspace(version[len]))
+		len++;
+	memmove(version, version+len, full_len-len);
+	full_len -= len;
+
+	/* Preserve up to next whitespace. */
+	len = 0;
+	while (version[len] && !isspace(version[len]))
+		len++;
+	memmove(version + len, version + strlen(version),
+		full_len - strlen(version));
+}
+
+/* If the modinfo contains a "version" value, then set this. */
+void maybe_frob_version(const char *modfilename,
+			void *modinfo,
+			unsigned long modinfo_len,
+			unsigned long modinfo_offset)
+{
+	char *version, *csum;
+
+	version = get_modinfo(modinfo, modinfo_len, "version");
+	if (!version)
+		return;
+
+	/* RCS $Revision gets stripped out. */
+	strip_rcs_crap(version);
+
+	/* Check against double sumversion */
+	if (strchr(version, ' '))
+		return;
+
+	/* Version contains embedded NUL: second half has space for checksum */
+	csum = version + strlen(version);
+	*(csum++) = ' ';
+	if (get_version(modfilename, csum))
+		write_version(modfilename, version,
+			      modinfo_offset + (version - (char *)modinfo));
+}
diff -urN linux-2.6.8-rc2/scripts/modpost.c linux-2.6.8-rc3/scripts/modpost.c
--- linux-2.6.8-rc2/scripts/modpost.c	2004-06-15 22:19:01.000000000 -0700
+++ linux-2.6.8-rc3/scripts/modpost.c	1969-12-31 16:00:00.000000000 -0800
@@ -1,739 +0,0 @@
-/* Postprocess module symbol versions
- *
- * Copyright 2003       Kai Germaschewski
- *           2002-2003  Rusty Russell, IBM Corporation
- *
- * Based in part on module-init-tools/depmod.c,file2alias
- *
- * This software may be used and distributed according to the terms
- * of the GNU General Public License, incorporated herein by reference.
- *
- * Usage: modpost vmlinux module1.o module2.o ...
- */
-
-#include <ctype.h>
-#include "modpost.h"
-
-/* Are we using CONFIG_MODVERSIONS? */
-int modversions = 0;
-/* Warn about undefined symbols? (do so if we have vmlinux) */
-int have_vmlinux = 0;
-
-void
-fatal(const char *fmt, ...)
-{
-	va_list arglist;
-
-	fprintf(stderr, "FATAL: ");
-
-	va_start(arglist, fmt);
-	vfprintf(stderr, fmt, arglist);
-	va_end(arglist);
-
-	exit(1);
-}
-
-void
-warn(const char *fmt, ...)
-{
-	va_list arglist;
-
-	fprintf(stderr, "WARNING: ");
-
-	va_start(arglist, fmt);
-	vfprintf(stderr, fmt, arglist);
-	va_end(arglist);
-}
-
-void *do_nofail(void *ptr, const char *file, int line, const char *expr)
-{
-	if (!ptr) {
-		fatal("Memory allocation failure %s line %d: %s.\n",
-		      file, line, expr);
-	}
-	return ptr;
-}
-
-/* A list of all modules we processed */
-
-static struct module *modules;
-
-struct module *
-find_module(char *modname)
-{
-	struct module *mod;
-
-	for (mod = modules; mod; mod = mod->next)
-		if (strcmp(mod->name, modname) == 0)
-			break;
-	return mod;
-}
-
-struct module *
-new_module(char *modname)
-{
-	struct module *mod;
-	char *p, *s;
-	
-	mod = NOFAIL(malloc(sizeof(*mod)));
-	memset(mod, 0, sizeof(*mod));
-	p = NOFAIL(strdup(modname));
-
-	/* strip trailing .o */
-	if ((s = strrchr(p, '.')) != NULL)
-		if (strcmp(s, ".o") == 0)
-			*s = '\0';
-
-	/* add to list */
-	mod->name = p;
-	mod->next = modules;
-	modules = mod;
-
-	return mod;
-}
-
-/* A hash of all exported symbols,
- * struct symbol is also used for lists of unresolved symbols */
-
-#define SYMBOL_HASH_SIZE 1024
-
-struct symbol {
-	struct symbol *next;
-	struct module *module;
-	unsigned int crc;
-	int crc_valid;
-	char name[0];
-};
-
-static struct symbol *symbolhash[SYMBOL_HASH_SIZE];
-
-/* This is based on the hash agorithm from gdbm, via tdb */
-static inline unsigned int tdb_hash(const char *name)
-{
-	unsigned value;	/* Used to compute the hash value.  */
-	unsigned   i;	/* Used to cycle through random values. */
-
-	/* Set the initial value from the key size. */
-	for (value = 0x238F13AF * strlen(name), i=0; name[i]; i++)
-		value = (value + (((unsigned char *)name)[i] << (i*5 % 24)));
-
-	return (1103515243 * value + 12345);
-}
-
-/* Allocate a new symbols for use in the hash of exported symbols or
- * the list of unresolved symbols per module */
-
-struct symbol *
-alloc_symbol(const char *name, struct symbol *next)
-{
-	struct symbol *s = NOFAIL(malloc(sizeof(*s) + strlen(name) + 1));
-
-	memset(s, 0, sizeof(*s));
-	strcpy(s->name, name);
-	s->next = next;
-	return s;
-}
-
-/* For the hash of exported symbols */
-
-void
-new_symbol(const char *name, struct module *module, unsigned int *crc)
-{
-	unsigned int hash;
-	struct symbol *new;
-
-	hash = tdb_hash(name) % SYMBOL_HASH_SIZE;
-	new = symbolhash[hash] = alloc_symbol(name, symbolhash[hash]);
-	new->module = module;
-	if (crc) {
-		new->crc = *crc;
-		new->crc_valid = 1;
-	}
-}
-
-struct symbol *
-find_symbol(const char *name)
-{
-	struct symbol *s;
-
-	/* For our purposes, .foo matches foo.  PPC64 needs this. */
-	if (name[0] == '.')
-		name++;
-
-	for (s = symbolhash[tdb_hash(name) % SYMBOL_HASH_SIZE]; s; s=s->next) {
-		if (strcmp(s->name, name) == 0)
-			return s;
-	}
-	return NULL;
-}
-
-/* Add an exported symbol - it may have already been added without a
- * CRC, in this case just update the CRC */
-void
-add_exported_symbol(const char *name, struct module *module, unsigned int *crc)
-{
-	struct symbol *s = find_symbol(name);
-
-	if (!s) {
-		new_symbol(name, module, crc);
-		return;
-	}
-	if (crc) {
-		s->crc = *crc;
-		s->crc_valid = 1;
-	}
-}
-
-void *
-grab_file(const char *filename, unsigned long *size)
-{
-	struct stat st;
-	void *map;
-	int fd;
-
-	fd = open(filename, O_RDONLY);
-	if (fd < 0 || fstat(fd, &st) != 0)
-		return NULL;
-
-	*size = st.st_size;
-	map = mmap(NULL, *size, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0);
-	close(fd);
-
-	if (map == MAP_FAILED)
-		return NULL;
-	return map;
-}
-
-/*
-   Return a copy of the next line in a mmap'ed file.
-   spaces in the beginning of the line is trimmed away.
-   Return a pointer to a static buffer.
-*/
-char*
-get_next_line(unsigned long *pos, void *file, unsigned long size)
-{
-	static char line[4096];
-	int skip = 1;
-	size_t len = 0;
-	char *p = (char *)file + *pos;
-	char *s = line;
-
-	for (; *pos < size ; (*pos)++)
-	{
-		if (skip && isspace(*p)) {
-			p++;
-			continue;
-		}
-		skip = 0;
-		if (*p != '\n' && (*pos < size)) {
-			len++;
-			*s++ = *p++;
-			if (len > 4095)
-				break; /* Too long, stop */
-		} else {
-			/* End of string */
-			*s = '\0';
-			return line;
-		}
-	}
-	/* End of buffer */
-	return NULL;
-}
-
-void
-release_file(void *file, unsigned long size)
-{
-	munmap(file, size);
-}
-
-void
-parse_elf(struct elf_info *info, const char *filename)
-{
-	unsigned int i;
-	Elf_Ehdr *hdr = info->hdr;
-	Elf_Shdr *sechdrs;
-	Elf_Sym  *sym;
-
-	hdr = grab_file(filename, &info->size);
-	if (!hdr) {
-		perror(filename);
-		abort();
-	}
-	info->hdr = hdr;
-	if (info->size < sizeof(*hdr))
-		goto truncated;
-
-	/* Fix endianness in ELF header */
-	hdr->e_shoff    = TO_NATIVE(hdr->e_shoff);
-	hdr->e_shstrndx = TO_NATIVE(hdr->e_shstrndx);
-	hdr->e_shnum    = TO_NATIVE(hdr->e_shnum);
-	hdr->e_machine  = TO_NATIVE(hdr->e_machine);
-	sechdrs = (void *)hdr + hdr->e_shoff;
-	info->sechdrs = sechdrs;
-
-	/* Fix endianness in section headers */
-	for (i = 0; i < hdr->e_shnum; i++) {
-		sechdrs[i].sh_type   = TO_NATIVE(sechdrs[i].sh_type);
-		sechdrs[i].sh_offset = TO_NATIVE(sechdrs[i].sh_offset);
-		sechdrs[i].sh_size   = TO_NATIVE(sechdrs[i].sh_size);
-		sechdrs[i].sh_link   = TO_NATIVE(sechdrs[i].sh_link);
-		sechdrs[i].sh_name   = TO_NATIVE(sechdrs[i].sh_name);
-	}
-	/* Find symbol table. */
-	for (i = 1; i < hdr->e_shnum; i++) {
-		const char *secstrings
-			= (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
-
-		if (sechdrs[i].sh_offset > info->size)
-			goto truncated;
-		if (strcmp(secstrings+sechdrs[i].sh_name, ".modinfo") == 0) {
-			info->modinfo = (void *)hdr + sechdrs[i].sh_offset;
-			info->modinfo_len = sechdrs[i].sh_size;
-		}
-		if (sechdrs[i].sh_type != SHT_SYMTAB)
-			continue;
-
-		info->symtab_start = (void *)hdr + sechdrs[i].sh_offset;
-		info->symtab_stop  = (void *)hdr + sechdrs[i].sh_offset 
-			                         + sechdrs[i].sh_size;
-		info->strtab       = (void *)hdr + 
-			             sechdrs[sechdrs[i].sh_link].sh_offset;
-	}
-	if (!info->symtab_start) {
-		fprintf(stderr, "modpost: %s no symtab?\n", filename);
-		abort();
-	}
-	/* Fix endianness in symbols */
-	for (sym = info->symtab_start; sym < info->symtab_stop; sym++) {
-		sym->st_shndx = TO_NATIVE(sym->st_shndx);
-		sym->st_name  = TO_NATIVE(sym->st_name);
-		sym->st_value = TO_NATIVE(sym->st_value);
-		sym->st_size  = TO_NATIVE(sym->st_size);
-	}
-	return;
-
- truncated:
-	fprintf(stderr, "modpost: %s is truncated.\n", filename);
-	abort();
-}
-
-void
-parse_elf_finish(struct elf_info *info)
-{
-	release_file(info->hdr, info->size);
-}
-
-#define CRC_PFX     MODULE_SYMBOL_PREFIX "__crc_"
-#define KSYMTAB_PFX MODULE_SYMBOL_PREFIX "__ksymtab_"
-
-void
-handle_modversions(struct module *mod, struct elf_info *info,
-		   Elf_Sym *sym, const char *symname)
-{
-	unsigned int crc;
-
-	switch (sym->st_shndx) {
-	case SHN_COMMON:
-		fprintf(stderr, "*** Warning: \"%s\" [%s] is COMMON symbol\n",
-			symname, mod->name);
-		break;
-	case SHN_ABS:
-		/* CRC'd symbol */
-		if (memcmp(symname, CRC_PFX, strlen(CRC_PFX)) == 0) {
-			crc = (unsigned int) sym->st_value;
-			add_exported_symbol(symname + strlen(CRC_PFX),
-					    mod, &crc);
-			modversions = 1;
-		}
-		break;
-	case SHN_UNDEF:
-		/* undefined symbol */
-		if (ELF_ST_BIND(sym->st_info) != STB_GLOBAL)
-			break;
-		/* ignore global offset table */
-		if (strcmp(symname, "_GLOBAL_OFFSET_TABLE_") == 0)
-			break;
-		/* ignore __this_module, it will be resolved shortly */
-		if (strcmp(symname, MODULE_SYMBOL_PREFIX "__this_module") == 0)
-			break;
-#ifdef STT_REGISTER
-		if (info->hdr->e_machine == EM_SPARC ||
-		    info->hdr->e_machine == EM_SPARCV9) {
-			/* Ignore register directives. */
-			if (ELF_ST_TYPE(sym->st_info) == STT_REGISTER)
-				break;
-		}
-#endif
-		
-		if (memcmp(symname, MODULE_SYMBOL_PREFIX,
-			   strlen(MODULE_SYMBOL_PREFIX)) == 0)
-			mod->unres = alloc_symbol(symname +
-						  strlen(MODULE_SYMBOL_PREFIX),
-						  mod->unres);
-		break;
-	default:
-		/* All exported symbols */
-		if (memcmp(symname, KSYMTAB_PFX, strlen(KSYMTAB_PFX)) == 0) {
-			add_exported_symbol(symname + strlen(KSYMTAB_PFX),
-					    mod, NULL);
-		}
-		break;
-	}
-}
-
-int
-is_vmlinux(const char *modname)
-{
-	const char *myname;
-
-	if ((myname = strrchr(modname, '/')))
-		myname++;
-	else
-		myname = modname;
-
-	return strcmp(myname, "vmlinux") == 0;
-}
-
-void
-read_symbols(char *modname)
-{
-	const char *symname;
-	struct module *mod;
-	struct elf_info info = { };
-	Elf_Sym *sym;
-
-	parse_elf(&info, modname);
-
-	mod = new_module(modname);
-
-	/* When there's no vmlinux, don't print warnings about
-	 * unresolved symbols (since there'll be too many ;) */
-	if (is_vmlinux(modname)) {
-		unsigned int fake_crc = 0;
-		have_vmlinux = 1;
-		/* May not have this if !CONFIG_MODULE_UNLOAD: fake it.
-		   If it appears, we'll get the real CRC. */
-		add_exported_symbol("cleanup_module", mod, &fake_crc);
-		add_exported_symbol("struct_module", mod, &fake_crc);
-		mod->skip = 1;
-	}
-
-	for (sym = info.symtab_start; sym < info.symtab_stop; sym++) {
-		symname = info.strtab + sym->st_name;
-
-		handle_modversions(mod, &info, sym, symname);
-		handle_moddevtable(mod, &info, sym, symname);
-	}
-	maybe_frob_version(modname, info.modinfo, info.modinfo_len,
-			   (void *)info.modinfo - (void *)info.hdr);
-	parse_elf_finish(&info);
-
-	/* Our trick to get versioning for struct_module - it's
-	 * never passed as an argument to an exported function, so
-	 * the automatic versioning doesn't pick it up, but it's really
-	 * important anyhow */
-	if (modversions) {
-		mod->unres = alloc_symbol("struct_module", mod->unres);
-
-		/* Always version init_module and cleanup_module, in
-		 * case module doesn't have its own. */
-		mod->unres = alloc_symbol("init_module", mod->unres);
-		mod->unres = alloc_symbol("cleanup_module", mod->unres);
-	}
-}
-
-#define SZ 500
-
-/* We first write the generated file into memory using the
- * following helper, then compare to the file on disk and
- * only update the later if anything changed */
-
-void __attribute__((format(printf, 2, 3)))
-buf_printf(struct buffer *buf, const char *fmt, ...)
-{
-	char tmp[SZ];
-	int len;
-	va_list ap;
-	
-	va_start(ap, fmt);
-	len = vsnprintf(tmp, SZ, fmt, ap);
-	if (buf->size - buf->pos < len + 1) {
-		buf->size += 128;
-		buf->p = realloc(buf->p, buf->size);
-	}
-	strncpy(buf->p + buf->pos, tmp, len + 1);
-	buf->pos += len;
-	va_end(ap);
-}
-
-void
-buf_write(struct buffer *buf, const char *s, int len)
-{
-	if (buf->size - buf->pos < len) {
-		buf->size += len;
-		buf->p = realloc(buf->p, buf->size);
-	}
-	strncpy(buf->p + buf->pos, s, len);
-	buf->pos += len;
-}
-
-/* Header for the generated file */
-
-void
-add_header(struct buffer *b)
-{
-	buf_printf(b, "#include <linux/module.h>\n");
-	buf_printf(b, "#include <linux/vermagic.h>\n");
-	buf_printf(b, "#include <linux/compiler.h>\n");
-	buf_printf(b, "\n");
-	buf_printf(b, "MODULE_INFO(vermagic, VERMAGIC_STRING);\n");
-	buf_printf(b, "\n");
-	buf_printf(b, "#undef unix\n"); /* We have a module called "unix" */
-	buf_printf(b, "struct module __this_module\n");
-	buf_printf(b, "__attribute__((section(\".gnu.linkonce.this_module\"))) = {\n");
-	buf_printf(b, " .name = __stringify(KBUILD_MODNAME),\n");
-	buf_printf(b, " .init = init_module,\n");
-	buf_printf(b, "#ifdef CONFIG_MODULE_UNLOAD\n");
-	buf_printf(b, " .exit = cleanup_module,\n");
-	buf_printf(b, "#endif\n");
-	buf_printf(b, "};\n");
-}
-
-/* Record CRCs for unresolved symbols */
-
-void
-add_versions(struct buffer *b, struct module *mod)
-{
-	struct symbol *s, *exp;
-
-	for (s = mod->unres; s; s = s->next) {
-		exp = find_symbol(s->name);
-		if (!exp || exp->module == mod) {
-			if (have_vmlinux)
-				fprintf(stderr, "*** Warning: \"%s\" [%s.ko] "
-				"undefined!\n",	s->name, mod->name);
-			continue;
-		}
-		s->module = exp->module;
-		s->crc_valid = exp->crc_valid;
-		s->crc = exp->crc;
-	}
-
-	if (!modversions)
-		return;
-
-	buf_printf(b, "\n");
-	buf_printf(b, "static const struct modversion_info ____versions[]\n");
-	buf_printf(b, "__attribute_used__\n");
-	buf_printf(b, "__attribute__((section(\"__versions\"))) = {\n");
-
-	for (s = mod->unres; s; s = s->next) {
-		if (!s->module) {
-			continue;
-		}
-		if (!s->crc_valid) {
-			fprintf(stderr, "*** Warning: \"%s\" [%s.ko] "
-				"has no CRC!\n",
-				s->name, mod->name);
-			continue;
-		}
-		buf_printf(b, "\t{ %#8x, \"%s\" },\n", s->crc, s->name);
-	}
-
-	buf_printf(b, "};\n");
-}
-
-void
-add_depends(struct buffer *b, struct module *mod, struct module *modules)
-{
-	struct symbol *s;
-	struct module *m;
-	int first = 1;
-
-	for (m = modules; m; m = m->next) {
-		m->seen = is_vmlinux(m->name);
-	}
-
-	buf_printf(b, "\n");
-	buf_printf(b, "static const char __module_depends[]\n");
-	buf_printf(b, "__attribute_used__\n");
-	buf_printf(b, "__attribute__((section(\".modinfo\"))) =\n");
-	buf_printf(b, "\"depends=");
-	for (s = mod->unres; s; s = s->next) {
-		if (!s->module)
-			continue;
-
-		if (s->module->seen)
-			continue;
-
-		s->module->seen = 1;
-		buf_printf(b, "%s%s", first ? "" : ",",
-			   strrchr(s->module->name, '/') + 1);
-		first = 0;
-	}
-	buf_printf(b, "\";\n");
-}
-
-void
-write_if_changed(struct buffer *b, const char *fname)
-{
-	char *tmp;
-	FILE *file;
-	struct stat st;
-
-	file = fopen(fname, "r");
-	if (!file)
-		goto write;
-
-	if (fstat(fileno(file), &st) < 0)
-		goto close_write;
-
-	if (st.st_size != b->pos)
-		goto close_write;
-
-	tmp = NOFAIL(malloc(b->pos));
-	if (fread(tmp, 1, b->pos, file) != b->pos)
-		goto free_write;
-
-	if (memcmp(tmp, b->p, b->pos) != 0)
-		goto free_write;
-
-	free(tmp);
-	fclose(file);
-	return;
-
- free_write:
-	free(tmp);
- close_write:
-	fclose(file);
- write:
-	file = fopen(fname, "w");
-	if (!file) {
-		perror(fname);
-		exit(1);
-	}
-	if (fwrite(b->p, 1, b->pos, file) != b->pos) {
-		perror(fname);
-		exit(1);
-	}
-	fclose(file);
-}
-
-void
-read_dump(const char *fname)
-{
-	unsigned long size, pos = 0;
-	void *file = grab_file(fname, &size);
-	char *line;
-
-        if (!file)
-		/* No symbol versions, silently ignore */
-		return;
-
-	while ((line = get_next_line(&pos, file, size))) {
-		char *symname, *modname, *d;
-		unsigned int crc;
-		struct module *mod;
-
-		if (!(symname = strchr(line, '\t')))
-			goto fail;
-		*symname++ = '\0';
-		if (!(modname = strchr(symname, '\t')))
-			goto fail;
-		*modname++ = '\0';
-		if (strchr(modname, '\t'))
-			goto fail;
-		crc = strtoul(line, &d, 16);
-		if (*symname == '\0' || *modname == '\0' || *d != '\0')
-			goto fail;
-
-		if (!(mod = find_module(modname))) {
-			if (is_vmlinux(modname)) {
-				modversions = 1;
-				have_vmlinux = 1;
-			}
-			mod = new_module(NOFAIL(strdup(modname)));
-			mod->skip = 1;
-		}
-		add_exported_symbol(symname, mod, &crc);
-	}
-	return;
-fail:
-	fatal("parse error in symbol dump file\n");
-}
-
-void
-write_dump(const char *fname)
-{
-	struct buffer buf = { };
-	struct symbol *symbol;
-	int n;
-
-	for (n = 0; n < SYMBOL_HASH_SIZE ; n++) {
-		symbol = symbolhash[n];
-		while (symbol) {
-			symbol = symbol->next;
-		}
-	}
-
-	for (n = 0; n < SYMBOL_HASH_SIZE ; n++) {
-		symbol = symbolhash[n];
-		while (symbol) {
-			buf_printf(&buf, "0x%08x\t%s\t%s\n", symbol->crc,
-				symbol->name, symbol->module->name);
-			symbol = symbol->next;
-		}
-	}
-	write_if_changed(&buf, fname);
-}
-
-int
-main(int argc, char **argv)
-{
-	struct module *mod;
-	struct buffer buf = { };
-	char fname[SZ];
-	char *dump_read = NULL, *dump_write = NULL;
-	int opt;
-
-	while ((opt = getopt(argc, argv, "i:o:")) != -1) {
-		switch(opt) {
-			case 'i':
-				dump_read = optarg;
-				break;
-			case 'o':
-				dump_write = optarg;
-				break;
-			default:
-				exit(1);
-		}
-	}
-
-	if (dump_read)
-		read_dump(dump_read);
-
-	while (optind < argc) {
-		read_symbols(argv[optind++]);
-	}
-
-	for (mod = modules; mod; mod = mod->next) {
-		if (mod->skip)
-			continue;
-
-		buf.pos = 0;
-
-		add_header(&buf);
-		add_versions(&buf, mod);
-		add_depends(&buf, mod, modules);
-		add_moddevtable(&buf, mod);
-
-		sprintf(fname, "%s.mod.c", mod->name);
-		write_if_changed(&buf, fname);
-	}
-
-	if (dump_write)
-		write_dump(dump_write);
-
-	return 0;
-}
-
diff -urN linux-2.6.8-rc2/scripts/modpost.h linux-2.6.8-rc3/scripts/modpost.h
--- linux-2.6.8-rc2/scripts/modpost.h	2004-06-15 22:18:37.000000000 -0700
+++ linux-2.6.8-rc3/scripts/modpost.h	1969-12-31 16:00:00.000000000 -0800
@@ -1,103 +0,0 @@
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdarg.h>
-#include <string.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/mman.h>
-#include <fcntl.h>
-#include <unistd.h>
-#include <elf.h>
-
-#include "elfconfig.h"
-
-#if KERNEL_ELFCLASS == ELFCLASS32
-
-#define Elf_Ehdr    Elf32_Ehdr 
-#define Elf_Shdr    Elf32_Shdr 
-#define Elf_Sym     Elf32_Sym
-#define ELF_ST_BIND ELF32_ST_BIND
-#define ELF_ST_TYPE ELF32_ST_TYPE
-
-#else
-
-#define Elf_Ehdr    Elf64_Ehdr 
-#define Elf_Shdr    Elf64_Shdr 
-#define Elf_Sym     Elf64_Sym
-#define ELF_ST_BIND ELF64_ST_BIND
-#define ELF_ST_TYPE ELF64_ST_TYPE
-
-#endif
-
-#if KERNEL_ELFDATA != HOST_ELFDATA
-
-static inline void __endian(const void *src, void *dest, unsigned int size)
-{
-	unsigned int i;
-	for (i = 0; i < size; i++)
-		((unsigned char*)dest)[i] = ((unsigned char*)src)[size - i-1];
-}
-
-
-
-#define TO_NATIVE(x)						\
-({								\
-	typeof(x) __x;						\
-	__endian(&(x), &(__x), sizeof(__x));			\
-	__x;							\
-})
-
-#else /* endianness matches */
-
-#define TO_NATIVE(x) (x)
-
-#endif
-
-#define NOFAIL(ptr)   do_nofail((ptr), __FILE__, __LINE__, #ptr)
-void *do_nofail(void *ptr, const char *file, int line, const char *expr);
-
-struct buffer {
-	char *p;
-	int pos;
-	int size;
-};
-
-void __attribute__((format(printf, 2, 3)))
-buf_printf(struct buffer *buf, const char *fmt, ...);
-
-void
-buf_write(struct buffer *buf, const char *s, int len);
-
-struct module {
-	struct module *next;
-	const char *name;
-	struct symbol *unres;
-	int seen;
-	int skip;
-	struct buffer dev_table_buf;
-};
-
-struct elf_info {
-	unsigned long size;
-	Elf_Ehdr     *hdr;
-	Elf_Shdr     *sechdrs;
-	Elf_Sym      *symtab_start;
-	Elf_Sym      *symtab_stop;
-	const char   *strtab;
-	char	     *modinfo;
-	unsigned int modinfo_len;
-};
-
-void handle_moddevtable(struct module *mod, struct elf_info *info,
-			Elf_Sym *sym, const char *symname);
-
-void add_moddevtable(struct buffer *buf, struct module *mod);
-
-void maybe_frob_version(const char *modfilename,
-			void *modinfo,
-			unsigned long modinfo_len,
-			unsigned long modinfo_offset);
-
-void *grab_file(const char *filename, unsigned long *size);
-char* get_next_line(unsigned long *pos, void *file, unsigned long size);
-void release_file(void *file, unsigned long size);
diff -urN linux-2.6.8-rc2/scripts/package/Makefile linux-2.6.8-rc3/scripts/package/Makefile
--- linux-2.6.8-rc2/scripts/package/Makefile	2004-08-03 15:21:18.635984445 -0700
+++ linux-2.6.8-rc3/scripts/package/Makefile	2004-08-03 15:22:20.372517032 -0700
@@ -31,9 +31,10 @@
 MKSPEC     := $(srctree)/scripts/package/mkspec
 PREV       := set -e; cd ..;
 
