16 files changed, 206 insertions, 154 deletions

diff --git a/arch/um/drivers/chan_user.c b/arch/um/drivers/chan_user.c
index 2f880cb167a..0cad3546cb8 100644
--- a/arch/um/drivers/chan_user.c
+++ b/arch/um/drivers/chan_user.c
@@ -120,7 +120,7 @@ static int winch_thread(void *arg)
         /* These are synchronization calls between various UML threads on the
          * host - since they are not different kernel threads, we cannot use
          * kernel semaphores. We don't use SysV semaphores because they are
-         * persistant. */
+         * persistent. */
         count = os_read_file(pipe_fd, &c, sizeof(c));
         if(count != sizeof(c))
                 printk("winch_thread : failed to read synchronization byte, "
diff --git a/arch/um/drivers/cow_sys.h b/arch/um/drivers/cow_sys.h
index 7a5b4afde69..c6a308464ac 100644
--- a/arch/um/drivers/cow_sys.h
+++ b/arch/um/drivers/cow_sys.h
@@ -5,6 +5,7 @@
 #include "user_util.h"
 #include "os.h"
 #include "user.h"
+#include "um_malloc.h"
 
 static inline void *cow_malloc(int size)
 {
diff --git a/arch/um/drivers/daemon_user.c b/arch/um/drivers/daemon_user.c
index 77954ea7704..310af0f1e49 100644
--- a/arch/um/drivers/daemon_user.c
+++ b/arch/um/drivers/daemon_user.c
@@ -17,6 +17,7 @@
 #include "user_util.h"
 #include "user.h"
 #include "os.h"
+#include "um_malloc.h"
 
 #define MAX_PACKET (ETH_MAX_PACKET + ETH_HEADER_OTHER)
 
diff --git a/arch/um/drivers/fd.c b/arch/um/drivers/fd.c
index 108b7dafbd0..218aa0e9b79 100644
--- a/arch/um/drivers/fd.c
+++ b/arch/um/drivers/fd.c
@@ -12,6 +12,7 @@
 #include "user_util.h"
 #include "chan_user.h"
 #include "os.h"
+#include "um_malloc.h"
 
 struct fd_chan {
         int fd;
diff --git a/arch/um/drivers/mcast_user.c b/arch/um/drivers/mcast_user.c
index 4d2bd39a85b..8138f5ea1bf 100644
--- a/arch/um/drivers/mcast_user.c
+++ b/arch/um/drivers/mcast_user.c
@@ -23,6 +23,7 @@
 #include "user_util.h"
 #include "user.h"
 #include "os.h"
+#include "um_malloc.h"
 
 #define MAX_PACKET (ETH_MAX_PACKET + ETH_HEADER_OTHER)
 
diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
index d08bd036ccb..7b172160fe0 100644
--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -79,7 +79,7 @@ static irqreturn_t mconsole_interrupt(int irq, void *dev_id)
         /* long to avoid size mismatch warnings from gcc */
         long fd;
         struct mconsole_entry *new;
-        struct mc_request req;
+        static struct mc_request req;   /* that's OK */
 
         fd = (long) dev_id;
         while (mconsole_get_request(fd, &req)){
@@ -91,6 +91,7 @@ static irqreturn_t mconsole_interrupt(int irq, void *dev_id)
                                 mconsole_reply(&req, "Out of memory", 1, 0);
                         else {
                                 new->request = req;
+                                new->request.regs = get_irq_regs()->regs;
                                 list_add(&new->list, &mc_requests);
                         }
                 }
@@ -314,9 +315,21 @@ void mconsole_stop(struct mc_request *req)
 {
         deactivate_fd(req->originating_fd, MCONSOLE_IRQ);
         os_set_fd_block(req->originating_fd, 1);
-        mconsole_reply(req, "", 0, 0);
-        while(mconsole_get_request(req->originating_fd, req)){
-                if(req->cmd->handler == mconsole_go) break;
+        mconsole_reply(req, "stopped", 0, 0);
+        while (mconsole_get_request(req->originating_fd, req)) {
+                if (req->cmd->handler == mconsole_go)
+                        break;
+                if (req->cmd->handler == mconsole_stop) {
+                        mconsole_reply(req, "Already stopped", 1, 0);
+                        continue;
+                }
+                if (req->cmd->handler == mconsole_sysrq) {
+                        struct pt_regs *old_regs;
+                        old_regs = set_irq_regs((struct pt_regs *)&req->regs);
+                        mconsole_sysrq(req);
+                        set_irq_regs(old_regs);
+                        continue;
+                }
                 (*req->cmd->handler)(req);
         }
         os_set_fd_block(req->originating_fd, 0);
@@ -673,9 +686,7 @@ static void with_console(struct mc_request *req, void (*proc)(void *),
 static void sysrq_proc(void *arg)
 {
         char *op = arg;
-        struct pt_regs *old_regs = set_irq_regs(&current->thread.regs);
         handle_sysrq(*op, NULL);
-        set_irq_regs(old_regs);
 }
 