+# rpm-pkg
 .PHONY: rpm-pkg rpm
 
-$(objtree)/kernel.spec: $(MKSPEC)
+$(objtree)/kernel.spec: $(MKSPEC) $(srctree)/Makefile
 	$(CONFIG_SHELL) $(MKSPEC) > $@
 
 rpm-pkg rpm: $(objtree)/kernel.spec
@@ -52,6 +53,22 @@
 
 clean-rule +=  rm -f $(objtree)/kernel.spec
 
+# binrpm-pkg
+.PHONY: binrpm-pkg
+$(objtree)/binkernel.spec: $(MKSPEC) $(srctree)/Makefile
+	$(CONFIG_SHELL) $(MKSPEC) prebuilt > $@
+	
+binrpm-pkg: $(objtree)/binkernel.spec
+	$(MAKE)
+	set -e; \
+	$(CONFIG_SHELL) $(srctree)/scripts/mkversion > $(objtree)/.tmp_version
+	set -e; \
+	mv -f $(objtree)/.tmp_version $(objtree)/.version
+
+	$(RPM) --define "_builddir $(srctree)" --target $(UTS_MACHINE) -bb $<
+
+clean-rule += rm -f $(objtree)/binkernel.spec
+
 # Deb target
 # ---------------------------------------------------------------------------
 #
@@ -67,5 +84,6 @@
 # ---------------------------------------------------------------------------
 help:
 	@echo  '  rpm-pkg         - Build the kernel as an RPM package'
+	@echo  '  binrpm-pkg      - Build an rpm package containing the compiled kernel & modules'
 	@echo  '  deb-pkg         - Build the kernel as an deb package'
 
diff -urN linux-2.6.8-rc2/scripts/package/mkspec linux-2.6.8-rc3/scripts/package/mkspec
--- linux-2.6.8-rc2/scripts/package/mkspec	2004-08-03 15:21:18.636984486 -0700
+++ linux-2.6.8-rc3/scripts/package/mkspec	2004-08-03 15:22:20.373517073 -0700
@@ -9,6 +9,13 @@
 #	Patched for non-x86 by Opencon (L) 2002 <opencon@rio.skydome.net>
 #
 
+# how we were called determines which rpms we build and how we build them
+if [ "$1" = "prebuilt" ]; then
+	PREBUILT=true
+else
+	PREBUILT=false
+fi
+
 # starting to output the spec
 if [ "`grep CONFIG_DRM=y .config | cut -f2 -d\=`" = "y" ]; then
 	PROVIDES=kernel-drm
@@ -26,8 +33,12 @@
 echo "Group: System Environment/Kernel"
 echo "Vendor: The Linux Community"
 echo "URL: http://www.kernel.org"
+
+if ! $PREBUILT; then
 echo -n "Source: kernel-$VERSION.$PATCHLEVEL.$SUBLEVEL"
 echo "$EXTRAVERSION.tar.gz" | sed -e "s/-//g"
+fi
+
 echo "BuildRoot: /var/tmp/%{name}-%{PACKAGE_VERSION}-root"
 echo "Provides: $PROVIDES"
 echo "%define __spec_install_post /usr/lib/rpm/brp-compress || :"
@@ -36,12 +47,20 @@
 echo "%description"
 echo "The Linux Kernel, the operating system core itself"
 echo ""
+
+if ! $PREBUILT; then
 echo "%prep"
 echo "%setup -q"
 echo ""
+fi
+
 echo "%build"
+
+if ! $PREBUILT; then
 echo "make clean && make"
 echo ""
+fi
+
 echo "%install"
 echo 'mkdir -p $RPM_BUILD_ROOT/boot $RPM_BUILD_ROOT/lib $RPM_BUILD_ROOT/lib/modules'
 
diff -urN linux-2.6.8-rc2/scripts/sumversion.c linux-2.6.8-rc3/scripts/sumversion.c
--- linux-2.6.8-rc2/scripts/sumversion.c	2004-06-15 22:19:43.000000000 -0700
+++ linux-2.6.8-rc3/scripts/sumversion.c	1969-12-31 16:00:00.000000000 -0800
@@ -1,544 +0,0 @@
-#include <netinet/in.h>
-#include <stdint.h>
-#include <ctype.h>
-#include <errno.h>
-#include <string.h>
-#include "modpost.h"
-
-/* Parse tag=value strings from .modinfo section */
-static char *next_string(char *string, unsigned long *secsize)
-{
-	/* Skip non-zero chars */
-	while (string[0]) {
-		string++;
-		if ((*secsize)-- <= 1)
-			return NULL;
-	}
-
-	/* Skip any zero padding. */
-	while (!string[0]) {
-		string++;
-		if ((*secsize)-- <= 1)
-			return NULL;
-	}
-	return string;
-}
-
-static char *get_modinfo(void *modinfo, unsigned long modinfo_len,
-			 const char *tag)
-{
-	char *p;
-	unsigned int taglen = strlen(tag);
-	unsigned long size = modinfo_len;
-
-	for (p = modinfo; p; p = next_string(p, &size)) {
-		if (strncmp(p, tag, taglen) == 0 && p[taglen] == '=')
-			return p + taglen + 1;
-	}
-	return NULL;
-}
-
-/*
- * Stolen form Cryptographic API.
- *
- * MD4 Message Digest Algorithm (RFC1320).
- *
- * Implementation derived from Andrew Tridgell and Steve French's
- * CIFS MD4 implementation, and the cryptoapi implementation
- * originally based on the public domain implementation written
- * by Colin Plumb in 1993.
- *
- * Copyright (c) Andrew Tridgell 1997-1998.
- * Modified by Steve French (sfrench@us.ibm.com) 2002
- * Copyright (c) Cryptoapi developers.
- * Copyright (c) 2002 David S. Miller (davem@redhat.com)
- * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- */
-#define MD4_DIGEST_SIZE		16
-#define MD4_HMAC_BLOCK_SIZE	64
-#define MD4_BLOCK_WORDS		16
-#define MD4_HASH_WORDS		4
-
-struct md4_ctx {
-	uint32_t hash[MD4_HASH_WORDS];
-	uint32_t block[MD4_BLOCK_WORDS];
-	uint64_t byte_count;
-};
-
-static inline uint32_t lshift(uint32_t x, unsigned int s)
-{
-	x &= 0xFFFFFFFF;
-	return ((x << s) & 0xFFFFFFFF) | (x >> (32 - s));
-}
-
-static inline uint32_t F(uint32_t x, uint32_t y, uint32_t z)
-{
-	return (x & y) | ((~x) & z);
-}
-
-static inline uint32_t G(uint32_t x, uint32_t y, uint32_t z)
-{
-	return (x & y) | (x & z) | (y & z);
-}
-
-static inline uint32_t H(uint32_t x, uint32_t y, uint32_t z)
-{
-	return x ^ y ^ z;
-}
-
-#define ROUND1(a,b,c,d,k,s) (a = lshift(a + F(b,c,d) + k, s))
-#define ROUND2(a,b,c,d,k,s) (a = lshift(a + G(b,c,d) + k + (uint32_t)0x5A827999,s))
-#define ROUND3(a,b,c,d,k,s) (a = lshift(a + H(b,c,d) + k + (uint32_t)0x6ED9EBA1,s))
-
-/* XXX: this stuff can be optimized */
-static inline void le32_to_cpu_array(uint32_t *buf, unsigned int words)
-{
-	while (words--) {
-		*buf = ntohl(*buf);
-		buf++;
-	}
-}
-
-static inline void cpu_to_le32_array(uint32_t *buf, unsigned int words)
-{
-	while (words--) {
-		*buf = htonl(*buf);
-		buf++;
-	}
-}
-
-static void md4_transform(uint32_t *hash, uint32_t const *in)
-{
-	uint32_t a, b, c, d;
-
-	a = hash[0];
-	b = hash[1];
-	c = hash[2];
-	d = hash[3];
-
-	ROUND1(a, b, c, d, in[0], 3);
-	ROUND1(d, a, b, c, in[1], 7);
-	ROUND1(c, d, a, b, in[2], 11);
-	ROUND1(b, c, d, a, in[3], 19);
-	ROUND1(a, b, c, d, in[4], 3);
-	ROUND1(d, a, b, c, in[5], 7);
-	ROUND1(c, d, a, b, in[6], 11);
-	ROUND1(b, c, d, a, in[7], 19);
-	ROUND1(a, b, c, d, in[8], 3);
-	ROUND1(d, a, b, c, in[9], 7);
-	ROUND1(c, d, a, b, in[10], 11);
-	ROUND1(b, c, d, a, in[11], 19);
-	ROUND1(a, b, c, d, in[12], 3);
-	ROUND1(d, a, b, c, in[13], 7);
-	ROUND1(c, d, a, b, in[14], 11);
-	ROUND1(b, c, d, a, in[15], 19);
-
-	ROUND2(a, b, c, d,in[ 0], 3);
-	ROUND2(d, a, b, c, in[4], 5);
-	ROUND2(c, d, a, b, in[8], 9);
-	ROUND2(b, c, d, a, in[12], 13);
-	ROUND2(a, b, c, d, in[1], 3);
-	ROUND2(d, a, b, c, in[5], 5);
-	ROUND2(c, d, a, b, in[9], 9);
-	ROUND2(b, c, d, a, in[13], 13);
-	ROUND2(a, b, c, d, in[2], 3);
-	ROUND2(d, a, b, c, in[6], 5);
-	ROUND2(c, d, a, b, in[10], 9);
-	ROUND2(b, c, d, a, in[14], 13);
-	ROUND2(a, b, c, d, in[3], 3);
-	ROUND2(d, a, b, c, in[7], 5);
-	ROUND2(c, d, a, b, in[11], 9);
-	ROUND2(b, c, d, a, in[15], 13);
-
-	ROUND3(a, b, c, d,in[ 0], 3);
-	ROUND3(d, a, b, c, in[8], 9);
-	ROUND3(c, d, a, b, in[4], 11);
-	ROUND3(b, c, d, a, in[12], 15);
-	ROUND3(a, b, c, d, in[2], 3);
-	ROUND3(d, a, b, c, in[10], 9);
-	ROUND3(c, d, a, b, in[6], 11);
-	ROUND3(b, c, d, a, in[14], 15);
-	ROUND3(a, b, c, d, in[1], 3);
-	ROUND3(d, a, b, c, in[9], 9);
-	ROUND3(c, d, a, b, in[5], 11);
-	ROUND3(b, c, d, a, in[13], 15);
-	ROUND3(a, b, c, d, in[3], 3);
-	ROUND3(d, a, b, c, in[11], 9);
-	ROUND3(c, d, a, b, in[7], 11);
-	ROUND3(b, c, d, a, in[15], 15);
-
-	hash[0] += a;
-	hash[1] += b;
-	hash[2] += c;
-	hash[3] += d;
-}
-
-static inline void md4_transform_helper(struct md4_ctx *ctx)
-{
-	le32_to_cpu_array(ctx->block, sizeof(ctx->block) / sizeof(uint32_t));
-	md4_transform(ctx->hash, ctx->block);
-}
-
-static void md4_init(struct md4_ctx *mctx)
-{
-	mctx->hash[0] = 0x67452301;
-	mctx->hash[1] = 0xefcdab89;
-	mctx->hash[2] = 0x98badcfe;
-	mctx->hash[3] = 0x10325476;
-	mctx->byte_count = 0;
-}
-
-static void md4_update(struct md4_ctx *mctx,
-		       const unsigned char *data, unsigned int len)
-{
-	const uint32_t avail = sizeof(mctx->block) - (mctx->byte_count & 0x3f);
-
-	mctx->byte_count += len;
-
-	if (avail > len) {
-		memcpy((char *)mctx->block + (sizeof(mctx->block) - avail),
-		       data, len);
-		return;
-	}
-
-	memcpy((char *)mctx->block + (sizeof(mctx->block) - avail),
-	       data, avail);
-
-	md4_transform_helper(mctx);
-	data += avail;
-	len -= avail;
-
-	while (len >= sizeof(mctx->block)) {
-		memcpy(mctx->block, data, sizeof(mctx->block));
-		md4_transform_helper(mctx);
-		data += sizeof(mctx->block);
-		len -= sizeof(mctx->block);
-	}
-
-	memcpy(mctx->block, data, len);
-}
-
-static void md4_final_ascii(struct md4_ctx *mctx, char *out, unsigned int len)
-{
-	const unsigned int offset = mctx->byte_count & 0x3f;
-	char *p = (char *)mctx->block + offset;
-	int padding = 56 - (offset + 1);
-
-	*p++ = 0x80;
-	if (padding < 0) {
-		memset(p, 0x00, padding + sizeof (uint64_t));
-		md4_transform_helper(mctx);
-		p = (char *)mctx->block;
-		padding = 56;
-	}
-
-	memset(p, 0, padding);
-	mctx->block[14] = mctx->byte_count << 3;
-	mctx->block[15] = mctx->byte_count >> 29;
-	le32_to_cpu_array(mctx->block, (sizeof(mctx->block) -
-	                  sizeof(uint64_t)) / sizeof(uint32_t));
-	md4_transform(mctx->hash, mctx->block);
-	cpu_to_le32_array(mctx->hash, sizeof(mctx->hash) / sizeof(uint32_t));
-
-	snprintf(out, len, "%08X%08X%08X%08X",
-		 mctx->hash[0], mctx->hash[1], mctx->hash[2], mctx->hash[3]);
-}
-
-static inline void add_char(unsigned char c, struct md4_ctx *md)
-{
-	md4_update(md, &c, 1);
-}
-
-static int parse_string(const char *file, unsigned long len,
-			struct md4_ctx *md)
-{
-	unsigned long i;
-
-	add_char(file[0], md);
-	for (i = 1; i < len; i++) {
-		add_char(file[i], md);
-		if (file[i] == '"' && file[i-1] != '\\')
-			break;
-	}
-	return i;
-}
-
-static int parse_comment(const char *file, unsigned long len)
-{
-	unsigned long i;
-
-	for (i = 2; i < len; i++) {
-		if (file[i-1] == '*' && file[i] == '/')
-			break;
-	}
-	return i;
-}
-
-/* FIXME: Handle .s files differently (eg. # starts comments) --RR */
-static int parse_file(const char *fname, struct md4_ctx *md)
-{
-	char *file;
-	unsigned long i, len;
-
-	file = grab_file(fname, &len);
-	if (!file)
-		return 0;
-
-	for (i = 0; i < len; i++) {
-		/* Collapse and ignore \ and CR. */
-		if (file[i] == '\\' && (i+1 < len) && file[i+1] == '\n') {
-			i++;
-			continue;
-		}
-
-		/* Ignore whitespace */
-		if (isspace(file[i]))
-			continue;
-
-		/* Handle strings as whole units */
-		if (file[i] == '"') {
-			i += parse_string(file+i, len - i, md);
-			continue;
-		}
-
-		/* Comments: ignore */
-		if (file[i] == '/' && file[i+1] == '*') {
-			i += parse_comment(file+i, len - i);
-			continue;
-		}
-
-		add_char(file[i], md);
-	}
-	release_file(file, len);
-	return 1;
-}
-
-/* We have dir/file.o.  Open dir/.file.o.cmd, look for deps_ line to
- * figure out source file. */
-static int parse_source_files(const char *objfile, struct md4_ctx *md)
-{
-	char *cmd, *file, *line, *dir;
-	const char *base;
-	unsigned long flen, pos = 0;
-	int dirlen, ret = 0, check_files = 0;
-
-	cmd = NOFAIL(malloc(strlen(objfile) + sizeof("..cmd")));
-
-	base = strrchr(objfile, '/');
-	if (base) {
-		base++;
-		dirlen = base - objfile;
-		sprintf(cmd, "%.*s.%s.cmd", dirlen, objfile, base);
-	} else {
-		dirlen = 0;
-		sprintf(cmd, ".%s.cmd", objfile);
-	}
-	dir = NOFAIL(malloc(dirlen + 1));
-	strncpy(dir, objfile, dirlen);
-	dir[dirlen] = '\0';
-
-	file = grab_file(cmd, &flen);
-	if (!file) {
-		fprintf(stderr, "Warning: could not find %s for %s\n",
-			cmd, objfile);
-		goto out;
-	}
-
-	/* There will be a line like so:
-		deps_drivers/net/dummy.o := \
-		  drivers/net/dummy.c \
-		    $(wildcard include/config/net/fastroute.h) \
-		  include/linux/config.h \
-		    $(wildcard include/config/h.h) \
-		  include/linux/module.h \
-
-	   Sum all files in the same dir or subdirs.
-	*/
-	while ((line = get_next_line(&pos, file, flen)) != NULL) {
-		char* p = line;
-		if (strncmp(line, "deps_", sizeof("deps_")-1) == 0) {
-			check_files = 1;
-			continue;
-		}
-		if (!check_files)
-			continue;
-
-		/* Continue until line does not end with '\' */
-		if ( *(p + strlen(p)-1) != '\\')
-			break;
-		/* Terminate line at first space, to get rid of final ' \' */
-		while (*p) {
-                       if (isspace(*p)) {
-				*p = '\0';
-				break;
-			}
-			p++;
-		}
-
-		/* Check if this file is in same dir as objfile */
-		if ((strstr(line, dir)+strlen(dir)-1) == strrchr(line, '/')) {
-			if (!parse_file(line, md)) {
-				fprintf(stderr,
-					"Warning: could not open %s: %s\n",
-					line, strerror(errno));
-				goto out_file;
-			}
-
-		}
-
-	}
-
-	/* Everyone parsed OK */
-	ret = 1;
-out_file:
-	release_file(file, flen);
-out:
-	free(dir);
-	free(cmd);
-	return ret;
-}
-
-static int get_version(const char *modname, char sum[])
-{
-	void *file;
-	unsigned long len;
-	int ret = 0;
-	struct md4_ctx md;
-	char *sources, *end, *fname;
-	const char *basename;
-	char filelist[sizeof(".tmp_versions/%s.mod") + strlen(modname)];
-
-	/* Source files for module are in .tmp_versions/modname.mod,
-	   after the first line. */
-	if (strrchr(modname, '/'))
-		basename = strrchr(modname, '/') + 1;
-	else
-		basename = modname;
-	sprintf(filelist, ".tmp_versions/%s", basename);
-	/* Truncate .o, add .mod */
-	strcpy(filelist + strlen(filelist)-2, ".mod");
-
-	file = grab_file(filelist, &len);
-	if (!file) {
-		fprintf(stderr, "Warning: could not find versions for %s\n",
-			filelist);
-		return 0;
-	}
-
-	sources = strchr(file, '\n');
-	if (!sources) {
-		fprintf(stderr, "Warning: malformed versions file for %s\n",
-			modname);
-		goto release;
-	}
-
-	sources++;
-	end = strchr(sources, '\n');
-	if (!end) {
-		fprintf(stderr, "Warning: bad ending versions file for %s\n",
-			modname);
-		goto release;
-	}
-	*end = '\0';
-
-	md4_init(&md);
-	for (fname = strtok(sources, " "); fname; fname = strtok(NULL, " ")) {
-		if (!parse_source_files(fname, &md))
-			goto release;
-	}
-
-	/* sum is of form \0<padding>. */
-	md4_final_ascii(&md, sum, 1 + strlen(sum+1));
-	ret = 1;
-release:
-	release_file(file, len);
-	return ret;
-}
-
-static void write_version(const char *filename, const char *sum,
-			  unsigned long offset)
-{
-	int fd;
-
-	fd = open(filename, O_RDWR);
-	if (fd < 0) {
-		fprintf(stderr, "Warning: changing sum in %s failed: %s\n",
-			filename, strerror(errno));
-		return;
-	}
-
-	if (lseek(fd, offset, SEEK_SET) == (off_t)-1) {
-		fprintf(stderr, "Warning: changing sum in %s:%lu failed: %s\n",
-			filename, offset, strerror(errno));
-		goto out;
-	}
-
-	if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
-		fprintf(stderr, "Warning: writing sum in %s failed: %s\n",
-			filename, strerror(errno));
-		goto out;
-	}
-out:
-	close(fd);
-}
-
-void strip_rcs_crap(char *version)
-{
-	unsigned int len, full_len;
-
-	if (strncmp(version, "$Revision", strlen("$Revision")) != 0)
-		return;
-
-	/* Space for version string follows. */
-	full_len = strlen(version) + strlen(version + strlen(version) + 1) + 2;
-
-	/* Move string to start with version number: prefix will be
-	 * $Revision$ or $Revision: */
-	len = strlen("$Revision");
-	if (version[len] == ':' || version[len] == '$')
-		len++;
-	while (isspace(version[len]))
-		len++;
-	memmove(version, version+len, full_len-len);
-	full_len -= len;
-
-	/* Preserve up to next whitespace. */
-	len = 0;
-	while (version[len] && !isspace(version[len]))
-		len++;
-	memmove(version + len, version + strlen(version),
-		full_len - strlen(version));
-}
-
-/* If the modinfo contains a "version" value, then set this. */
-void maybe_frob_version(const char *modfilename,
-			void *modinfo,
-			unsigned long modinfo_len,
-			unsigned long modinfo_offset)
-{
-	char *version, *csum;
-
-	version = get_modinfo(modinfo, modinfo_len, "version");
-	if (!version)
-		return;
-
-	/* RCS $Revision gets stripped out. */
-	strip_rcs_crap(version);
-
-	/* Check against double sumversion */
-	if (strchr(version, ' '))
-		return;
-
-	/* Version contains embedded NUL: second half has space for checksum */
-	csum = version + strlen(version);
-	*(csum++) = ' ';
-	if (get_version(modfilename, csum))
-		write_version(modfilename, version,
-			      modinfo_offset + (version - (char *)modinfo));
-}
diff -urN linux-2.6.8-rc2/security/selinux/hooks.c linux-2.6.8-rc3/security/selinux/hooks.c
--- linux-2.6.8-rc2/security/selinux/hooks.c	2004-08-03 15:21:18.711987563 -0700
+++ linux-2.6.8-rc3/security/selinux/hooks.c	2004-08-03 15:22:20.485521667 -0700
@@ -63,6 +63,7 @@
 #include <net/ipv6.h>
 #include <linux/hugetlb.h>
 #include <linux/major.h>
+#include <linux/personality.h>
 
 #include "avc.h"
 #include "objsec.h"
@@ -1684,6 +1685,9 @@
 		if (rc)
 			return rc;
 
+		/* Clear any possibly unsafe personality bits on exec: */
+		current->personality &= ~PER_CLEAR_ON_SETID;
+
 		/* Set the security field to the new SID. */
 		bsec->sid = newsid;
 	}
diff -urN linux-2.6.8-rc2/sound/Kconfig linux-2.6.8-rc3/sound/Kconfig
--- linux-2.6.8-rc2/sound/Kconfig	2004-06-15 22:20:03.000000000 -0700
+++ linux-2.6.8-rc3/sound/Kconfig	2004-08-03 15:22:20.533523636 -0700
@@ -70,7 +70,7 @@
 endmenu
 
 menu "Open Sound System"
-	depends on SOUND!=n
+	depends on SOUND!=n && (BROKEN || !SPARC64)
 
 config SOUND_PRIME
 	tristate "Open Sound System (DEPRECATED)"
diff -urN linux-2.6.8-rc2/sound/core/oss/pcm_oss.c linux-2.6.8-rc3/sound/core/oss/pcm_oss.c
--- linux-2.6.8-rc2/sound/core/oss/pcm_oss.c	2004-08-03 15:21:18.892994989 -0700
+++ linux-2.6.8-rc3/sound/core/oss/pcm_oss.c	2004-08-03 15:22:20.692530159 -0700
@@ -672,7 +672,7 @@
 			else
 				printk("pcm_oss: read: recovering from SUSPEND\n");
 #endif
-			ret = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DRAIN, 0);
+			ret = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DRAIN, NULL);
 			if (ret < 0)
 				break;
 		} else if (runtime->status->state == SNDRV_PCM_STATE_SETUP) {
@@ -693,7 +693,7 @@
 		}
 		if (ret == -EPIPE) {
 			if (runtime->status->state == SNDRV_PCM_STATE_DRAINING) {
-				ret = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, 0);
+				ret = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
 				if (ret < 0)
 					break;
 			}
@@ -754,7 +754,7 @@
 			else
 				printk("pcm_oss: readv: recovering from SUSPEND\n");
 #endif
-			ret = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DRAIN, 0);
+			ret = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DRAIN, NULL);
 			if (ret < 0)
 				break;
 		} else if (runtime->status->state == SNDRV_PCM_STATE_SETUP) {
diff -urN linux-2.6.8-rc2/sound/core/pcm.c linux-2.6.8-rc3/sound/core/pcm.c
--- linux-2.6.8-rc2/sound/core/pcm.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/sound/core/pcm.c	2004-08-03 15:22:20.702530569 -0700
@@ -202,37 +202,37 @@
 
 const char *snd_pcm_stream_name(snd_pcm_stream_t stream)
 {
-	snd_assert(stream <= SNDRV_PCM_STREAM_LAST, return 0);
+	snd_assert(stream <= SNDRV_PCM_STREAM_LAST, return NULL);
 	return snd_pcm_stream_names[stream];
 }
 
 const char *snd_pcm_access_name(snd_pcm_access_t access)
 {
-	snd_assert(access <= SNDRV_PCM_ACCESS_LAST, return 0);
+	snd_assert(access <= SNDRV_PCM_ACCESS_LAST, return NULL);
 	return snd_pcm_access_names[access];
 }
 
 const char *snd_pcm_format_name(snd_pcm_format_t format)
 {
-	snd_assert(format <= SNDRV_PCM_FORMAT_LAST, return 0);
+	snd_assert(format <= SNDRV_PCM_FORMAT_LAST, return NULL);
 	return snd_pcm_format_names[format];
 }
 
 const char *snd_pcm_subformat_name(snd_pcm_subformat_t subformat)
 {
-	snd_assert(subformat <= SNDRV_PCM_SUBFORMAT_LAST, return 0);
+	snd_assert(subformat <= SNDRV_PCM_SUBFORMAT_LAST, return NULL);
 	return snd_pcm_subformat_names[subformat];
 }
 
 const char *snd_pcm_tstamp_mode_name(snd_pcm_tstamp_t mode)
 {
-	snd_assert(mode <= SNDRV_PCM_TSTAMP_LAST, return 0);
+	snd_assert(mode <= SNDRV_PCM_TSTAMP_LAST, return NULL);
 	return snd_pcm_tstamp_mode_names[mode];
 }
 
 const char *snd_pcm_state_name(snd_pcm_state_t state)
 {
-	snd_assert(state <= SNDRV_PCM_STATE_LAST, return 0);
+	snd_assert(state <= SNDRV_PCM_STATE_LAST, return NULL);
 	return snd_pcm_state_names[state];
 }
 
diff -urN linux-2.6.8-rc2/sound/drivers/serial-u16550.c linux-2.6.8-rc3/sound/drivers/serial-u16550.c
--- linux-2.6.8-rc2/sound/drivers/serial-u16550.c	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/sound/drivers/serial-u16550.c	2004-08-03 15:22:20.991542425 -0700
@@ -674,7 +674,7 @@
 				break;
 			if (snd_rawmidi_transmit(substream, &midi_byte, 1) != 1)
 				break;
-#if SNDRV_SERIAL_MS124W_MB_NOCOMBO
+#ifdef SNDRV_SERIAL_MS124W_MB_NOCOMBO
 			/* select exactly one of the four ports */
 			addr_byte = (1 << (substream->number + 4)) | 0x08;
 #else
diff -urN linux-2.6.8-rc2/sound/drivers/vx/vx_pcm.c linux-2.6.8-rc3/sound/drivers/vx/vx_pcm.c
--- linux-2.6.8-rc2/sound/drivers/vx/vx_pcm.c	2004-06-15 22:18:57.000000000 -0700
+++ linux-2.6.8-rc3/sound/drivers/vx/vx_pcm.c	2004-08-03 15:22:21.063545379 -0700
@@ -465,7 +465,7 @@
 	struct vx_rmh rmh;
 	int data_mode;
 
-	*pipep = 0;
+	*pipep = NULL;
 	vx_init_rmh(&rmh, CMD_RES_PIPE);
 	vx_set_pipe_cmd_params(&rmh, capture, audioid, num_audio);
 #if 0	// NYI
@@ -581,7 +581,7 @@
 {
 	snd_pcm_runtime_t *runtime = subs->runtime;
 	vx_core_t *chip = snd_pcm_substream_chip(subs);
-	vx_pipe_t *pipe = 0;
+	vx_pipe_t *pipe = NULL;
 	unsigned int audio;
 	int err;
 
@@ -632,7 +632,7 @@
 	pipe = snd_magic_cast(vx_pipe_t, subs->runtime->private_data, return -EINVAL);
 
 	if (--pipe->references == 0) {
-		chip->playback_pipes[pipe->number] = 0;
+		chip->playback_pipes[pipe->number] = NULL;
 		vx_free_pipe(chip, pipe);
 	}
 
@@ -1038,7 +1038,7 @@
 	if (! subs->runtime->private_data)
 		return -EINVAL;
 	pipe = snd_magic_cast(vx_pipe_t, subs->runtime->private_data, return -EINVAL);
-	chip->capture_pipes[pipe->number] = 0;
+	chip->capture_pipes[pipe->number] = NULL;
 
 	pipe_out_monitoring = pipe->monitoring_pipe;
 
@@ -1049,8 +1049,8 @@
 	if (pipe_out_monitoring) {
 		if (--pipe_out_monitoring->references == 0) {
 			vx_free_pipe(chip, pipe_out_monitoring);
-			chip->playback_pipes[pipe->number] = 0;
-			pipe->monitoring_pipe = 0;
+			chip->playback_pipes[pipe->number] = NULL;
+			pipe->monitoring_pipe = NULL;
 		}
 	}
 	
@@ -1269,11 +1269,11 @@
 	chip->pcm[pcm->device] = NULL;
 	if (chip->playback_pipes) {
 		kfree(chip->playback_pipes);
-		chip->playback_pipes = 0;
+		chip->playback_pipes = NULL;
 	}
 	if (chip->capture_pipes) {
 		kfree(chip->capture_pipes);
-		chip->capture_pipes = 0;
+		chip->capture_pipes = NULL;
 	}
 }
 
diff -urN linux-2.6.8-rc2/sound/i2c/other/tea575x-tuner.c linux-2.6.8-rc3/sound/i2c/other/tea575x-tuner.c
--- linux-2.6.8-rc2/sound/i2c/other/tea575x-tuner.c	2004-06-15 22:19:11.000000000 -0700
+++ linux-2.6.8-rc3/sound/i2c/other/tea575x-tuner.c	2004-08-03 15:22:21.064545420 -0700
@@ -85,11 +85,12 @@
  * Linux Video interface
  */
 
-static int snd_tea575x_do_ioctl(struct inode *inode, struct file *file,
-			        unsigned int cmd, void *arg)
+static int snd_tea575x_ioctl(struct inode *inode, struct file *file,
+			     unsigned int cmd, unsigned long data)
 {
 	struct video_device *dev = video_devdata(file);
 	tea575x_t *tea = video_get_drvdata(dev);
+	void __user *arg = (void __user *)data;
 	
 	switch(cmd) {
 		case VIDIOCGCAP:
@@ -167,12 +168,6 @@
 	}
 }
 
-static int snd_tea575x_ioctl(struct inode *inode, struct file *file,
-			     unsigned int cmd, unsigned long arg)
-{
-	return video_usercopy(inode, file, cmd, arg, snd_tea575x_do_ioctl);
-}
-
 /*
  * initialize all the tea575x chips
  */
diff -urN linux-2.6.8-rc2/sound/isa/Kconfig linux-2.6.8-rc3/sound/isa/Kconfig
--- linux-2.6.8-rc2/sound/isa/Kconfig	2004-08-03 15:21:19.122004383 -0700
+++ linux-2.6.8-rc3/sound/isa/Kconfig	2004-08-03 15:22:21.138548456 -0700
@@ -184,7 +184,7 @@
 
 config SND_SB16_CSP
 	bool "Sound Blaster 16/AWE CSP support"
-	depends on SND_SB16 || SND_SBAWE
+	depends on (SND_SB16 || SND_SBAWE) && (BROKEN || !PPC)
 	help
 	  Say 'Y' to include support for CSP core. This special coprocessor
 	  can do variable tasks like various compression and decompression
diff -urN linux-2.6.8-rc2/sound/isa/gus/gus_mem.c linux-2.6.8-rc3/sound/isa/gus/gus_mem.c
--- linux-2.6.8-rc2/sound/isa/gus/gus_mem.c	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/sound/isa/gus/gus_mem.c	2004-08-03 15:22:21.198550917 -0700
@@ -59,7 +59,7 @@
 			else
 				nblock->prev->next = nblock;
 			up(&alloc->memory_mutex);
-			return 0;
+			return NULL;
 		}
 		pblock = pblock->next;
 	}
diff -urN linux-2.6.8-rc2/sound/isa/sb/emu8000_pcm.c linux-2.6.8-rc3/sound/isa/sb/emu8000_pcm.c
--- linux-2.6.8-rc2/sound/isa/sb/emu8000_pcm.c	2004-06-15 22:20:18.000000000 -0700
+++ linux-2.6.8-rc3/sound/isa/sb/emu8000_pcm.c	2004-08-03 15:22:21.236552476 -0700
@@ -264,7 +264,7 @@
 	emu8k_pcm_t *rec = subs->runtime->private_data;
 	if (rec)
 		kfree(rec);
-	subs->runtime->private_data = 0;
+	subs->runtime->private_data = NULL;
 	return 0;
 }
 
diff -urN linux-2.6.8-rc2/sound/isa/sb/sb8_main.c linux-2.6.8-rc3/sound/isa/sb/sb8_main.c
--- linux-2.6.8-rc2/sound/isa/sb/sb8_main.c	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/sound/isa/sb/sb8_main.c	2004-08-03 15:22:21.237552517 -0700
@@ -452,11 +452,11 @@
 		runtime->hw.rate_max = 44100;
 		runtime->hw.channels_max = 2;
 		snd_pcm_hw_rule_add(runtime, 0, SNDRV_PCM_HW_PARAM_RATE,
-				    snd_sb8_hw_constraint_rate_channels, 0,
+				    snd_sb8_hw_constraint_rate_channels, NULL,
 				    SNDRV_PCM_HW_PARAM_CHANNELS,
 				    SNDRV_PCM_HW_PARAM_RATE, -1);
 		snd_pcm_hw_rule_add(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
-				     snd_sb8_hw_constraint_channels_rate, 0,
+				     snd_sb8_hw_constraint_channels_rate, NULL,
 				     SNDRV_PCM_HW_PARAM_RATE, -1);
 		break;
 	case SB_HW_201:
diff -urN linux-2.6.8-rc2/sound/isa/wavefront/wavefront_synth.c linux-2.6.8-rc3/sound/isa/wavefront/wavefront_synth.c
--- linux-2.6.8-rc2/sound/isa/wavefront/wavefront_synth.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/sound/isa/wavefront/wavefront_synth.c	2004-08-03 15:22:21.314555676 -0700
@@ -123,7 +123,7 @@
 #else
 #define DPRINT(cond, args...) \
        if ((dev->debug & (cond)) == (cond)) { \
-	     snd_printk (##args); \
+	     snd_printk (args); \
        }
 #endif
 #else
@@ -165,7 +165,7 @@
 	{ 0x0E, "Bad MIDI channel number" },
 	{ 0x10, "Download Record Error" },
 	{ 0x80, "Success" },
-	{ 0x0, 0x0 }
+	{ 0x0 }
 };
 
 #define NEEDS_ACK 1
@@ -361,7 +361,7 @@
 
 	if (cmd == WFC_DOWNLOAD_MULTISAMPLE) {
 		wfcmd->write_cnt = (unsigned long) rbuf;
-		rbuf = 0;
+		rbuf = NULL;
 	}
 
 	DPRINT (WF_DEBUG_CMD, "0x%x [%s] (%d,%d,%d)\n",
@@ -612,7 +612,7 @@
 	wbuf[0] = sample_num & 0x7f;
 	wbuf[1] = sample_num >> 7;
 
-	if ((x = snd_wavefront_cmd (dev, WFC_DELETE_SAMPLE, 0, wbuf)) == 0) {
+	if ((x = snd_wavefront_cmd (dev, WFC_DELETE_SAMPLE, NULL, wbuf)) == 0) {
 		dev->sample_status[sample_num] = WF_ST_EMPTY;
 	}
 