 void mconsole_sysrq(struct mc_request *req)
diff --git a/arch/um/drivers/mconsole_user.c b/arch/um/drivers/mconsole_user.c
index 17068eb746c..75aef6f7ef6 100644
--- a/arch/um/drivers/mconsole_user.c
+++ b/arch/um/drivers/mconsole_user.c
@@ -14,6 +14,7 @@
 #include <sys/un.h>
 #include <unistd.h>
 #include "user.h"
+#include "sysdep/ptrace.h"
 #include "mconsole.h"
 #include "umid.h"
 #include "user_util.h"
diff --git a/arch/um/drivers/mmapper_kern.c b/arch/um/drivers/mmapper_kern.c
index 9a3b5daf625..df3516e47d4 100644
--- a/arch/um/drivers/mmapper_kern.c
+++ b/arch/um/drivers/mmapper_kern.c
@@ -95,7 +95,8 @@ static const struct file_operations mmapper_fops = {
         .release        = mmapper_release,
 };
 
-static const struct miscdevice mmapper_dev = {
+/* No locking needed - only used (and modified) by below initcall and exitcall. */
+static struct miscdevice mmapper_dev = {
         .minor          = MISC_DYNAMIC_MINOR,
         .name           = "mmapper",
         .fops           = &mmapper_fops
diff --git a/arch/um/drivers/net_user.c b/arch/um/drivers/net_user.c
index f3a3f8a29c7..0ffd7ac295d 100644
--- a/arch/um/drivers/net_user.c
+++ b/arch/um/drivers/net_user.c
@@ -18,6 +18,7 @@
 #include "kern_util.h"
 #include "net_user.h"
 #include "os.h"
+#include "um_malloc.h"
 
 int tap_open_common(void *dev, char *gate_addr)
 {
diff --git a/arch/um/drivers/pcap_user.c b/arch/um/drivers/pcap_user.c
index 2ef641ded96..11921a7baa7 100644
--- a/arch/um/drivers/pcap_user.c
+++ b/arch/um/drivers/pcap_user.c
@@ -12,6 +12,7 @@
 #include "net_user.h"
 #include "pcap_user.h"
 #include "user.h"
+#include "um_malloc.h"
 
 #define MAX_PACKET (ETH_MAX_PACKET + ETH_HEADER_OTHER)
 
diff --git a/arch/um/drivers/port_user.c b/arch/um/drivers/port_user.c
index f2e8fc42ecc..bc6afaf74c1 100644
--- a/arch/um/drivers/port_user.c
+++ b/arch/um/drivers/port_user.c
@@ -19,6 +19,7 @@
 #include "chan_user.h"
 #include "port.h"
 #include "os.h"
+#include "um_malloc.h"
 
 struct port_chan {
         int raw;
diff --git a/arch/um/drivers/pty.c b/arch/um/drivers/pty.c
index abec620e838..829a5eca8c0 100644
--- a/arch/um/drivers/pty.c
+++ b/arch/um/drivers/pty.c
@@ -13,6 +13,7 @@
 #include "user_util.h"
 #include "kern_util.h"
 #include "os.h"
+#include "um_malloc.h"
 
 struct pty_chan {
         void (*announce)(char *dev_name, int dev);
diff --git a/arch/um/drivers/slip_user.c b/arch/um/drivers/slip_user.c
index 8460285c69a..7eddacc53b6 100644
--- a/arch/um/drivers/slip_user.c
+++ b/arch/um/drivers/slip_user.c
@@ -15,6 +15,7 @@
 #include "slip.h"
 #include "slip_common.h"
 #include "os.h"
+#include "um_malloc.h"
 
 void slip_user_init(void *data, void *dev)
 {
diff --git a/arch/um/drivers/tty.c b/arch/um/drivers/tty.c
index 11de3ac1eb5..d95d64309ea 100644
--- a/arch/um/drivers/tty.c
+++ b/arch/um/drivers/tty.c
@@ -11,6 +11,7 @@
 #include "user_util.h"
 #include "user.h"
 #include "os.h"
+#include "um_malloc.h"
 
 struct tty_chan {
         char *dev;
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index bc458f57921..49c047b75cc 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -106,10 +106,15 @@ static inline void ubd_set_bit(__u64 bit, unsigned char *data)
 
 #define DRIVER_NAME "uml-blkdev"
 
+/* Can be taken in interrupt context, and is passed to the block layer to lock
+ * the request queue. Kernel side code knows that. */
 static DEFINE_SPINLOCK(ubd_io_lock);
-static DEFINE_SPINLOCK(ubd_lock);
 
-static void (*do_ubd)(void);
+static DEFINE_MUTEX(ubd_lock);
+
+/* XXX - this made sense in 2.4 days, now it's only used as a boolean, and
+ * probably it doesn't make sense even for that. */
+static int do_ubd;
 
 static int ubd_open(struct inode * inode, struct file * filp);
 static int ubd_release(struct inode * inode, struct file * file);
@@ -117,7 +122,7 @@ static int ubd_ioctl(struct inode * inode, struct file * file,
                      unsigned int cmd, unsigned long arg);
 static int ubd_getgeo(struct block_device *bdev, struct hd_geometry *geo);
 