@@ -798,7 +798,7 @@
 	bptr = munge_int32 (header->number, buf, 2);
 	munge_buf ((unsigned char *)&header->hdr.p, bptr, WF_PATCH_BYTES);
     
-	if (snd_wavefront_cmd (dev, WFC_DOWNLOAD_PATCH, 0, buf)) {
+	if (snd_wavefront_cmd (dev, WFC_DOWNLOAD_PATCH, NULL, buf)) {
 		snd_printk ("download patch failed\n");
 		return -(EIO);
 	}
@@ -836,7 +836,7 @@
 	buf[0] = header->number;
 	munge_buf ((unsigned char *)&header->hdr.pr, &buf[1], WF_PROGRAM_BYTES);
     
-	if (snd_wavefront_cmd (dev, WFC_DOWNLOAD_PROGRAM, 0, buf)) {
+	if (snd_wavefront_cmd (dev, WFC_DOWNLOAD_PROGRAM, NULL, buf)) {
 		snd_printk ("download patch failed\n");	
 		return -(EIO);
 	}
@@ -850,7 +850,7 @@
 {
 	char rbuf[8];
 
-	if (snd_wavefront_cmd (dev, WFC_REPORT_FREE_MEMORY, rbuf, 0)) {
+	if (snd_wavefront_cmd (dev, WFC_REPORT_FREE_MEMORY, rbuf, NULL)) {
 		snd_printk ("can't get memory stats.\n");
 		return -1;
 	} else {
@@ -876,7 +876,7 @@
 
 	u16 sample_short;
 	u32 length;
-	u16 __user *data_end = 0;
+	u16 __user *data_end = NULL;
 	unsigned int i;
 	const unsigned int max_blksize = 4096/2;
 	unsigned int written;
@@ -1053,7 +1053,7 @@
 	if (snd_wavefront_cmd (dev, 
 			   header->size ?
 			   WFC_DOWNLOAD_SAMPLE : WFC_DOWNLOAD_SAMPLE_HEADER,
-			   0, sample_hdr)) {
+			   NULL, sample_hdr)) {
 		snd_printk ("sample %sdownload refused.\n",
 			    header->size ? "" : "header ");
 		return -(EIO);
@@ -1079,7 +1079,7 @@
 			blocksize = ((length-written+7)&~0x7);
 		}
 
-		if (snd_wavefront_cmd (dev, WFC_DOWNLOAD_BLOCK, 0, 0)) {
+		if (snd_wavefront_cmd (dev, WFC_DOWNLOAD_BLOCK, NULL, NULL)) {
 			snd_printk ("download block "
 				    "request refused.\n");
 			return -(EIO);
@@ -1186,7 +1186,7 @@
 	munge_int32 (header->hdr.a.FrequencyBias, &alias_hdr[20], 3);
 	munge_int32 (*(&header->hdr.a.FrequencyBias+1), &alias_hdr[23], 2);
 
-	if (snd_wavefront_cmd (dev, WFC_DOWNLOAD_SAMPLE_ALIAS, 0, alias_hdr)) {
+	if (snd_wavefront_cmd (dev, WFC_DOWNLOAD_SAMPLE_ALIAS, NULL, alias_hdr)) {
 		snd_printk ("download alias failed.\n");
 		return -(EIO);
 	}
@@ -1314,7 +1314,7 @@
 		munge_int32 (((unsigned char *)drum)[i], &drumbuf[1+(i*2)], 2);
 	}
 
-	if (snd_wavefront_cmd (dev, WFC_DOWNLOAD_EDRUM_PROGRAM, 0, drumbuf)) {
+	if (snd_wavefront_cmd (dev, WFC_DOWNLOAD_EDRUM_PROGRAM, NULL, drumbuf)) {
 		snd_printk ("download drum failed.\n");
 		return -(EIO);
 	}
@@ -2085,7 +2085,7 @@
 
 	voices[0] = 32;
 
-	if (snd_wavefront_cmd (dev, WFC_SET_NVOICES, 0, voices)) {
+	if (snd_wavefront_cmd (dev, WFC_SET_NVOICES, NULL, voices)) {
 		snd_printk ("cannot set number of voices to 32.\n");
 		goto gone_bad;
 	}
diff -urN linux-2.6.8-rc2/sound/oss/aci.c linux-2.6.8-rc3/sound/oss/aci.c
--- linux-2.6.8-rc2/sound/oss/aci.c	2004-06-15 22:19:28.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/aci.c	2004-08-03 15:22:21.432560517 -0700
@@ -99,7 +99,7 @@
 MODULE_PARM_DESC(wss,"change between ACI/WSS-mixer; use 0 and 1 - untested"
 		 " default: do nothing; for PCM1-pro only");
 
-#if DEBUG
+#ifdef DEBUG
 static void print_bits(unsigned char c)
 {
 	int j;
@@ -184,7 +184,7 @@
 static inline int aci_rawwrite(unsigned char byte)
 {
 	if (busy_wait() >= 0) {
-#if DEBUG
+#ifdef DEBUG
 		printk(KERN_DEBUG "aci_rawwrite(%d)\n", byte);
 #endif
 		outb(byte, COMMAND_REGISTER);
@@ -199,7 +199,7 @@
 
 	if (busy_wait() >= 0) {
 		byte=inb(STATUS_REGISTER);
-#if DEBUG
+#ifdef DEBUG
 		printk(KERN_DEBUG "%d = aci_rawread()\n", byte);
 #endif
 		return byte;
diff -urN linux-2.6.8-rc2/sound/oss/ad1816.c linux-2.6.8-rc3/sound/oss/ad1816.c
--- linux-2.6.8-rc2/sound/oss/ad1816.c	2004-06-15 22:20:03.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/ad1816.c	2004-08-03 15:22:21.446561091 -0700
@@ -1235,10 +1235,10 @@
 } isapnp_ad1816_list[] __initdata = {
 	{	ISAPNP_ANY_ID, ISAPNP_ANY_ID,
 		ISAPNP_VENDOR('A','D','S'), ISAPNP_FUNCTION(0x7150), 
-		0 },
+		NULL },
 	{	ISAPNP_ANY_ID, ISAPNP_ANY_ID,
 		ISAPNP_VENDOR('A','D','S'), ISAPNP_FUNCTION(0x7180),
-		0 },
+		NULL },
 	{0}
 };
 
diff -urN linux-2.6.8-rc2/sound/oss/ad1848.c linux-2.6.8-rc3/sound/oss/ad1848.c
--- linux-2.6.8-rc2/sound/oss/ad1848.c	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/ad1848.c	2004-08-03 15:22:21.481562527 -0700
@@ -2962,7 +2962,7 @@
 		ISAPNP_VENDOR('G','R','V'), ISAPNP_DEVICE(0x0001),
 		ISAPNP_VENDOR('G','R','V'), ISAPNP_FUNCTION(0x0000),
 		0, 0, 0, 1, 0},
-	{0}
+	{NULL}
 };
 
 static struct isapnp_device_id id_table[] __devinitdata = {
diff -urN linux-2.6.8-rc2/sound/oss/ad1889.c linux-2.6.8-rc3/sound/oss/ad1889.c
--- linux-2.6.8-rc2/sound/oss/ad1889.c	2004-08-03 15:21:19.359014106 -0700
+++ linux-2.6.8-rc3/sound/oss/ad1889.c	2004-08-03 15:22:21.516563963 -0700
@@ -338,7 +338,7 @@
 		{ "AC97_3D_CONTROL", 0x100 + AC97_3D_CONTROL, 16 },
 		{ "AC97_MODEM_RATE", 0x100 + AC97_MODEM_RATE, 16 },
 		{ "AC97_POWER_CONTROL", 0x100 + AC97_POWER_CONTROL, 16 },
-		{ 0 }
+		{ NULL }
 	};
 
 	if (dev == NULL)
@@ -1017,7 +1017,7 @@
 	if ((err = ad1889_ac97_init(dev, 0)) != 0)
 		goto err_free_dsp;
 
-	if (((proc_root = proc_mkdir("driver/ad1889", 0)) == NULL) ||
+	if (((proc_root = proc_mkdir("driver/ad1889", NULL)) == NULL) ||
 	    create_proc_read_entry("ac97", S_IFREG|S_IRUGO, proc_root, ac97_read_proc, dev->ac97_codec) == NULL ||
 	    create_proc_read_entry("info", S_IFREG|S_IRUGO, proc_root, ad1889_read_proc, dev) == NULL) 
 		goto err_free_dsp;
@@ -1038,7 +1038,7 @@
 
 err_free_mem:
 	ad1889_free_dev(dev);
-	pci_set_drvdata(pcidev, 0);
+	pci_set_drvdata(pcidev, NULL);
 
 	return -ENODEV;
 }
diff -urN linux-2.6.8-rc2/sound/oss/ali5455.c linux-2.6.8-rc3/sound/oss/ali5455.c
--- linux-2.6.8-rc2/sound/oss/ali5455.c	2004-06-15 22:19:51.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/ali5455.c	2004-08-03 15:22:21.639569008 -0700
@@ -1583,7 +1583,7 @@
 			size_t count, loff_t * ppos)
 {
 	struct ali_state *state = (struct ali_state *) file->private_data;
-	struct ali_card *card = state ? state->card : 0;
+	struct ali_card *card = state ? state->card : NULL;
 	struct dmabuf *dmabuf = &state->dmabuf;
 	ssize_t ret;
 	unsigned long flags;
@@ -1724,7 +1724,7 @@
 			 const char __user *buffer, size_t count, loff_t * ppos)
 {
 	struct ali_state *state = (struct ali_state *) file->private_data;
-	struct ali_card *card = state ? state->card : 0;
+	struct ali_card *card = state ? state->card : NULL;
 	struct dmabuf *dmabuf = &state->dmabuf;
 	ssize_t ret;
 	unsigned long flags;
diff -urN linux-2.6.8-rc2/sound/oss/cs46xx.c linux-2.6.8-rc3/sound/oss/cs46xx.c
--- linux-2.6.8-rc2/sound/oss/cs46xx.c	2004-08-03 15:21:19.429016978 -0700
+++ linux-2.6.8-rc3/sound/oss/cs46xx.c	2004-08-03 15:22:21.822576516 -0700
@@ -2480,7 +2480,7 @@
 {
 	struct cs_card *card = (struct cs_card *)file->private_data;
 	struct cs_state *state;
-	struct dmabuf *dmabuf=0;
+	struct dmabuf *dmabuf=NULL;
 	unsigned long flags;
 	audio_buf_info abinfo;
 	count_info cinfo;
@@ -4271,7 +4271,7 @@
 			CS_DBGOUT(CS_FUNCTION | CS_INIT, 2, printk(KERN_INFO 
 				"cs46xx: cs_ac97_init()- codec number %d not found\n",
 					num_ac97) );
-			card->ac97_codec[num_ac97] = 0;
+			card->ac97_codec[num_ac97] = NULL;
 			break;
 		}
 		CS_DBGOUT(CS_FUNCTION | CS_INIT, 2, printk(KERN_INFO 
diff -urN linux-2.6.8-rc2/sound/oss/cs46xxpm-24.h linux-2.6.8-rc3/sound/oss/cs46xxpm-24.h
--- linux-2.6.8-rc2/sound/oss/cs46xxpm-24.h	2004-06-15 22:20:03.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/cs46xxpm-24.h	2004-08-03 15:22:21.824576598 -0700
@@ -38,7 +38,7 @@
 */
 static int cs46xx_suspend_tbl(struct pci_dev *pcidev, u32 state);
 static int cs46xx_resume_tbl(struct pci_dev *pcidev);
-#define cs_pm_register(a, b, c)  0
+#define cs_pm_register(a, b, c)  NULL
 #define cs_pm_unregister_all(a) 
 #define CS46XX_SUSPEND_TBL cs46xx_suspend_tbl
 #define CS46XX_RESUME_TBL cs46xx_resume_tbl
diff -urN linux-2.6.8-rc2/sound/oss/dmasound/dmasound.h linux-2.6.8-rc3/sound/oss/dmasound/dmasound.h
--- linux-2.6.8-rc2/sound/oss/dmasound/dmasound.h	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/dmasound/dmasound.h	2004-08-03 15:22:21.824576598 -0700
@@ -1,6 +1,6 @@
 #ifndef _dmasound_h_
 /*
- *  linux/drivers/sound/dmasound/dmasound.h
+ *  linux/sound/oss/dmasound/dmasound.h
  *
  *
  *  Minor numbers for the sound driver.
@@ -44,12 +44,12 @@
 #define le2be16dbl(x)	(((x)<<8 & 0xff00ff00) | ((x)>>8 & 0x00ff00ff))
 
 #define IOCTL_IN(arg, ret) \
-	do { int error = get_user(ret, (int *)(arg)); \
+	do { int error = get_user(ret, (int __user *)(arg)); \
 		if (error) return error; \
 	} while (0)
-#define IOCTL_OUT(arg, ret)	ioctl_return((int *)(arg), ret)
+#define IOCTL_OUT(arg, ret)	ioctl_return((int __user *)(arg), ret)
 
-static inline int ioctl_return(int *addr, int value)
+static inline int ioctl_return(int __user *addr, int value)
 {
 	return value < 0 ? value : put_user(value, addr);
 }
@@ -153,14 +153,14 @@
      */
 
 typedef struct {
-    ssize_t (*ct_ulaw)(const u_char *, size_t, u_char *, ssize_t *, ssize_t);
-    ssize_t (*ct_alaw)(const u_char *, size_t, u_char *, ssize_t *, ssize_t);
-    ssize_t (*ct_s8)(const u_char *, size_t, u_char *, ssize_t *, ssize_t);
-    ssize_t (*ct_u8)(const u_char *, size_t, u_char *, ssize_t *, ssize_t);
-    ssize_t (*ct_s16be)(const u_char *, size_t, u_char *, ssize_t *, ssize_t);
-    ssize_t (*ct_u16be)(const u_char *, size_t, u_char *, ssize_t *, ssize_t);
-    ssize_t (*ct_s16le)(const u_char *, size_t, u_char *, ssize_t *, ssize_t);
-    ssize_t (*ct_u16le)(const u_char *, size_t, u_char *, ssize_t *, ssize_t);
+    ssize_t (*ct_ulaw)(const u_char __user *, size_t, u_char *, ssize_t *, ssize_t);
+    ssize_t (*ct_alaw)(const u_char __user *, size_t, u_char *, ssize_t *, ssize_t);
+    ssize_t (*ct_s8)(const u_char __user *, size_t, u_char *, ssize_t *, ssize_t);
+    ssize_t (*ct_u8)(const u_char __user *, size_t, u_char *, ssize_t *, ssize_t);
+    ssize_t (*ct_s16be)(const u_char __user *, size_t, u_char *, ssize_t *, ssize_t);
+    ssize_t (*ct_u16be)(const u_char __user *, size_t, u_char *, ssize_t *, ssize_t);
+    ssize_t (*ct_s16le)(const u_char __user *, size_t, u_char *, ssize_t *, ssize_t);
+    ssize_t (*ct_u16le)(const u_char __user *, size_t, u_char *, ssize_t *, ssize_t);
 } TRANS;
 
 struct sound_settings {
diff -urN linux-2.6.8-rc2/sound/oss/dmasound/dmasound_atari.c linux-2.6.8-rc3/sound/oss/dmasound/dmasound_atari.c
--- linux-2.6.8-rc2/sound/oss/dmasound/dmasound_atari.c	2004-08-03 15:21:19.448017758 -0700
+++ linux-2.6.8-rc3/sound/oss/dmasound/dmasound_atari.c	2004-08-03 15:22:21.872578567 -0700
@@ -1,9 +1,9 @@
 /*
- *  linux/drivers/sound/dmasound/dmasound_atari.c
+ *  linux/sound/oss/dmasound/dmasound_atari.c
  *
  *  Atari TT and Falcon DMA Sound Driver
  *
- *  See linux/drivers/sound/dmasound/dmasound_core.c for copyright and credits
+ *  See linux/sound/oss/dmasound/dmasound_core.c for copyright and credits
  *  prior to 28/01/2001
  *
  *  28/01/2001 [0.1] Iain Sandoe
diff -urN linux-2.6.8-rc2/sound/oss/dmasound/dmasound_awacs.c linux-2.6.8-rc3/sound/oss/dmasound/dmasound_awacs.c
--- linux-2.6.8-rc2/sound/oss/dmasound/dmasound_awacs.c	2004-06-15 22:19:12.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/dmasound/dmasound_awacs.c	2004-08-03 15:22:21.893579428 -0700
@@ -1,10 +1,10 @@
 /*
- *  linux/drivers/sound/dmasound/dmasound_awacs.c
+ *  linux/sound/oss/dmasound/dmasound_awacs.c
  *
  *  PowerMac `AWACS' and `Burgundy' DMA Sound Driver
  *  with some limited support for DACA & Tumbler
  *
- *  See linux/drivers/sound/dmasound/dmasound_core.c for copyright and
+ *  See linux/sound/oss/dmasound/dmasound_core.c for copyright and
  *  history prior to 2001/01/26.
  *
  *	26/01/2001 ed 0.1 Iain Sandoe
@@ -326,12 +326,12 @@
 #undef IOCTL_OUT
 
 #define IOCTL_IN(arg, ret)	\
-	rc = get_user(ret, (int *)(arg)); \
+	rc = get_user(ret, (int __user *)(arg)); \
 	if (rc) break;
 #define IOCTL_OUT(arg, ret)	\
-	ioctl_return2((int *)(arg), ret)
+	ioctl_return2((int __user *)(arg), ret)
 
-static inline int ioctl_return2(int *addr, int value)
+static inline int ioctl_return2(int __user *addr, int value)
 {
 	return value < 0 ? value : put_user(value, addr);
 }
@@ -461,7 +461,7 @@
 	write_audio_gpio(gpio_audio_reset, !gpio_audio_reset_pol);
 	msleep(100);
   	if (gpio_headphone_irq) {
-		if (request_irq(gpio_headphone_irq,headphone_intr,0,"Headphone detect",0) < 0) {
+		if (request_irq(gpio_headphone_irq,headphone_intr,0,"Headphone detect",NULL) < 0) {
     			printk(KERN_ERR "tumbler: Can't request headphone interrupt\n");
     			gpio_headphone_irq = 0;
     		} else {
@@ -470,7 +470,7 @@
 			val = pmac_call_feature(PMAC_FTR_READ_GPIO, NULL, gpio_headphone_detect, 0);
 			pmac_call_feature(PMAC_FTR_WRITE_GPIO, NULL, gpio_headphone_detect, val | 0x80);
 			/* Trigger it */
-  			headphone_intr(0,0,0);
+  			headphone_intr(0,NULL,NULL);
   		}
   	}
   	if (!gpio_headphone_irq) {
@@ -487,7 +487,7 @@
 tas_dmasound_cleanup(void)
 {
 	if (gpio_headphone_irq)
-		free_irq(gpio_headphone_irq, 0);
+		free_irq(gpio_headphone_irq, NULL);
 	return 0;
 }
 
@@ -514,6 +514,7 @@
 static int
 tas_mixer_ioctl(u_int cmd, u_long arg)
 {
+	int __user *argp = (int __user *)arg;
 	int data;
 	int rc;
 
@@ -524,16 +525,16 @@
 
         if ((cmd & ~0xff) == MIXER_WRITE(0) &&
             tas_supported_mixers() & (1<<(cmd & 0xff))) {
-		rc = get_user(data, (int *)(arg));
+		rc = get_user(data, argp);
                 if (rc<0) return rc;
 		tas_set_mixer_level(cmd & 0xff, data);
 		tas_get_mixer_level(cmd & 0xff, &data);
-		return ioctl_return2((int *)(arg), data);
+		return ioctl_return2(argp, data);
         }
         if ((cmd & ~0xff) == MIXER_READ(0) &&
             tas_supported_mixers() & (1<<(cmd & 0xff))) {
 		tas_get_mixer_level(cmd & 0xff, &data);
-		return ioctl_return2((int *)(arg), data);
+		return ioctl_return2(argp, data);
         }
 
 	switch(cmd) {
@@ -627,10 +628,10 @@
 static int __init PMacIrqInit(void)
 {
 	if (awacs)
-		if (request_irq(awacs_irq, pmac_awacs_intr, 0, "Built-in Sound misc", 0))
+		if (request_irq(awacs_irq, pmac_awacs_intr, 0, "Built-in Sound misc", NULL))
 			return 0;
-	if (request_irq(awacs_tx_irq, pmac_awacs_tx_intr, 0, "Built-in Sound out", 0)
-	    || request_irq(awacs_rx_irq, pmac_awacs_rx_intr, 0, "Built-in Sound in", 0))
+	if (request_irq(awacs_tx_irq, pmac_awacs_tx_intr, 0, "Built-in Sound out", NULL)
+	    || request_irq(awacs_rx_irq, pmac_awacs_rx_intr, 0, "Built-in Sound in", NULL))
 		return 0;
 	return 1;
 }
@@ -656,9 +657,9 @@
 		msleep(200);
 	}
 	if (awacs)
-		free_irq(awacs_irq, 0);
-	free_irq(awacs_tx_irq, 0);
-	free_irq(awacs_rx_irq, 0);
+		free_irq(awacs_irq, NULL);
+	free_irq(awacs_tx_irq, NULL);
+	free_irq(awacs_rx_irq, NULL);
 	
 	if (awacs)
 		iounmap((void *)awacs);
@@ -1504,7 +1505,7 @@
 				write_audio_gpio(gpio_audio_reset, !gpio_audio_reset_pol);
 				msleep(150);
 				tas_leave_sleep(); /* Stub for now */
-				headphone_intr(0,0,0);
+				headphone_intr(0,NULL,NULL);
 				break;
 			case AWACS_DACA:
 				msleep(10); /* Check this !!! */
@@ -2969,7 +2970,7 @@
 
 		sound_device_id = 0;
 		/* device ID appears post g3 b&w */
-		prop = (unsigned int *)get_property(info, "device-id", 0);
+		prop = (unsigned int *)get_property(info, "device-id", NULL);
 		if (prop != 0)
 			sound_device_id = *prop;
 
@@ -3080,7 +3081,7 @@
 
 	} else if (is_pbook_g3) {
 		struct device_node* mio;
-		macio_base = 0;
+		macio_base = NULL;
 		for (mio = io->parent; mio; mio = mio->parent) {
 			if (strcmp(mio->name, "mac-io") == 0
 			    && mio->n_addrs > 0) {
diff -urN linux-2.6.8-rc2/sound/oss/dmasound/dmasound_core.c linux-2.6.8-rc3/sound/oss/dmasound/dmasound_core.c
--- linux-2.6.8-rc2/sound/oss/dmasound/dmasound_core.c	2004-06-15 22:18:59.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/dmasound/dmasound_core.c	2004-08-03 15:22:21.945581562 -0700
@@ -1,5 +1,5 @@
 /*
- *  linux/drivers/sound/dmasound/dmasound_core.c
+ *  linux/sound/oss/dmasound/dmasound_core.c
  *
  *
  *  OSS/Free compatible Atari TT/Falcon and Amiga DMA sound driver for
@@ -279,11 +279,11 @@
 	return stereo;
 }
 
-static ssize_t sound_copy_translate(TRANS *trans, const u_char *userPtr,
+static ssize_t sound_copy_translate(TRANS *trans, const u_char __user *userPtr,
 				    size_t userCount, u_char frame[],
 				    ssize_t *frameUsed, ssize_t frameLeft)
 {
-	ssize_t (*ct_func)(const u_char *, size_t, u_char *, ssize_t *, ssize_t);
+	ssize_t (*ct_func)(const u_char __user *, size_t, u_char *, ssize_t *, ssize_t);
 
 	switch (dmasound.soft.format) {
 	    case AFMT_MU_LAW:
@@ -361,7 +361,7 @@
 		    strlcpy(info.id, dmasound.mach.name2, sizeof(info.id));
 		    strlcpy(info.name, dmasound.mach.name2, sizeof(info.name));
 		    info.modify_counter = mixer.modify_counter;
-		    if (copy_to_user((int *)arg, &info, sizeof(info)))
+		    if (copy_to_user((void __user *)arg, &info, sizeof(info)))
 			    return -EFAULT;
 		    return 0;
 		}
@@ -425,7 +425,7 @@
 			while (i--)
 				dmasound.mach.dma_free(sq->buffers[i], size);
 			kfree(sq->buffers);
-			sq->buffers = 0;
+			sq->buffers = NULL;
 			return -ENOMEM;
 		}
 	}
@@ -447,7 +447,7 @@
 
 static int sq_setup(struct sound_queue *sq)
 {
-	int (*setup_func)(void) = 0;
+	int (*setup_func)(void) = NULL;
 	int hard_frame ;
 
 	if (sq->locked) { /* are we already set? - and not changeable */
@@ -546,7 +546,7 @@
 	dmasound.mach.play();
 }
 
-static ssize_t sq_write(struct file *file, const char *src, size_t uLeft,
+static ssize_t sq_write(struct file *file, const char __user *src, size_t uLeft,
 			loff_t *ppos)
 {
 	ssize_t uWritten = 0;
@@ -703,7 +703,7 @@
      *  it and restart the DMA.
      */
 
-static ssize_t sq_read(struct file *file, char *dst, size_t uLeft,
+static ssize_t sq_read(struct file *file, char __user *dst, size_t uLeft,
 		       loff_t *ppos)
 {
 
@@ -1321,7 +1321,7 @@
 			info.fragstotal = write_sq.max_active;
 			info.fragsize = write_sq.user_frag_size;
 			info.bytes = info.fragments * info.fragsize;
-			if (copy_to_user((void *)arg, &info, sizeof(info)))
+			if (copy_to_user((void __user *)arg, &info, sizeof(info)))
 				return -EFAULT;
 			return 0;
 		} else
@@ -1547,7 +1547,7 @@
 	return 0;
 }
 
-static ssize_t state_read(struct file *file, char *buf, size_t count,
+static ssize_t state_read(struct file *file, char __user *buf, size_t count,
 			  loff_t *ppos)
 {
 	int n = state.len - state.ptr;
diff -urN linux-2.6.8-rc2/sound/oss/dmasound/dmasound_paula.c linux-2.6.8-rc3/sound/oss/dmasound/dmasound_paula.c
--- linux-2.6.8-rc2/sound/oss/dmasound/dmasound_paula.c	2004-06-15 22:18:38.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/dmasound/dmasound_paula.c	2004-08-03 15:22:21.971582628 -0700
@@ -1,9 +1,9 @@
 /*
- *  linux/drivers/sound/dmasound/dmasound_paula.c
+ *  linux/sound/oss/dmasound/dmasound_paula.c
  *
  *  Amiga `Paula' DMA Sound Driver
  *
- *  See linux/drivers/sound/dmasound/dmasound_core.c for copyright and credits
+ *  See linux/sound/oss/dmasound/dmasound_core.c for copyright and credits
  *  prior to 28/01/2001
  *
  *  28/01/2001 [0.1] Iain Sandoe
diff -urN linux-2.6.8-rc2/sound/oss/dmasound/dmasound_q40.c linux-2.6.8-rc3/sound/oss/dmasound/dmasound_q40.c
--- linux-2.6.8-rc2/sound/oss/dmasound/dmasound_q40.c	2004-06-15 22:18:38.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/dmasound/dmasound_q40.c	2004-08-03 15:22:21.971582628 -0700
@@ -1,9 +1,9 @@
 /*
- *  linux/drivers/sound/dmasound/dmasound_q40.c
+ *  linux/sound/oss/dmasound/dmasound_q40.c
  *
  *  Q40 DMA Sound Driver
  *
- *  See linux/drivers/sound/dmasound/dmasound_core.c for copyright and credits
+ *  See linux/sound/oss/dmasound/dmasound_core.c for copyright and credits
  *  prior to 28/01/2001
  *
  *  28/01/2001 [0.1] Iain Sandoe
diff -urN linux-2.6.8-rc2/sound/oss/dmasound/tas3001c.c linux-2.6.8-rc3/sound/oss/dmasound/tas3001c.c
--- linux-2.6.8-rc2/sound/oss/dmasound/tas3001c.c	2004-06-15 22:18:59.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/dmasound/tas3001c.c	2004-08-03 15:22:21.973582710 -0700
@@ -452,8 +452,9 @@
 {
 	int rc;
 	struct tas_biquad_ctrl_t biquad;
+	void __user *argp = (void __user *)arg;
 
-	if (copy_from_user((void *)&biquad, (const void *)arg, sizeof(struct tas_biquad_ctrl_t))) {
+	if (copy_from_user(&biquad, argp, sizeof(struct tas_biquad_ctrl_t))) {
 		return -EFAULT;
 	}
 
@@ -466,7 +467,7 @@
 		rc=tas3001c_read_biquad(self, biquad.channel, biquad.filter, &biquad.data);
 		if (rc != 0) return rc;
 
-		if (copy_to_user((void *)arg, (const void *)&biquad, sizeof(struct tas_biquad_ctrl_t))) {
+		if (copy_to_user(argp, &biquad, sizeof(struct tas_biquad_ctrl_t))) {
 			return -EFAULT;
 		}
 
@@ -485,27 +486,21 @@
 	int i,j;
 	char sync_required[2][6];
 	struct tas_biquad_ctrl_t biquad;
+	struct tas_biquad_ctrl_list_t __user *argp = (void __user *)arg;
 
 	memset(sync_required,0,sizeof(sync_required));
 
-	if (copy_from_user((void *)&filter_count,
-			   (const void *)arg + offsetof(struct tas_biquad_ctrl_list_t,filter_count),
-			   sizeof(int))) {
+	if (copy_from_user(&filter_count, &argp->filter_count, sizeof(int)))
 		return -EFAULT;
-	}
 
-	if (copy_from_user((void *)&flags,
-			   (const void *)arg + offsetof(struct tas_biquad_ctrl_list_t,flags),
-			   sizeof(int))) {
+	if (copy_from_user(&flags, &argp->flags, sizeof(int)))
 		return -EFAULT;
-	}
 
 	if (cmd & SIOC_IN) {
 	}
 
 	for (i=0; i < filter_count; i++) {
-		if (copy_from_user((void *)&biquad,
-				   (const void *)arg + offsetof(struct tas_biquad_ctrl_list_t, biquads[i]),
+		if (copy_from_user(&biquad, &argp->biquads[i],
 				   sizeof(struct tas_biquad_ctrl_t))) {
 			return -EFAULT;
 		}
@@ -520,8 +515,7 @@
 			rc=tas3001c_read_biquad(self, biquad.channel, biquad.filter, &biquad.data);
 			if (rc != 0) return rc;
 
-			if (copy_to_user((void *)arg + offsetof(struct tas_biquad_ctrl_list_t, biquads[i]),
-					 (const void *)&biquad,
+			if (copy_to_user(&argp->biquads[i], &biquad,
 					 sizeof(struct tas_biquad_ctrl_t))) {
 				return -EFAULT;
 			}
@@ -596,12 +590,10 @@
 {
 	int rc;
 	struct tas_drce_ctrl_t drce_ctrl;
+	void __user *argp = (void __user *)arg;
 
-	if (copy_from_user((void *)&drce_ctrl,
-			   (const void *)arg,
-			   sizeof(struct tas_drce_ctrl_t))) {
+	if (copy_from_user(&drce_ctrl, argp, sizeof(struct tas_drce_ctrl_t)))
 		return -EFAULT;
-	}
 
 #ifdef DEBUG_DRCE
 	printk("DRCE IOCTL: input [ FLAGS:%x ENABLE:%x THRESH:%x\n",
@@ -623,8 +615,7 @@
 		if (drce_ctrl.flags & TAS_DRCE_THRESHOLD)
 			drce_ctrl.data.threshold = self->drce_state.threshold;
 
-		if (copy_to_user((void *)arg,
-				 (const void *)&drce_ctrl,
+		if (copy_to_user(argp, &drce_ctrl,
 				 sizeof(struct tas_drce_ctrl_t))) {
 			return -EFAULT;
 		}
@@ -703,6 +694,7 @@
 			u_int cmd,
 			u_long arg)
 {
+	uint __user *argp = (void __user *)arg;
 	switch (cmd) {
 	case TAS_READ_EQ:
 	case TAS_WRITE_EQ:
@@ -713,11 +705,11 @@
 		return tas3001c_eq_list_rw(self, cmd, arg);
 
 	case TAS_READ_EQ_FILTER_COUNT:
-		put_user(TAS3001C_BIQUAD_FILTER_COUNT, (uint *)(arg));
+		put_user(TAS3001C_BIQUAD_FILTER_COUNT, argp);
 		return 0;
 
 	case TAS_READ_EQ_CHANNEL_COUNT:
-		put_user(TAS3001C_BIQUAD_CHANNEL_COUNT, (uint *)(arg));
+		put_user(TAS3001C_BIQUAD_CHANNEL_COUNT, argp);
 		return 0;
 
 	case TAS_READ_DRCE:
@@ -725,15 +717,14 @@
 		return tas3001c_drce_rw(self, cmd, arg);
 
 	case TAS_READ_DRCE_CAPS:
-		put_user(TAS_DRCE_ENABLE | TAS_DRCE_THRESHOLD, (uint *)(arg));
+		put_user(TAS_DRCE_ENABLE | TAS_DRCE_THRESHOLD, argp);
 		return 0;
 
 	case TAS_READ_DRCE_MIN:
 	case TAS_READ_DRCE_MAX: {
 		struct tas_drce_ctrl_t drce_ctrl;
 
-		if (copy_from_user((void *)&drce_ctrl,
-				   (const void *)arg,
+		if (copy_from_user(&drce_ctrl, argp,
 				   sizeof(struct tas_drce_ctrl_t))) {
 			return -EFAULT;
 		}
@@ -746,8 +737,7 @@
 			}
 		}
 
-		if (copy_to_user((void *)arg,
-				 (const void *)&drce_ctrl,
+		if (copy_to_user(argp, &drce_ctrl,
 				 sizeof(struct tas_drce_ctrl_t))) {
 			return -EFAULT;
 		}
diff -urN linux-2.6.8-rc2/sound/oss/dmasound/tas3001c_tables.c linux-2.6.8-rc3/sound/oss/dmasound/tas3001c_tables.c
--- linux-2.6.8-rc2/sound/oss/dmasound/tas3001c_tables.c	2004-06-15 22:18:37.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/dmasound/tas3001c_tables.c	2004-08-03 15:22:21.973582710 -0700
@@ -3,12 +3,12 @@
 
 static struct tas_drce_t eqp_0e_2_1_drce = {
   .enable     = 1,
-  .above      { .val = 3.0 * (1<<8), .expand = 0 },
-  .below      { .val = 1.0 * (1<<8), .expand = 0 },
-  .threshold  -15.33  * (1<<8),
-  .energy     2.4     * (1<<12),
-  .attack     0.013   * (1<<12),
-  .decay      0.212   * (1<<12),
+  .above      = { .val = 3.0 * (1<<8), .expand = 0 },
+  .below      = { .val = 1.0 * (1<<8), .expand = 0 },
+  .threshold  = -15.33  * (1<<8),
+  .energy     = 2.4     * (1<<12),
+  .attack     = 0.013   * (1<<12),
+  .decay      = 0.212   * (1<<12),
 };
 
 static struct tas_biquad_ctrl_t eqp_0e_2_1_biquads[]={
diff -urN linux-2.6.8-rc2/sound/oss/dmasound/tas3004.c linux-2.6.8-rc3/sound/oss/dmasound/tas3004.c
--- linux-2.6.8-rc2/sound/oss/dmasound/tas3004.c	2004-06-15 22:19:52.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/dmasound/tas3004.c	2004-08-03 15:22:21.974582751 -0700
@@ -635,10 +635,11 @@
 		u_int cmd,
 		u_long arg)
 {
+	void __user *argp = (void __user *)arg;
 	int rc;
 	struct tas_biquad_ctrl_t biquad;
 
-	if (copy_from_user((void *)&biquad, (const void *)arg, sizeof(struct tas_biquad_ctrl_t))) {
+	if (copy_from_user((void *)&biquad, argp, sizeof(struct tas_biquad_ctrl_t))) {
 		return -EFAULT;
 	}
 
@@ -651,7 +652,7 @@
 		rc=tas3004_read_biquad(self, biquad.channel, biquad.filter, &biquad.data);
 		if (rc != 0) return rc;
 
-		if (copy_to_user((void *)arg, (const void *)&biquad, sizeof(struct tas_biquad_ctrl_t))) {
+		if (copy_to_user(argp, &biquad, sizeof(struct tas_biquad_ctrl_t))) {
 			return -EFAULT;
 		}
 
@@ -670,27 +671,21 @@
 	int i,j;
 	char sync_required[TAS3004_BIQUAD_CHANNEL_COUNT][TAS3004_BIQUAD_FILTER_COUNT];
 	struct tas_biquad_ctrl_t biquad;
+	struct tas_biquad_ctrl_list_t __user *argp = (void __user *)arg;
 
 	memset(sync_required,0,sizeof(sync_required));
 
-	if (copy_from_user((void *)&filter_count,
-			   (const void *)arg + offsetof(struct tas_biquad_ctrl_list_t,filter_count),
-			   sizeof(int))) {
+	if (copy_from_user(&filter_count, &argp->filter_count, sizeof(int)))
 		return -EFAULT;
-	}
 
-	if (copy_from_user((void *)&flags,
-			   (const void *)arg + offsetof(struct tas_biquad_ctrl_list_t,flags),
-			   sizeof(int))) {
+	if (copy_from_user(&flags, &argp->flags, sizeof(int)))
 		return -EFAULT;
-	}
 
 	if (cmd & SIOC_IN) {
 	}
 
 	for (i=0; i < filter_count; i++) {
-		if (copy_from_user((void *)&biquad,
-				   (const void *)arg + offsetof(struct tas_biquad_ctrl_list_t, biquads[i]),
+		if (copy_from_user(&biquad, &argp->biquads[i],
 				   sizeof(struct tas_biquad_ctrl_t))) {
 			return -EFAULT;
 		}
@@ -705,8 +700,7 @@
 			rc=tas3004_read_biquad(self, biquad.channel, biquad.filter, &biquad.data);
 			if (rc != 0) return rc;
 
-			if (copy_to_user((void *)arg + offsetof(struct tas_biquad_ctrl_list_t, biquads[i]),
-					 (const void *)&biquad,
+			if (copy_to_user(&argp->biquads[i], &biquad,
 					 sizeof(struct tas_biquad_ctrl_t))) {
 				return -EFAULT;
 			}
@@ -840,12 +834,10 @@
 {
 	int rc;
 	struct tas_drce_ctrl_t drce_ctrl;
+	void __user *argp = (void __user *)arg;
 
-	if (copy_from_user((void *)&drce_ctrl,
-			   (const void *)arg,
-			   sizeof(struct tas_drce_ctrl_t))) {
+	if (copy_from_user(&drce_ctrl, argp, sizeof(struct tas_drce_ctrl_t)))
 		return -EFAULT;
-	}
 
 #ifdef DEBUG_DRCE
 	printk("DRCE: input [ FLAGS:%x ENABLE:%x ABOVE:%x/%x BELOW:%x/%x THRESH:%x ENERGY:%x ATTACK:%x DECAY:%x\n",
@@ -880,8 +872,7 @@
 		if (drce_ctrl.flags & TAS_DRCE_DECAY)
 			drce_ctrl.data.decay = self->drce_state.decay;
 
-		if (copy_to_user((void *)arg,
-				 (const void *)&drce_ctrl,
+		if (copy_to_user(argp, &drce_ctrl,
 				 sizeof(struct tas_drce_ctrl_t))) {
 			return -EFAULT;
 		}
@@ -952,6 +943,7 @@
 			u_int cmd,
 			u_long arg)
 {
+	uint __user *argp = (void __user *)arg;
 	switch (cmd) {
 	case TAS_READ_EQ:
 	case TAS_WRITE_EQ:
@@ -962,11 +954,11 @@
 		return tas3004_eq_list_rw(self, cmd, arg);
 
 	case TAS_READ_EQ_FILTER_COUNT:
-		put_user(TAS3004_BIQUAD_FILTER_COUNT, (uint *)(arg));
+		put_user(TAS3004_BIQUAD_FILTER_COUNT, argp);
 		return 0;
 
 	case TAS_READ_EQ_CHANNEL_COUNT:
-		put_user(TAS3004_BIQUAD_CHANNEL_COUNT, (uint *)(arg));
+		put_user(TAS3004_BIQUAD_CHANNEL_COUNT, argp);
 		return 0;
 
 	case TAS_READ_DRCE:
@@ -981,7 +973,7 @@
 			 TAS_DRCE_ENERGY         |
 			 TAS_DRCE_ATTACK         |
 			 TAS_DRCE_DECAY,
-			 (uint *)(arg));
+			 argp);
 		return 0;
 
 	case TAS_READ_DRCE_MIN:
@@ -989,8 +981,7 @@
 		struct tas_drce_ctrl_t drce_ctrl;
 		const struct tas_drce_t *drce_copy;
 
-		if (copy_from_user((void *)&drce_ctrl,
-				   (const void *)arg,
+		if (copy_from_user(&drce_ctrl, argp,
 				   sizeof(struct tas_drce_ctrl_t))) {
 			return -EFAULT;
 		}
@@ -1020,8 +1011,7 @@
 			drce_ctrl.data.decay=drce_copy->decay;
 		}
 
-		if (copy_to_user((void *)arg,
-				 (const void *)&drce_ctrl,
+		if (copy_to_user(argp, &drce_ctrl,
 				 sizeof(struct tas_drce_ctrl_t))) {
 			return -EFAULT;
 		}
diff -urN linux-2.6.8-rc2/sound/oss/dmasound/trans_16.c linux-2.6.8-rc3/sound/oss/dmasound/trans_16.c
--- linux-2.6.8-rc2/sound/oss/dmasound/trans_16.c	2004-06-15 22:20:03.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/dmasound/trans_16.c	2004-08-03 15:22:21.976582833 -0700
@@ -1,9 +1,9 @@
 /*
- *  linux/drivers/sound/dmasound/trans_16.c
+ *  linux/sound/oss/dmasound/trans_16.c
  *
  *  16 bit translation routines.  Only used by Power mac at present.
  *
- *  See linux/drivers/sound/dmasound/dmasound_core.c for copyright and
+ *  See linux/sound/oss/dmasound/dmasound_core.c for copyright and
  *  history prior to 08/02/2001.
  *
  *  08/02/2001 Iain Sandoe
@@ -20,42 +20,42 @@
 static short dmasound_alaw2dma16[] ;
 static short dmasound_ulaw2dma16[] ;
 
-static ssize_t pmac_ct_law(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ct_law(const u_char __user *userPtr, size_t userCount,
 			   u_char frame[], ssize_t *frameUsed,
 			   ssize_t frameLeft);
-static ssize_t pmac_ct_s8(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ct_s8(const u_char __user *userPtr, size_t userCount,
 			  u_char frame[], ssize_t *frameUsed,
 			  ssize_t frameLeft);
-static ssize_t pmac_ct_u8(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ct_u8(const u_char __user *userPtr, size_t userCount,
 			  u_char frame[], ssize_t *frameUsed,
 			  ssize_t frameLeft);
-static ssize_t pmac_ct_s16(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ct_s16(const u_char __user *userPtr, size_t userCount,
 			   u_char frame[], ssize_t *frameUsed,
 			   ssize_t frameLeft);
-static ssize_t pmac_ct_u16(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ct_u16(const u_char __user *userPtr, size_t userCount,
 			   u_char frame[], ssize_t *frameUsed,
 			   ssize_t frameLeft);
 
-static ssize_t pmac_ctx_law(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ctx_law(const u_char __user *userPtr, size_t userCount,
 			    u_char frame[], ssize_t *frameUsed,
 			    ssize_t frameLeft);
-static ssize_t pmac_ctx_s8(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ctx_s8(const u_char __user *userPtr, size_t userCount,
 			   u_char frame[], ssize_t *frameUsed,
 			   ssize_t frameLeft);
-static ssize_t pmac_ctx_u8(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ctx_u8(const u_char __user *userPtr, size_t userCount,
 			   u_char frame[], ssize_t *frameUsed,
 			   ssize_t frameLeft);
-static ssize_t pmac_ctx_s16(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ctx_s16(const u_char __user *userPtr, size_t userCount,
 			    u_char frame[], ssize_t *frameUsed,
 			    ssize_t frameLeft);
-static ssize_t pmac_ctx_u16(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ctx_u16(const u_char __user *userPtr, size_t userCount,
 			    u_char frame[], ssize_t *frameUsed,
 			    ssize_t frameLeft);
 
-static ssize_t pmac_ct_s16_read(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ct_s16_read(const u_char __user *userPtr, size_t userCount,
 			   u_char frame[], ssize_t *frameUsed,
 			   ssize_t frameLeft);
-static ssize_t pmac_ct_u16_read(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ct_u16_read(const u_char __user *userPtr, size_t userCount,
 			   u_char frame[], ssize_t *frameUsed,
 			   ssize_t frameLeft);
 
@@ -63,7 +63,7 @@
 
 static int expand_data;	/* Data for expanding */
 
-static ssize_t pmac_ct_law(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ct_law(const u_char __user *userPtr, size_t userCount,
 			   u_char frame[], ssize_t *frameUsed,
 			   ssize_t frameLeft)
 {
@@ -96,7 +96,7 @@
 }
 
 
-static ssize_t pmac_ct_s8(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ct_s8(const u_char __user *userPtr, size_t userCount,
 			  u_char frame[], ssize_t *frameUsed,
 			  ssize_t frameLeft)
 {
@@ -127,7 +127,7 @@
 }
 
 
-static ssize_t pmac_ct_u8(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ct_u8(const u_char __user *userPtr, size_t userCount,
 			  u_char frame[], ssize_t *frameUsed,
 			  ssize_t frameLeft)
 {
@@ -158,7 +158,7 @@
 }
 
 
-static ssize_t pmac_ct_s16(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ct_s16(const u_char __user *userPtr, size_t userCount,
 			   u_char frame[], ssize_t *frameUsed,
 			   ssize_t frameLeft)
 {
@@ -170,7 +170,7 @@
 	userCount >>= (stereo? 2: 1);
 	used = count = min_t(unsigned long, userCount, frameLeft);
 	if (!stereo) {
-		short *up = (short *) userPtr;
+		short __user *up = (short __user *) userPtr;
 		while (count > 0) {
 			short data;
 			if (get_user(data, up++))
@@ -187,7 +187,7 @@
 	return stereo? used * 4: used * 2;
 }
 
-static ssize_t pmac_ct_u16(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ct_u16(const u_char __user *userPtr, size_t userCount,
 			   u_char frame[], ssize_t *frameUsed,
 			   ssize_t frameLeft)
 {
@@ -195,7 +195,7 @@
 	int mask = (dmasound.soft.format == AFMT_U16_LE? 0x0080: 0x8000);
 	int stereo = dmasound.soft.stereo;
 	short *fp = (short *) &frame[*frameUsed];
-	short *up = (short *) userPtr;
+	short __user *up = (short __user *) userPtr;
 
 	frameLeft >>= 2;
 	userCount >>= (stereo? 2: 1);
@@ -219,7 +219,7 @@
 }
 
 
-static ssize_t pmac_ctx_law(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ctx_law(const u_char __user *userPtr, size_t userCount,
 			    u_char frame[], ssize_t *frameUsed,
 			    ssize_t frameLeft)
 {
@@ -266,7 +266,7 @@
 	return stereo? utotal * 2: utotal;
 }
 
-static ssize_t pmac_ctx_s8(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ctx_s8(const u_char __user *userPtr, size_t userCount,
 			   u_char frame[], ssize_t *frameUsed,
 			   ssize_t frameLeft)
 {
@@ -311,7 +311,7 @@
 }
 
 
-static ssize_t pmac_ctx_u8(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ctx_u8(const u_char __user *userPtr, size_t userCount,
 			   u_char frame[], ssize_t *frameUsed,
 			   ssize_t frameLeft)
 {
@@ -356,13 +356,13 @@
 }
 
 
-static ssize_t pmac_ctx_s16(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ctx_s16(const u_char __user *userPtr, size_t userCount,
 			    u_char frame[], ssize_t *frameUsed,
 			    ssize_t frameLeft)
 {
 	unsigned int *p = (unsigned int *) &frame[*frameUsed];
 	unsigned int data = expand_data;
-	unsigned short *up = (unsigned short *) userPtr;
+	unsigned short __user *up = (unsigned short __user *) userPtr;
 	int bal = expand_bal;
 	int hSpeed = dmasound.hard.speed, sSpeed = dmasound.soft.speed;
 	int stereo = dmasound.soft.stereo;
@@ -400,14 +400,14 @@
 }
 
 
-static ssize_t pmac_ctx_u16(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ctx_u16(const u_char __user *userPtr, size_t userCount,
 			    u_char frame[], ssize_t *frameUsed,
 			    ssize_t frameLeft)
 {
 	int mask = (dmasound.soft.format == AFMT_U16_LE? 0x0080: 0x8000);
 	unsigned int *p = (unsigned int *) &frame[*frameUsed];
 	unsigned int data = expand_data;
-	unsigned short *up = (unsigned short *) userPtr;
+	unsigned short __user *up = (unsigned short __user *) userPtr;
 	int bal = expand_bal;
 	int hSpeed = dmasound.hard.speed, sSpeed = dmasound.soft.speed;
 	int stereo = dmasound.soft.stereo;
@@ -447,7 +447,7 @@
 
 /* data in routines... */
 
-static ssize_t pmac_ct_s8_read(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ct_s8_read(const u_char __user *userPtr, size_t userCount,
 			  u_char frame[], ssize_t *frameUsed,
 			  ssize_t frameLeft)
 {
@@ -465,13 +465,13 @@
 		val = *p++;
 		val = (val * software_input_volume) >> 7;
 		data = val >> 8;
-		if (put_user(data, (u_char *)userPtr++))
+		if (put_user(data, (u_char __user *)userPtr++))
 			return -EFAULT;
 		if (stereo) {
 			val = *p;
 			val = (val * software_input_volume) >> 7;
 			data = val >> 8;
-			if (put_user(data, (u_char *)userPtr++))
+			if (put_user(data, (u_char __user *)userPtr++))
 				return -EFAULT;
 		}
 		p++;
@@ -482,7 +482,7 @@
 }
 
 
-static ssize_t pmac_ct_u8_read(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ct_u8_read(const u_char __user *userPtr, size_t userCount,
 			  u_char frame[], ssize_t *frameUsed,
 			  ssize_t frameLeft)
 {
@@ -500,13 +500,13 @@
 		val = *p++;
 		val = (val * software_input_volume) >> 7;
 		data = (val >> 8) ^ 0x80;
-		if (put_user(data, (u_char *)userPtr++))
+		if (put_user(data, (u_char __user *)userPtr++))
 			return -EFAULT;
 		if (stereo) {
 			val = *p;
 			val = (val * software_input_volume) >> 7;
 			data = (val >> 8) ^ 0x80;
-			if (put_user(data, (u_char *)userPtr++))
+			if (put_user(data, (u_char __user *)userPtr++))
 				return -EFAULT;
 		}
 		p++;
@@ -516,14 +516,14 @@
 	return stereo? used * 2: used;
 }
 
-static ssize_t pmac_ct_s16_read(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ct_s16_read(const u_char __user *userPtr, size_t userCount,
 			   u_char frame[], ssize_t *frameUsed,
 			   ssize_t frameLeft)
 {
 	ssize_t count, used;
 	int stereo = dmasound.soft.stereo;
 	short *fp = (short *) &frame[*frameUsed];
-	short *up = (short *) userPtr;
+	short __user *up = (short __user *) userPtr;
 
 	frameLeft >>= 2;
 	userCount >>= (stereo? 2: 1);
@@ -548,7 +548,7 @@
 	return stereo? used * 4: used * 2;
 }
 
-static ssize_t pmac_ct_u16_read(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ct_u16_read(const u_char __user *userPtr, size_t userCount,
 			   u_char frame[], ssize_t *frameUsed,
 			   ssize_t frameLeft)
 {
@@ -556,7 +556,7 @@
 	int mask = (dmasound.soft.format == AFMT_U16_LE? 0x0080: 0x8000);
 	int stereo = dmasound.soft.stereo;
 	short *fp = (short *) &frame[*frameUsed];
-	short *up = (short *) userPtr;
+	short __user *up = (short __user *) userPtr;
 
 	frameLeft >>= 2;
 	userCount >>= (stereo? 2: 1);
@@ -585,7 +585,7 @@
 
 /* data in routines (reducing speed)... */
 
-static ssize_t pmac_ctx_s8_read(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ctx_s8_read(const u_char __user *userPtr, size_t userCount,
 			  u_char frame[], ssize_t *frameUsed,
 			  ssize_t frameLeft)
 {
@@ -614,11 +614,11 @@
 		p++;
 		if (bal < 0) {
 			data = vall >> 8;
-			if (put_user(data, (u_char *)userPtr++))
+			if (put_user(data, (u_char __user *)userPtr++))
 				return -EFAULT;
 			if (stereo) {
 				data = valr >> 8;
-				if (put_user(data, (u_char *)userPtr++))
+				if (put_user(data, (u_char __user *)userPtr++))
 					return -EFAULT;
 			}
 			userCount--;
@@ -634,7 +634,7 @@
 }
 
 
-static ssize_t pmac_ctx_u8_read(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ctx_u8_read(const u_char __user *userPtr, size_t userCount,
 			  u_char frame[], ssize_t *frameUsed,
 			  ssize_t frameLeft)
 {
@@ -664,11 +664,11 @@
 		p++;
 		if (bal < 0) {
 			data = (vall >> 8) ^ 0x80;
-			if (put_user(data, (u_char *)userPtr++))
+			if (put_user(data, (u_char __user *)userPtr++))
 				return -EFAULT;
 			if (stereo) {
 				data = (valr >> 8) ^ 0x80;
-				if (put_user(data, (u_char *)userPtr++))
+				if (put_user(data, (u_char __user *)userPtr++))
 					return -EFAULT;
 			}
 			userCount--;
@@ -683,13 +683,13 @@
 	return stereo? utotal * 2: utotal;
 }
 
-static ssize_t pmac_ctx_s16_read(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ctx_s16_read(const u_char __user *userPtr, size_t userCount,
 			   u_char frame[], ssize_t *frameUsed,
 			   ssize_t frameLeft)
 {
 	int bal = expand_read_bal;
 	short *fp = (short *) &frame[*frameUsed];
-	short *up = (short *) userPtr;
+	short __user *up = (short __user *) userPtr;
 	int stereo = dmasound.soft.stereo;
 	int hSpeed = dmasound.hard.speed, sSpeed = dmasound.soft.speed;
 	int utotal, ftotal;
@@ -730,14 +730,14 @@
 	return stereo? utotal * 4: utotal * 2;
 }
 
-static ssize_t pmac_ctx_u16_read(const u_char *userPtr, size_t userCount,
+static ssize_t pmac_ctx_u16_read(const u_char __user *userPtr, size_t userCount,
 			   u_char frame[], ssize_t *frameUsed,
 			   ssize_t frameLeft)
 {
 	int bal = expand_read_bal;
 	int mask = (dmasound.soft.format == AFMT_U16_LE? 0x0080: 0x8000);
 	short *fp = (short *) &frame[*frameUsed];
-	short *up = (short *) userPtr;
+	short __user *up = (short __user *) userPtr;
 	int stereo = dmasound.soft.stereo;
 	int hSpeed = dmasound.hard.speed, sSpeed = dmasound.soft.speed;
 	int utotal, ftotal;
diff -urN linux-2.6.8-rc2/sound/oss/emu10k1/main.c linux-2.6.8-rc3/sound/oss/emu10k1/main.c
--- linux-2.6.8-rc2/sound/oss/emu10k1/main.c	2004-06-15 22:20:04.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/emu10k1/main.c	2004-08-03 15:22:22.011584269 -0700
@@ -342,26 +342,26 @@
 {
 	char s[48];
 
-	if (!proc_mkdir ("driver/emu10k1", 0)) {
+	if (!proc_mkdir ("driver/emu10k1", NULL)) {
 		printk(KERN_ERR "emu10k1: unable to create proc directory driver/emu10k1\n");
 		goto err_out;
 	}
 
 	sprintf(s, "driver/emu10k1/%s", pci_name(card->pci_dev));
-	if (!proc_mkdir (s, 0)) {
+	if (!proc_mkdir (s, NULL)) {
 		printk(KERN_ERR "emu10k1: unable to create proc directory %s\n", s);
 		goto err_emu10k1_proc;
 	}
 
 	sprintf(s, "driver/emu10k1/%s/info", pci_name(card->pci_dev));
-	if (!create_proc_read_entry (s, 0, 0, emu10k1_info_proc, card)) {
+	if (!create_proc_read_entry (s, 0, NULL, emu10k1_info_proc, card)) {
 		printk(KERN_ERR "emu10k1: unable to create proc entry %s\n", s);
 		goto err_dev_proc;
 	}
 
 	if (!card->is_aps) {
 		sprintf(s, "driver/emu10k1/%s/ac97", pci_name(card->pci_dev));
-		if (!create_proc_read_entry (s, 0, 0, ac97_read_proc, card->ac97)) {
+		if (!create_proc_read_entry (s, 0, NULL, ac97_read_proc, card->ac97)) {
 			printk(KERN_ERR "emu10k1: unable to create proc entry %s\n", s);
 			goto err_proc_ac97;
 		}
diff -urN linux-2.6.8-rc2/sound/oss/emu10k1/midi.c linux-2.6.8-rc3/sound/oss/emu10k1/midi.c
--- linux-2.6.8-rc2/sound/oss/emu10k1/midi.c	2004-06-15 22:20:26.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/emu10k1/midi.c	2004-08-03 15:22:22.042585541 -0700
@@ -532,7 +532,7 @@
 
 	if (card->seq_mididev) {
 		kfree(card->seq_mididev);
-		card->seq_mididev = 0;
+		card->seq_mididev = NULL;
 	}
 }
 
diff -urN linux-2.6.8-rc2/sound/oss/forte.c linux-2.6.8-rc3/sound/oss/forte.c
--- linux-2.6.8-rc2/sound/oss/forte.c	2004-06-15 22:19:13.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/forte.c	2004-08-03 15:22:22.053585992 -0700
@@ -1847,15 +1847,15 @@
 static int __init 
 forte_proc_init (void)
 {
-	if (!proc_mkdir ("driver/forte", 0))
+	if (!proc_mkdir ("driver/forte", NULL))
 		return -EIO;
 
-	if (!create_proc_read_entry ("driver/forte/chip", 0, 0, forte_proc_read, forte)) {
+	if (!create_proc_read_entry ("driver/forte/chip", 0, NULL, forte_proc_read, forte)) {
 		remove_proc_entry ("driver/forte", NULL);
 		return -EIO;
 	}
 
-	if (!create_proc_read_entry("driver/forte/ac97", 0, 0, ac97_read_proc, forte->ac97)) {
+	if (!create_proc_read_entry("driver/forte/ac97", 0, NULL, ac97_read_proc, forte->ac97)) {
 		remove_proc_entry ("driver/forte/chip", NULL);
 		remove_proc_entry ("driver/forte", NULL);
 		return -EIO;
diff -urN linux-2.6.8-rc2/sound/oss/gus_card.c linux-2.6.8-rc3/sound/oss/gus_card.c
--- linux-2.6.8-rc2/sound/oss/gus_card.c	2004-06-15 22:18:37.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/gus_card.c	2004-08-03 15:22:22.054586033 -0700
@@ -41,9 +41,6 @@
 {
 	gus_wave_init(hw_config);
 
-	request_region(hw_config->io_base, 16, "GUS");
-	request_region(hw_config->io_base + 0x100, 12, "GUS");	/* 0x10c-> is MAX */
-
 	if (sound_alloc_dma(hw_config->dma, "GUS"))
 		printk(KERN_ERR "gus_card.c: Can't allocate DMA channel %d\n", hw_config->dma);
 	if (hw_config->dma2 != -1 && hw_config->dma2 != hw_config->dma)
@@ -73,11 +70,7 @@
 			  printk(KERN_ERR "GUS: Unsupported IRQ %d\n", irq);
 			  return 0;
 		  }
-	if (check_region(hw_config->io_base, 16))
-		printk(KERN_ERR "GUS: I/O range conflict (1)\n");
-	else if (check_region(hw_config->io_base + 0x100, 16))
-		printk(KERN_ERR "GUS: I/O range conflict (2)\n");
-	else if (gus_wave_detect(hw_config->io_base))
+	if (gus_wave_detect(hw_config->io_base))
 		return 1;
 
 #ifndef EXCLUDE_GUS_IODETECT
@@ -86,17 +79,14 @@
 	 * Look at the possible base addresses (0x2X0, X=1, 2, 3, 4, 5, 6)
 	 */
 
-	for (io_addr = 0x210; io_addr <= 0x260; io_addr += 0x10)
-		if (io_addr != hw_config->io_base)	/*
-							 * Already tested
-							 */
-			if (!check_region(io_addr, 16))
-				if (!check_region(io_addr + 0x100, 16))
-					if (gus_wave_detect(io_addr))
-					  {
-						  hw_config->io_base = io_addr;
-						  return 1;
-					  }
+	for (io_addr = 0x210; io_addr <= 0x260; io_addr += 0x10) {
+		if (io_addr == hw_config->io_base)	/* Already tested */
+			continue;
+		if (gus_wave_detect(io_addr)) {
+			hw_config->io_base = io_addr;
+			return 1;
+		}
+	}
 #endif
 
 	printk("NO GUS card found !\n");
diff -urN linux-2.6.8-rc2/sound/oss/gus_wave.c linux-2.6.8-rc3/sound/oss/gus_wave.c
--- linux-2.6.8-rc2/sound/oss/gus_wave.c	2004-06-15 22:20:27.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/gus_wave.c	2004-08-03 15:22:22.126588987 -0700
@@ -978,6 +978,13 @@
 	unsigned long   loc;
 	unsigned char   val;
 
+	if (!request_region(baseaddr, 16, "GUS"))
+		return 0;
+	if (!request_region(baseaddr + 0x100, 12, "GUS")) { /* 0x10c-> is MAX */
+		release_region(baseaddr, 16);
+		return 0;
+	}
+
 	gus_base = baseaddr;
 
 	gus_write8(0x4c, 0);	/* Reset GF1 */
@@ -1015,8 +1022,11 @@
 
 	/* See if there is first block there.... */
 	gus_poke(0L, 0xaa);
-	if (gus_peek(0L) != 0xaa)
-		return (0);
+	if (gus_peek(0L) != 0xaa) {
+		release_region(baseaddr + 0x100, 12);
+		release_region(baseaddr, 16);
+		return 0;
+	}
 
 	/* Now zero it out so that I can check for mirroring .. */
 	gus_poke(0L, 0x00);
diff -urN linux-2.6.8-rc2/sound/oss/i810_audio.c linux-2.6.8-rc3/sound/oss/i810_audio.c
--- linux-2.6.8-rc2/sound/oss/i810_audio.c	2004-06-15 22:19:44.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/i810_audio.c	2004-08-03 15:22:22.202592105 -0700
@@ -450,12 +450,38 @@
 /* extract register offset from codec struct */
 #define IO_REG_OFF(codec) (((struct i810_card *) codec->private_data)->ac97_id_map[codec->id])
 
-#define GET_CIV(port) MODULOP2(inb((port) + OFF_CIV), SG_LEN)
-#define GET_LVI(port) MODULOP2(inb((port) + OFF_LVI), SG_LEN)
+#define I810_IOREAD(size, type, card, off)				\
+({									\
+	type val;							\
+	if (card->use_mmio)						\
+		val=read##size(card->iobase_mmio+off);			\
+	else								\
+		val=in##size(card->iobase+off);				\
+	val;								\
+})
+
+#define I810_IOREADL(card, off)		I810_IOREAD(l, u32, card, off)
+#define I810_IOREADW(card, off)		I810_IOREAD(w, u16, card, off)
+#define I810_IOREADB(card, off)		I810_IOREAD(b, u8,  card, off)
+
+#define I810_IOWRITE(size, val, card, off)				\
+({									\
+	if (card->use_mmio)						\
+		write##size(val, card->iobase_mmio+off);		\
+	else								\
+		out##size(val, card->iobase+off);			\
+})
+
+#define I810_IOWRITEL(val, card, off)	I810_IOWRITE(l, val, card, off)
+#define I810_IOWRITEW(val, card, off)	I810_IOWRITE(w, val, card, off)
+#define I810_IOWRITEB(val, card, off)	I810_IOWRITE(b, val, card, off)
+
+#define GET_CIV(card, port) MODULOP2(I810_IOREADB((card), (port) + OFF_CIV), SG_LEN)
+#define GET_LVI(card, port) MODULOP2(I810_IOREADB((card), (port) + OFF_LVI), SG_LEN)
 
 /* set LVI from CIV */
-#define CIV_TO_LVI(port, off) \
-	outb(MODULOP2(GET_CIV((port)) + (off), SG_LEN), (port) + OFF_LVI)
+#define CIV_TO_LVI(card, port, off) \
+	I810_IOWRITEB(MODULOP2(GET_CIV((card), (port)) + (off), SG_LEN), (card), (port) + OFF_LVI)
 
 static struct i810_card *devs = NULL;
 
@@ -714,9 +740,9 @@
 		return 0;
 
 	if (rec)
-		port = state->card->iobase + dmabuf->read_channel->port;
+		port = dmabuf->read_channel->port;
 	else
-		port = state->card->iobase + dmabuf->write_channel->port;
+		port = dmabuf->write_channel->port;
 
 	if(state->card->pci_id == PCI_DEVICE_ID_SI_7012) {
 		port_picb = port + OFF_SR;
@@ -725,8 +751,8 @@
 		port_picb = port + OFF_PICB;
 
 	do {
-		civ = GET_CIV(port);
-		offset = inw(port_picb);
+		civ = GET_CIV(state->card, port);
+		offset = I810_IOREADW(state->card, port_picb);
 		/* Must have a delay here! */ 
 		if(offset == 0)
 			udelay(1);
@@ -745,7 +771,7 @@
 		 * that we won't have to worry about the chip still being
 		 * out of sync with reality ;-)
 		 */
-	} while (civ != GET_CIV(port) || offset != inw(port_picb));
+	} while (civ != GET_CIV(state->card, port) || offset != I810_IOREADW(state->card, port_picb));
 		 
 	return (((civ + 1) * dmabuf->fragsize - (bytes * offset))
 		% dmabuf->dmasize);
@@ -758,15 +784,15 @@
 	struct i810_card *card = state->card;
 
 	dmabuf->enable &= ~ADC_RUNNING;
-	outb(0, card->iobase + PI_CR);
+	I810_IOWRITEB(0, card, PI_CR);
 	// wait for the card to acknowledge shutdown
-	while( inb(card->iobase + PI_CR) != 0 ) ;
+	while( I810_IOREADB(card, PI_CR) != 0 ) ;
 	// now clear any latent interrupt bits (like the halt bit)
 	if(card->pci_id == PCI_DEVICE_ID_SI_7012)
-		outb( inb(card->iobase + PI_PICB), card->iobase + PI_PICB );
+		I810_IOWRITEB( I810_IOREADB(card, PI_PICB), card, PI_PICB );
 	else
-		outb( inb(card->iobase + PI_SR), card->iobase + PI_SR );
-	outl( inl(card->iobase + GLOB_STA) & INT_PI, card->iobase + GLOB_STA);
+		I810_IOWRITEB( I810_IOREADB(card, PI_SR), card, PI_SR );
+	I810_IOWRITEL( I810_IOREADL(card, GLOB_STA) & INT_PI, card, GLOB_STA);
 }
 
 static void stop_adc(struct i810_state *state)
@@ -787,7 +813,7 @@
 	    (dmabuf->trigger & PCM_ENABLE_INPUT)) {
 		dmabuf->enable |= ADC_RUNNING;
 		// Interrupt enable, LVI enable, DMA enable
-		outb(0x10 | 0x04 | 0x01, state->card->iobase + PI_CR);
+		I810_IOWRITEB(0x10 | 0x04 | 0x01, state->card, PI_CR);
 	}
 }
 
@@ -808,15 +834,15 @@
 	struct i810_card *card = state->card;
 
 	dmabuf->enable &= ~DAC_RUNNING;
-	outb(0, card->iobase + PO_CR);
+	I810_IOWRITEB(0, card, PO_CR);
 	// wait for the card to acknowledge shutdown
-	while( inb(card->iobase + PO_CR) != 0 ) ;
+	while( I810_IOREADB(card, PO_CR) != 0 ) ;
 	// now clear any latent interrupt bits (like the halt bit)
 	if(card->pci_id == PCI_DEVICE_ID_SI_7012)
-		outb( inb(card->iobase + PO_PICB), card->iobase + PO_PICB );
+		I810_IOWRITEB( I810_IOREADB(card, PO_PICB), card, PO_PICB );
 	else
-		outb( inb(card->iobase + PO_SR), card->iobase + PO_SR );
-	outl( inl(card->iobase + GLOB_STA) & INT_PO, card->iobase + GLOB_STA);
+		I810_IOWRITEB( I810_IOREADB(card, PO_SR), card, PO_SR );
+	I810_IOWRITEL( I810_IOREADL(card, GLOB_STA) & INT_PO, card, GLOB_STA);
 }
 
 static void stop_dac(struct i810_state *state)
@@ -837,7 +863,7 @@
 	    (dmabuf->trigger & PCM_ENABLE_OUTPUT)) {
 		dmabuf->enable |= DAC_RUNNING;
 		// Interrupt enable, LVI enable, DMA enable
-		outb(0x10 | 0x04 | 0x01, state->card->iobase + PO_CR);
+		I810_IOWRITEB(0x10 | 0x04 | 0x01, state->card, PO_CR);
 	}
 }
 static void start_dac(struct i810_state *state)
@@ -1000,12 +1026,12 @@
 			sg++;
 		}
 		spin_lock_irqsave(&state->card->lock, flags);
-		outb(2, state->card->iobase+c->port+OFF_CR);   /* reset DMA machine */
-		while( inb(state->card->iobase+c->port+OFF_CR) & 0x02 ) ;
-		outl((u32)state->card->chandma +
+		I810_IOWRITEB(2, state->card, c->port+OFF_CR);   /* reset DMA machine */
+		while( I810_IOREADB(state->card, c->port+OFF_CR) & 0x02 ) ;
+		I810_IOWRITEL((u32)state->card->chandma +
 		    c->num*sizeof(struct i810_channel),
-		    state->card->iobase+c->port+OFF_BDBAR);
-		CIV_TO_LVI(state->card->iobase+c->port, 0);
+		    state->card, c->port+OFF_BDBAR);
+		CIV_TO_LVI(state->card, c->port, 0);
 
 		spin_unlock_irqrestore(&state->card->lock, flags);
 
@@ -1037,14 +1063,13 @@
 	void (*start)(struct i810_state *);
 
 	count = dmabuf->count;
-	port = state->card->iobase;
 	if (rec) {
-		port += dmabuf->read_channel->port;
+		port = dmabuf->read_channel->port;
 		trigger = PCM_ENABLE_INPUT;
 		start = __start_adc;
 		count = dmabuf->dmasize - count;
 	} else {
-		port += dmabuf->write_channel->port;
+		port = dmabuf->write_channel->port;
 		trigger = PCM_ENABLE_OUTPUT;
 		start = __start_dac;
 	}
@@ -1059,14 +1084,14 @@
 			return;
 
 		start(state);
-		while (!(inb(port + OFF_CR) & ((1<<4) | (1<<2))))
+		while (!(I810_IOREADB(state->card, port + OFF_CR) & ((1<<4) | (1<<2))))
 			;
 	}
 
 	/* MASKP2(swptr, fragsize) - 1 is the tail of our transfer */
 	x = MODULOP2(MASKP2(dmabuf->swptr, fragsize) - 1, dmabuf->dmasize);
 	x >>= dmabuf->fragshift;
-	outb(x, port + OFF_LVI);
+	I810_IOWRITEB(x, state->card, port + OFF_LVI);
 }
 
 static void i810_update_lvi(struct i810_state *state, int rec)
@@ -1108,8 +1133,8 @@
 			/* this is normal for the end of a read */
 			/* only give an error if we went past the */
 			/* last valid sg entry */
-			if (GET_CIV(state->card->iobase + PI_BASE) !=
-			    GET_LVI(state->card->iobase + PI_BASE)) {
+			if (GET_CIV(state->card, PI_BASE) !=
+			    GET_LVI(state->card, PI_BASE)) {
 				printk(KERN_WARNING "i810_audio: DMA overrun on read\n");
 				dmabuf->error++;
 			}
@@ -1133,13 +1158,13 @@
 			/* this is normal for the end of a write */
 			/* only give an error if we went past the */
 			/* last valid sg entry */
-			if (GET_CIV(state->card->iobase + PO_BASE) !=
-			    GET_LVI(state->card->iobase + PO_BASE)) {
+			if (GET_CIV(state->card, PO_BASE) !=
+			    GET_LVI(state->card, PO_BASE)) {
 				printk(KERN_WARNING "i810_audio: DMA overrun on write\n");
 				printk("i810_audio: CIV %d, LVI %d, hwptr %x, "
 					"count %d\n",
-					GET_CIV(state->card->iobase + PO_BASE),
-					GET_LVI(state->card->iobase + PO_BASE),
+					GET_CIV(state->card, PO_BASE),
+					GET_LVI(state->card, PO_BASE),
 					dmabuf->hwptr, dmabuf->count);
 				dmabuf->error++;
 			}
@@ -1287,7 +1312,7 @@
 		struct i810_state *state = card->states[i];
 		struct i810_channel *c;
 		struct dmabuf *dmabuf;
-		unsigned long port = card->iobase;
+		unsigned long port;
 		u16 status;
 		
 		if(!state)
@@ -1302,12 +1327,12 @@
 		} else	/* This can occur going from R/W to close */
 			continue;
 		
-		port+=c->port;
+		port = c->port;
 
 		if(card->pci_id == PCI_DEVICE_ID_SI_7012)
-			status = inw(port + OFF_PICB);
+			status = I810_IOREADW(card, port + OFF_PICB);
 		else
-			status = inw(port + OFF_SR);
+			status = I810_IOREADW(card, port + OFF_SR);
 
 #ifdef DEBUG_INTERRUPTS
 		printk("NUM %d PORT %X IRQ ( ST%d ", c->num, c->port, status);
@@ -1340,7 +1365,7 @@
 			if(dmabuf->enable & ADC_RUNNING)
 				count = dmabuf->dmasize - count;
 			if (count >= (int)dmabuf->fragsize) {
-				outb(inb(port+OFF_CR) | 1, port+OFF_CR);
+				I810_IOWRITEB(I810_IOREADB(card, port+OFF_CR) | 1, card, port+OFF_CR);
 #ifdef DEBUG_INTERRUPTS
 				printk(" CONTINUE ");
 #endif
@@ -1356,9 +1381,9 @@
 			}
 		}
 		if(card->pci_id == PCI_DEVICE_ID_SI_7012)
-			outw(status & DMA_INT_MASK, port + OFF_PICB);
+			I810_IOWRITEW(status & DMA_INT_MASK, card, port + OFF_PICB);
 		else
-			outw(status & DMA_INT_MASK, port + OFF_SR);
+			I810_IOWRITEW(status & DMA_INT_MASK, card, port + OFF_SR);
 	}
 #ifdef DEBUG_INTERRUPTS
 	printk(")\n");
@@ -1372,7 +1397,7 @@
 
 	spin_lock(&card->lock);
 
-	status = inl(card->iobase + GLOB_STA);
+	status = I810_IOREADL(card, GLOB_STA);
 
 	if(!(status & INT_MASK)) 
 	{
@@ -1384,7 +1409,7 @@
 		i810_channel_interrupt(card);
 
  	/* clear 'em */
-	outl(status & INT_MASK, card->iobase + GLOB_STA);
+	I810_IOWRITEL(status & INT_MASK, card, GLOB_STA);
 	spin_unlock(&card->lock);
 	return IRQ_HANDLED;
 }
@@ -1396,7 +1421,7 @@
 static ssize_t i810_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos)
 {
 	struct i810_state *state = (struct i810_state *)file->private_data;
-	struct i810_card *card=state ? state->card : 0;
+	struct i810_card *card=state ? state->card : NULL;
 	struct dmabuf *dmabuf = &state->dmabuf;
 	ssize_t ret;
 	unsigned long flags;
@@ -1536,7 +1561,7 @@
 static ssize_t i810_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos)
 {
 	struct i810_state *state = (struct i810_state *)file->private_data;
-	struct i810_card *card=state ? state->card : 0;
+	struct i810_card *card=state ? state->card : NULL;
 	struct dmabuf *dmabuf = &state->dmabuf;
 	ssize_t ret;
 	unsigned long flags;
@@ -1784,13 +1809,13 @@
 			__stop_adc(state);
 		}
 		if (c != NULL) {
-			outb(2, state->card->iobase+c->port+OFF_CR);   /* reset DMA machine */
-			while ( inb(state->card->iobase+c->port+OFF_CR) & 2 )
+			I810_IOWRITEB(2, state->card, c->port+OFF_CR);   /* reset DMA machine */
+			while ( I810_IOREADB(state->card, c->port+OFF_CR) & 2 )
 				cpu_relax();
-			outl((u32)state->card->chandma +
+			I810_IOWRITEL((u32)state->card->chandma +
 			    c->num*sizeof(struct i810_channel),
-			    state->card->iobase+c->port+OFF_BDBAR);
-			CIV_TO_LVI(state->card->iobase+c->port, 0);
+			    state->card, c->port+OFF_BDBAR);
+			CIV_TO_LVI(state->card, c->port, 0);
 		}
 
 		spin_unlock_irqrestore(&state->card->lock, flags);
@@ -1920,7 +1945,7 @@
 		/* Global Status and Global Control register are now  */
 		/* used to indicate this.                             */
 
-                i_glob_cnt = inl(state->card->iobase + GLOB_CNT);
+                i_glob_cnt = I810_IOREADL(state->card, GLOB_CNT);
 
 		/* Current # of channels enabled */
 		if ( i_glob_cnt & 0x0100000 )
@@ -1932,14 +1957,14 @@
 
 		switch ( val ) {
 			case 2: /* 2 channels is always supported */
-				outl(i_glob_cnt & 0xffcfffff,
-				     state->card->iobase + GLOB_CNT);
+				I810_IOWRITEL(i_glob_cnt & 0xffcfffff,
+				     state->card, GLOB_CNT);
 				/* Do we need to change mixer settings????  */
 				break;
 			case 4: /* Supported on some chipsets, better check first */
 				if ( state->card->channels >= 4 ) {
-					outl((i_glob_cnt & 0xffcfffff) | 0x100000,
-					      state->card->iobase + GLOB_CNT);
+					I810_IOWRITEL((i_glob_cnt & 0xffcfffff) | 0x100000,
+					      state->card, GLOB_CNT);
 					/* Do we need to change mixer settings??? */
 				} else {
 					val = ret;
@@ -1947,8 +1972,8 @@
 				break;
 			case 6: /* Supported on some chipsets, better check first */
 				if ( state->card->channels >= 6 ) {
-					outl((i_glob_cnt & 0xffcfffff) | 0x200000,
-					      state->card->iobase + GLOB_CNT);
+					I810_IOWRITEL((i_glob_cnt & 0xffcfffff) | 0x200000,
+					      state->card, GLOB_CNT);
 					/* Do we need to change mixer settings??? */
 				} else {
 					val = ret;
@@ -2477,8 +2502,8 @@
 		} else {
 			i810_set_dac_rate(state, 8000);
 			/* Put the ACLink in 2 channel mode by default */
-			i = inl(card->iobase + GLOB_CNT);
-			outl(i & 0xffcfffff, card->iobase + GLOB_CNT);
+			i = I810_IOREADL(card, GLOB_CNT);
+			I810_IOWRITEL(i & 0xffcfffff, card, GLOB_CNT);
 		}
 	}
 		
@@ -2569,7 +2594,7 @@
 	int count = 100;
 	u16 reg_set = IO_REG_OFF(dev) | (reg&0x7f);
 	
-	while(count-- && (inb(card->iobase + CAS) & 1)) 
+	while(count-- && (I810_IOREADB(card, CAS) & 1)) 
 		udelay(1);
 	
 	return inw(card->ac97base + reg_set);
@@ -2597,7 +2622,7 @@
 	int count = 100;
 	u16 reg_set = IO_REG_OFF(dev) | (reg&0x7f);
 	
-	while(count-- && (inb(card->iobase + CAS) & 1)) 
+	while(count-- && (I810_IOREADB(card, CAS) & 1)) 
 		udelay(1);
 	
         outw(data, card->ac97base + reg_set);
@@ -2686,7 +2711,7 @@
 
 static inline int i810_ac97_exists(struct i810_card *card, int ac97_number)
 {
-	u32 reg = inl(card->iobase + GLOB_STA);
+	u32 reg = I810_IOREADL(card, GLOB_STA);
 	switch (ac97_number) {
 	case 0:
 		return reg & (1<<8);
@@ -2757,7 +2782,7 @@
  
 static int i810_ac97_power_up_bus(struct i810_card *card)
 {	
-	u32 reg = inl(card->iobase + GLOB_CNT);
+	u32 reg = I810_IOREADL(card, GLOB_CNT);
 	int i;
 	int primary_codec_id = 0;
 
@@ -2769,14 +2794,14 @@
 	reg&=~8;	/* ACLink on */
 	
 	/* At this point we deassert AC_RESET # */
-	outl(reg , card->iobase + GLOB_CNT);
+	I810_IOWRITEL(reg , card, GLOB_CNT);
 
 	/* We must now allow time for the Codec initialisation.
 	   600mS is the specified time */
 	   	
 	for(i=0;i<10;i++)
 	{
-		if((inl(card->iobase+GLOB_CNT)&4)==0)
+		if((I810_IOREADL(card, GLOB_CNT)&4)==0)
 			break;
 
 		set_current_state(TASK_UNINTERRUPTIBLE);
@@ -2795,8 +2820,11 @@
 	 *	See if the primary codec comes ready. This must happen
 	 *	before we start doing DMA stuff
 	 */	
-	/* see i810_ac97_init for the next 7 lines (jsaw) */
-	inw(card->ac97base);
+	/* see i810_ac97_init for the next 10 lines (jsaw) */
+	if (card->use_mmio)
+		readw(card->ac97base_mmio);
+	else
+		inw(card->ac97base);
 	if (ich_use_mmio(card)) {
 		primary_codec_id = (int) readl(card->iobase_mmio + SDM) & 0x3;
 		printk(KERN_INFO "i810_audio: Primary codec has ID %d\n",
@@ -2814,7 +2842,10 @@
 		else 
 			printk("no response.\n");
 	}
-	inw(card->ac97base);
+	if (card->use_mmio)
+		readw(card->ac97base_mmio);
+	else
+		inw(card->ac97base);
 	return 1;
 }
 
@@ -2839,15 +2870,15 @@
 	/* to check....                                         */
 
 	card->channels = 2;
-	reg = inl(card->iobase + GLOB_STA);
+	reg = I810_IOREADL(card, GLOB_STA);
 	if ( reg & 0x0200000 )
 		card->channels = 6;
 	else if ( reg & 0x0100000 )
 		card->channels = 4;
 	printk(KERN_INFO "i810_audio: Audio Controller supports %d channels.\n", card->channels);
 	printk(KERN_INFO "i810_audio: Defaulting to base 2 channel mode.\n");
-	reg = inl(card->iobase + GLOB_CNT);
-	outl(reg & 0xffcfffff, card->iobase + GLOB_CNT);
+	reg = I810_IOREADL(card, GLOB_CNT);
+	I810_IOWRITEL(reg & 0xffcfffff, card, GLOB_CNT);
 		
 	for (num_ac97 = 0; num_ac97 < NR_AC97; num_ac97++) 
 		card->ac97_codec[num_ac97] = NULL;
@@ -2858,8 +2889,10 @@
 	for (num_ac97 = 0; num_ac97 < nr_ac97_max; num_ac97++) {
 		/* codec reset */
 		printk(KERN_INFO "i810_audio: Resetting connection %d\n", num_ac97);
-		if (card->use_mmio) readw(card->ac97base_mmio + 0x80*num_ac97);
-		else inw(card->ac97base + 0x80*num_ac97);
+		if (card->use_mmio)
+			readw(card->ac97base_mmio + 0x80*num_ac97);
+		else
+			inw(card->ac97base + 0x80*num_ac97);
 
 		/* If we have the SDATA_IN Map Register, as on ICH4, we
 		   do not loop thru all possible codec IDs but thru all 
@@ -3062,7 +3095,7 @@
 			goto config_out;
 		}
 		dmabuf->count = dmabuf->dmasize;
-		CIV_TO_LVI(card->iobase+dmabuf->write_channel->port, -1);
+		CIV_TO_LVI(card, dmabuf->write_channel->port, -1);
 		local_irq_save(flags);
 		start_dac(state);
 		offset = i810_get_dma_addr(state, 0);
@@ -3106,13 +3139,6 @@
 		return -ENODEV;
 	}
 	
-	if( pci_resource_start(pci_dev, 1) == 0)
-	{
-		/* MMIO only ICH5 .. here be dragons .. */
-		printk(KERN_ERR "i810_audio: Pure MMIO interfaces not yet supported.\n");
-		return -ENODEV;
-	}
-
 	if ((card = kmalloc(sizeof(struct i810_card), GFP_KERNEL)) == NULL) {
 		printk(KERN_ERR "i810_audio: out of memory\n");
 		return -ENOMEM;
@@ -3125,6 +3151,11 @@
 	card->ac97base = pci_resource_start (pci_dev, 0);
 	card->iobase = pci_resource_start (pci_dev, 1);
 
+	if (!(card->ac97base) || !(card->iobase)) {
+		card->ac97base = 0;
+		card->iobase = 0;
+	}
+
 	/* if chipset could have mmio capability, check it */ 
 	if (card_cap[pci_id->driver_data].flags & CAP_MMIO) {
 		card->ac97base_mmio_phys = pci_resource_start (pci_dev, 2);
@@ -3139,6 +3170,11 @@
 		}
 	}
 
+	if (!(card->use_mmio) && (!(card->iobase) || !(card->ac97base))) {
+		printk(KERN_ERR "i810_audio: No I/O resources available.\n");
+		goto out_mem;
+	}
+
 	card->irq = pci_dev->irq;
 	card->next = devs;
 	card->magic = I810_CARD_MAGIC;
diff -urN linux-2.6.8-rc2/sound/oss/msnd_pinnacle.c linux-2.6.8-rc3/sound/oss/msnd_pinnacle.c
--- linux-2.6.8-rc2/sound/oss/msnd_pinnacle.c	2004-06-15 22:19:37.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/msnd_pinnacle.c	2004-08-03 15:22:22.204592187 -0700
@@ -1145,11 +1145,10 @@
 	char *pinfiji = "Pinnacle/Fiji";
 #endif
 
-	if (check_region(dev.io, dev.numio)) {
+	if (!request_region(dev.io, dev.numio, "probing")) {
 		printk(KERN_ERR LOGNAME ": I/O port conflict\n");
 		return -ENODEV;
 	}
-	request_region(dev.io, dev.numio, "probing");
 
 	if (reset_dsp() < 0) {
 		release_region(dev.io, dev.numio);
@@ -1833,12 +1832,11 @@
 		/* Joystick */
 		pinnacle_devs[3].io0 = joystick_io;
 
-		if (check_region(cfg, 2)) {
+		if (!request_region(cfg, 2, "Pinnacle/Fiji Config")) {
 			printk(KERN_ERR LOGNAME ": Config port 0x%x conflict\n", cfg);
 			return -EIO;
 		}
 
-		request_region(cfg, 2, "Pinnacle/Fiji Config");
 		if (msnd_pinnacle_cfg_devices(cfg, reset, pinnacle_devs)) {
 			printk(KERN_ERR LOGNAME ": Device configuration error\n");
 			release_region(cfg, 2);
diff -urN linux-2.6.8-rc2/sound/oss/sb_common.c linux-2.6.8-rc3/sound/oss/sb_common.c
--- linux-2.6.8-rc2/sound/oss/sb_common.c	2004-06-15 22:18:56.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/sb_common.c	2004-08-03 15:22:22.208592351 -0700
@@ -1206,7 +1206,7 @@
 	if (last_devc == NULL)
 		return 0;
 
-	last_devc = 0;
+	last_devc = NULL;
 
 	if (hw_config->io_base <= 0)
 	{
diff -urN linux-2.6.8-rc2/sound/oss/via82cxxx_audio.c linux-2.6.8-rc3/sound/oss/via82cxxx_audio.c
--- linux-2.6.8-rc2/sound/oss/via82cxxx_audio.c	2004-06-15 22:19:03.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/via82cxxx_audio.c	2004-08-03 15:22:22.235593458 -0700
@@ -10,7 +10,7 @@
  * NO WARRANTY
  *
  * For a list of known bugs (errata) and documentation,
- * see via-audio.pdf in linux/Documentation/DocBook.
+ * see via-audio.pdf in Documentation/DocBook.
  * If this documentation does not exist, run "make pdfdocs".
  */
 
diff -urN linux-2.6.8-rc2/sound/oss/vwsnd.c linux-2.6.8-rc3/sound/oss/vwsnd.c
--- linux-2.6.8-rc2/sound/oss/vwsnd.c	2004-06-15 22:19:36.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/vwsnd.c	2004-08-03 15:22:22.289595674 -0700
@@ -1,6 +1,6 @@
 /*
  * Sound driver for Silicon Graphics 320 and 540 Visual Workstations'
- * onboard audio.  See notes in ../../Documentation/sound/oss/vwsnd .
+ * onboard audio.  See notes in Documentation/sound/oss/vwsnd .
  *
  * Copyright 1999 Silicon Graphics, Inc.  All rights reserved.
  *
diff -urN linux-2.6.8-rc2/sound/oss/wavfront.c linux-2.6.8-rc3/sound/oss/wavfront.c
--- linux-2.6.8-rc2/sound/oss/wavfront.c	2004-06-15 22:19:36.000000000 -0700
+++ linux-2.6.8-rc3/sound/oss/wavfront.c	2004-08-03 15:22:22.331597397 -0700
@@ -312,7 +312,7 @@
 	{ 0x0E, "Bad MIDI channel number" },
 	{ 0x10, "Download Record Error" },
 	{ 0x80, "Success" },
-	{ 0x0, 0x0 }
+	{ 0 }
 };
 
 #define NEEDS_ACK 1
@@ -493,7 +493,7 @@
 
 	if (cmd == WFC_DOWNLOAD_MULTISAMPLE) {
 		wfcmd->write_cnt = (unsigned int) rbuf;
-		rbuf = 0;
+		rbuf = NULL;
 	}
 
 	DPRINT (WF_DEBUG_CMD, "0x%x [%s] (%d,%d,%d)\n",
@@ -745,7 +745,7 @@
 	wbuf[0] = sample_num & 0x7f;
 	wbuf[1] = sample_num >> 7;
 
-	if ((x = wavefront_cmd (WFC_DELETE_SAMPLE, 0, wbuf)) == 0) {
+	if ((x = wavefront_cmd (WFC_DELETE_SAMPLE, NULL, wbuf)) == 0) {
 		dev.sample_status[sample_num] = WF_ST_EMPTY;
 	}
 
@@ -934,7 +934,7 @@
 	bptr = munge_int32 (header->number, buf, 2);
 	munge_buf ((unsigned char *)&header->hdr.p, bptr, WF_PATCH_BYTES);
     
-	if (wavefront_cmd (WFC_DOWNLOAD_PATCH, 0, buf)) {
+	if (wavefront_cmd (WFC_DOWNLOAD_PATCH, NULL, buf)) {
 		printk (KERN_ERR LOGNAME "download patch failed\n");
 		return -(EIO);
 	}
@@ -972,7 +972,7 @@
 	buf[0] = header->number;
 	munge_buf ((unsigned char *)&header->hdr.pr, &buf[1], WF_PROGRAM_BYTES);
     
-	if (wavefront_cmd (WFC_DOWNLOAD_PROGRAM, 0, buf)) {
+	if (wavefront_cmd (WFC_DOWNLOAD_PROGRAM, NULL, buf)) {
 		printk (KERN_WARNING LOGNAME "download patch failed\n");	
 		return -(EIO);
 	}
@@ -986,7 +986,7 @@
 {
 	char rbuf[8];
 
-	if (wavefront_cmd (WFC_REPORT_FREE_MEMORY, rbuf, 0)) {
+	if (wavefront_cmd (WFC_REPORT_FREE_MEMORY, rbuf, NULL)) {
 		printk (KERN_WARNING LOGNAME "can't get memory stats.\n");
 		return -1;
 	} else {
@@ -1011,7 +1011,7 @@
 
 	UINT16 sample_short;
 	UINT32 length;
-	UINT16 __user *data_end = 0;
+	UINT16 __user *data_end = NULL;
 	unsigned int i;
 	const int max_blksize = 4096/2;
 	unsigned int written;
@@ -1188,7 +1188,7 @@
 
 	if (wavefront_cmd (header->size ?
 			   WFC_DOWNLOAD_SAMPLE : WFC_DOWNLOAD_SAMPLE_HEADER,
-			   0, sample_hdr)) {
+			   NULL, sample_hdr)) {
 		printk (KERN_WARNING LOGNAME "sample %sdownload refused.\n",
 			header->size ? "" : "header ");
 		return -(EIO);
@@ -1214,7 +1214,7 @@
 			blocksize = ((length-written+7)&~0x7);
 		}
 
-		if (wavefront_cmd (WFC_DOWNLOAD_BLOCK, 0, 0)) {
+		if (wavefront_cmd (WFC_DOWNLOAD_BLOCK, NULL, NULL)) {
 			printk (KERN_WARNING LOGNAME "download block "
 				"request refused.\n");
 			return -(EIO);
@@ -1321,7 +1321,7 @@
 	munge_int32 (header->hdr.a.FrequencyBias, &alias_hdr[20], 3);
 	munge_int32 (*(&header->hdr.a.FrequencyBias+1), &alias_hdr[23], 2);
 
-	if (wavefront_cmd (WFC_DOWNLOAD_SAMPLE_ALIAS, 0, alias_hdr)) {
+	if (wavefront_cmd (WFC_DOWNLOAD_SAMPLE_ALIAS, NULL, alias_hdr)) {
 		printk (KERN_ERR LOGNAME "download alias failed.\n");
 		return -(EIO);
 	}
@@ -1445,7 +1445,7 @@
 		munge_int32 (((unsigned char *)drum)[i], &drumbuf[1+(i*2)], 2);
 	}
 
-	if (wavefront_cmd (WFC_DOWNLOAD_EDRUM_PROGRAM, 0, drumbuf)) {
+	if (wavefront_cmd (WFC_DOWNLOAD_EDRUM_PROGRAM, NULL, drumbuf)) {
 		printk (KERN_ERR LOGNAME "download drum failed.\n");
 		return -(EIO);
 	}
@@ -2738,7 +2738,7 @@
 
 	voices[0] = 32;
 
-	if (wavefront_cmd (WFC_SET_NVOICES, 0, voices)) {
+	if (wavefront_cmd (WFC_SET_NVOICES, NULL, voices)) {
 		printk (KERN_WARNING LOGNAME
 			"cannot set number of voices to 32.\n");
 		goto gone_bad;
diff -urN linux-2.6.8-rc2/sound/pci/au88x0/au88x0.h linux-2.6.8-rc3/sound/pci/au88x0/au88x0.h
--- linux-2.6.8-rc2/sound/pci/au88x0/au88x0.h	2004-06-15 22:19:36.000000000 -0700
+++ linux-2.6.8-rc3/sound/pci/au88x0/au88x0.h	2004-08-03 15:22:22.345597971 -0700
@@ -146,12 +146,12 @@
 #endif
 
 	/* Global resources */
-	char mixcapt[2];
-	char mixplayb[4];
+	s8 mixcapt[2];
+	s8 mixplayb[4];
 #ifndef CHIP_AU8820
-	char mixspdif[2];
-	char mixa3d[2];		/* mixers which collect all a3d streams. */
-	char mixxtlk[2];	/* crosstalk canceler mixer inputs. */
+	s8 mixspdif[2];
+	s8 mixa3d[2];	/* mixers which collect all a3d streams. */
+	s8 mixxtlk[2];	/* crosstalk canceler mixer inputs. */
 #endif
 	u32 fixed_res[5];
 
diff -urN linux-2.6.8-rc2/sound/pci/azt3328.c linux-2.6.8-rc3/sound/pci/azt3328.c
--- linux-2.6.8-rc2/sound/pci/azt3328.c	2004-06-15 22:19:36.000000000 -0700
+++ linux-2.6.8-rc3/sound/pci/azt3328.c	2004-08-03 15:22:22.433601581 -0700
@@ -843,7 +843,7 @@
 		snd_azf3328_setdmaa(chip, runtime->dma_addr, snd_pcm_lib_period_bytes(substream), snd_pcm_lib_buffer_bytes(substream), 0);
 
 		spin_lock_irqsave(&chip->reg_lock, flags);
-#if WIN9X
+#ifdef WIN9X
 		/* FIXME: enable playback/recording??? */
 		status1 |= DMA_PLAY_SOMETHING1 | DMA_PLAY_SOMETHING2;
 		outw(status1, chip->codec_port+IDX_IO_PLAY_FLAGS);
@@ -933,7 +933,7 @@
 		snd_azf3328_setdmaa(chip, runtime->dma_addr, snd_pcm_lib_period_bytes(substream), snd_pcm_lib_buffer_bytes(substream), 1);
 
 		spin_lock_irqsave(&chip->reg_lock, flags);
-#if WIN9X
+#ifdef WIN9X
 		/* FIXME: enable playback/recording??? */
 		status1 |= DMA_PLAY_SOMETHING1 | DMA_PLAY_SOMETHING2;
 		outw(status1, chip->codec_port+IDX_IO_REC_FLAGS);
@@ -993,7 +993,7 @@
 	unsigned long flags;
 
 	spin_lock_irqsave(&chip->reg_lock, flags);
-#if QUERY_HARDWARE
+#ifdef QUERY_HARDWARE
 	bufptr = inl(chip->codec_port+IDX_IO_PLAY_DMA_START_1);
 #else
 	bufptr = substream->runtime->dma_addr;
@@ -1016,7 +1016,7 @@
 	unsigned long flags;
 
 	spin_lock_irqsave(&chip->reg_lock, flags);
-#if QUERY_HARDWARE
+#ifdef QUERY_HARDWARE
 	bufptr = inl(chip->codec_port+IDX_IO_REC_DMA_START_1);
 #else
 	bufptr = substream->runtime->dma_addr;
diff -urN linux-2.6.8-rc2/sound/pci/es1968.c linux-2.6.8-rc3/sound/pci/es1968.c
--- linux-2.6.8-rc2/sound/pci/es1968.c	2004-06-15 22:19:43.000000000 -0700
+++ linux-2.6.8-rc3/sound/pci/es1968.c	2004-08-03 15:22:22.493604042 -0700
@@ -1990,6 +1990,8 @@
 			if ((val & 0xff00) < 0x1f00)
 				val += 0x0100;
 		}
+		if (val == 0x1f1f)
+			val |= 0x8000;
 		snd_ac97_write_cache(chip->ac97, AC97_MASTER, val);
 		snd_ctl_notify(chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
 			       &chip->master_volume->id);
diff -urN linux-2.6.8-rc2/sound/pci/ice1712/ice1712.c linux-2.6.8-rc3/sound/pci/ice1712/ice1712.c
--- linux-2.6.8-rc2/sound/pci/ice1712/ice1712.c	2004-06-15 22:19:11.000000000 -0700
+++ linux-2.6.8-rc3/sound/pci/ice1712/ice1712.c	2004-08-03 15:22:22.548606299 -0700
@@ -2295,7 +2295,7 @@
 	snd_ice1712_hoontech_cards,
 	snd_ice1712_delta_cards,
 	snd_ice1712_ews_cards,
-	0,
+	NULL,
 };
 
 static unsigned char __devinit snd_ice1712_read_i2c(ice1712_t *ice,
diff -urN linux-2.6.8-rc2/sound/pci/ice1712/ice1724.c linux-2.6.8-rc3/sound/pci/ice1712/ice1724.c
--- linux-2.6.8-rc2/sound/pci/ice1712/ice1724.c	2004-08-03 15:21:19.631025265 -0700
+++ linux-2.6.8-rc3/sound/pci/ice1712/ice1724.c	2004-08-03 15:22:22.551606422 -0700
@@ -1815,7 +1815,7 @@
 	snd_vt1724_revo_cards,
 	snd_vt1724_amp_cards, 
 	snd_vt1724_aureon_cards,
-	0,
+	NULL,
 };
 
 
diff -urN linux-2.6.8-rc2/sound/pci/intel8x0m.c linux-2.6.8-rc3/sound/pci/intel8x0m.c
--- linux-2.6.8-rc2/sound/pci/intel8x0m.c	2004-06-15 22:19:31.000000000 -0700
+++ linux-2.6.8-rc3/sound/pci/intel8x0m.c	2004-08-03 15:22:22.765615201 -0700
@@ -1328,7 +1328,7 @@
 	{ 0x5455, "ALi M5455" },
 	{ 0x746d, "AMD AMD8111" },
 #endif
-	{ 0, 0 },
+	{ 0 },
 };
 
 static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
diff -urN linux-2.6.8-rc2/sound/pci/maestro3.c linux-2.6.8-rc3/sound/pci/maestro3.c
--- linux-2.6.8-rc2/sound/pci/maestro3.c	2004-06-15 22:19:36.000000000 -0700
+++ linux-2.6.8-rc3/sound/pci/maestro3.c	2004-08-03 15:22:22.803616760 -0700
@@ -968,7 +968,7 @@
 		.amp_gpio = 0x03,
 	},
 	/* END */
-	{ 0 }
+	{ NULL }
 };
 
 
diff -urN linux-2.6.8-rc2/sound/pci/rme9652/hdsp.c linux-2.6.8-rc3/sound/pci/rme9652/hdsp.c
--- linux-2.6.8-rc2/sound/pci/rme9652/hdsp.c	2004-06-15 22:19:11.000000000 -0700
+++ linux-2.6.8-rc3/sound/pci/rme9652/hdsp.c	2004-08-03 15:22:22.870619508 -0700
@@ -4971,16 +4971,16 @@
 
 	hdsp->irq = -1;
 	hdsp->state = 0;
-	hdsp->midi[0].rmidi = 0;
-	hdsp->midi[1].rmidi = 0;
-	hdsp->midi[0].input = 0;
-	hdsp->midi[1].input = 0;
-	hdsp->midi[0].output = 0;
-	hdsp->midi[1].output = 0;
+	hdsp->midi[0].rmidi = NULL;
+	hdsp->midi[1].rmidi = NULL;
+	hdsp->midi[0].input = NULL;
+	hdsp->midi[1].input = NULL;
+	hdsp->midi[0].output = NULL;
+	hdsp->midi[1].output = NULL;
 	spin_lock_init(&hdsp->midi[0].lock);
 	spin_lock_init(&hdsp->midi[1].lock);
 	hdsp->iobase = 0;
-	hdsp->res_port = 0;
+	hdsp->res_port = NULL;
 	hdsp->control_register = 0;
 	hdsp->control2_register = 0;
 	hdsp->io_type = Undefined;
diff -urN linux-2.6.8-rc2/sound/pci/sonicvibes.c linux-2.6.8-rc3/sound/pci/sonicvibes.c
--- linux-2.6.8-rc2/sound/pci/sonicvibes.c	2004-06-15 22:19:43.000000000 -0700
+++ linux-2.6.8-rc3/sound/pci/sonicvibes.c	2004-08-03 15:22:22.872619590 -0700
@@ -805,7 +805,7 @@
 	sonic->mode |= SV_MODE_PLAY;
 	sonic->playback_substream = substream;
 	runtime->hw = snd_sonicvibes_playback;
-	snd_pcm_hw_rule_add(runtime, 0, SNDRV_PCM_HW_PARAM_RATE, snd_sonicvibes_hw_constraint_dac_rate, 0, SNDRV_PCM_HW_PARAM_RATE, -1);
+	snd_pcm_hw_rule_add(runtime, 0, SNDRV_PCM_HW_PARAM_RATE, snd_sonicvibes_hw_constraint_dac_rate, NULL, SNDRV_PCM_HW_PARAM_RATE, -1);
 	return 0;
 }
 
diff -urN linux-2.6.8-rc2/sound/ppc/Kconfig linux-2.6.8-rc3/sound/ppc/Kconfig
--- linux-2.6.8-rc2/sound/ppc/Kconfig	2004-06-15 22:19:22.000000000 -0700
+++ linux-2.6.8-rc3/sound/ppc/Kconfig	2004-08-03 15:22:22.880619918 -0700
@@ -3,9 +3,12 @@
 menu "ALSA PowerMac devices"
 	depends on SND!=n && PPC
 
+comment "ALSA PowerMac requires I2C"
+	depends on SND && I2C=n
+
 config SND_POWERMAC
 	tristate "PowerMac (AWACS, DACA, Burgundy, Tumbler, Keywest)"
-	depends on SND
+	depends on SND && I2C
 	select SND_PCM
 
 endmenu
diff -urN linux-2.6.8-rc2/sound/ppc/pmac.c linux-2.6.8-rc3/sound/ppc/pmac.c
--- linux-2.6.8-rc2/sound/ppc/pmac.c	2004-08-03 15:21:19.730029327 -0700
+++ linux-2.6.8-rc3/sound/ppc/pmac.c	2004-08-03 15:22:22.917621436 -0700
@@ -896,7 +896,7 @@
 		sound = sound->next;
 	if (! sound)
 		return -ENODEV;
-	prop = (unsigned int *) get_property(sound, "sub-frame", 0);
+	prop = (unsigned int *) get_property(sound, "sub-frame", NULL);
 	if (prop && *prop < 16)
 		chip->subframe = *prop;
 	/* This should be verified on older screamers */
@@ -938,7 +938,7 @@
 		// chip->can_byte_swap = 0; /* FIXME: check this */
 		chip->control_mask = MASK_IEPC | 0x11; /* disable IEE */
 	}
-	prop = (unsigned int *)get_property(sound, "device-id", 0);
+	prop = (unsigned int *)get_property(sound, "device-id", NULL);
 	if (prop)
 		chip->device_id = *prop;
 	chip->has_iic = (find_devices("perch") != NULL);