-#define MAX_DEV (8)
+#define MAX_DEV (16)
 
 static struct block_device_operations ubd_blops = {
         .owner          = THIS_MODULE,
@@ -150,8 +155,9 @@ static struct gendisk *fake_gendisk[MAX_DEV];
 static struct openflags global_openflags = OPEN_FLAGS;
 
 struct cow {
-        /* This is the backing file, actually */
+        /* backing file name */
         char *file;
+        /* backing file fd */
         int fd;
         unsigned long *bitmap;
         unsigned long bitmap_len;
@@ -160,14 +166,16 @@ struct cow {
 };
 
 struct ubd {
+        /* name (and fd, below) of the file opened for writing, either the
+         * backing or the cow file. */
         char *file;
         int count;
         int fd;
         __u64 size;
         struct openflags boot_openflags;
         struct openflags openflags;
-        int shared;
-        int no_cow;
+        unsigned shared:1;
+        unsigned no_cow:1;
         struct cow cow;
         struct platform_device pdev;
 };
@@ -192,18 +200,7 @@ struct ubd {
         .cow =                  DEFAULT_COW, \
 }
 
-struct ubd ubd_dev[MAX_DEV] = { [ 0 ... MAX_DEV - 1 ] = DEFAULT_UBD };
-
-static int ubd0_init(void)
-{
-        struct ubd *dev = &ubd_dev[0];
-
-        if(dev->file == NULL)
-                dev->file = "root_fs";
-        return(0);
-}
-
-__initcall(ubd0_init);
+struct ubd ubd_devs[MAX_DEV] = { [ 0 ... MAX_DEV - 1 ] = DEFAULT_UBD };
 
 /* Only changed by fake_ide_setup which is a setup */
 static int fake_ide = 0;
@@ -277,7 +274,7 @@ static int parse_unit(char **ptr)
                         return(-1);
                 *ptr = end;
         }
-        else if (('a' <= *str) && (*str <= 'h')) {
+        else if (('a' <= *str) && (*str <= 'z')) {
                 n = *str - 'a';
                 str++;
                 *ptr = str;
@@ -285,9 +282,13 @@ static int parse_unit(char **ptr)
         return(n);
 }
 
+/* If *index_out == -1 at exit, the passed option was a general one;
+ * otherwise, the str pointer is used (and owned) inside ubd_devs array, so it
+ * should not be freed on exit.
+ */
 static int ubd_setup_common(char *str, int *index_out)
 {
-        struct ubd *dev;
+        struct ubd *ubd_dev;
         struct openflags flags = global_openflags;
         char *backing_file;
         int n, err, i;
@@ -311,7 +312,7 @@ static int ubd_setup_common(char *str, int *index_out)
                 }
 
                 err = 1;
-                spin_lock(&ubd_lock);
+                mutex_lock(&ubd_lock);
                 if(fake_major != MAJOR_NR){
                         printk(KERN_ERR "Can't assign a fake major twice\n");
                         goto out1;
@@ -323,7 +324,7 @@ static int ubd_setup_common(char *str, int *index_out)
                        major);
                 err = 0;
         out1:
-                spin_unlock(&ubd_lock);
+                mutex_unlock(&ubd_lock);
                 return(err);
         }
 
@@ -340,10 +341,10 @@ static int ubd_setup_common(char *str, int *index_out)
         }
 
         err = 1;
-        spin_lock(&ubd_lock);
+        mutex_lock(&ubd_lock);
 
-        dev = &ubd_dev[n];
-        if(dev->file != NULL){
+        ubd_dev = &ubd_devs[n];
+        if(ubd_dev->file != NULL){
                 printk(KERN_ERR "ubd_setup : device already configured\n");
                 goto out;
         }
@@ -360,10 +361,10 @@ static int ubd_setup_common(char *str, int *index_out)
                         flags.s = 1;
                         break;
                 case 'd':
-                        dev->no_cow = 1;
+                        ubd_dev->no_cow = 1;
                         break;
                 case 'c':
-                        dev->shared = 1;
+                        ubd_dev->shared = 1;
                         break;
                 case '=':
                         str++;
@@ -390,7 +391,7 @@ break_loop:
         }
 
         if(backing_file){
-                if(dev->no_cow)
+                if(ubd_dev->no_cow)
                         printk(KERN_ERR "Can't specify both 'd' and a "
                                "cow file\n");
                 else {
@@ -398,11 +399,11 @@ break_loop:
                         backing_file++;
                 }
         }
-        dev->file = str;
-        dev->cow.file = backing_file;
-        dev->boot_openflags = flags;
+        ubd_dev->file = str;
+        ubd_dev->cow.file = backing_file;
+        ubd_dev->boot_openflags = flags;
 out:
-        spin_unlock(&ubd_lock);
+        mutex_unlock(&ubd_lock);
         return(err);
 }
 
@@ -472,8 +473,9 @@ int thread_fd = -1;
 
 /* Changed by ubd_handler, which is serialized because interrupts only
  * happen on CPU 0.
+ * XXX: currently unused.
  */
-int intr_count = 0;
+static int intr_count = 0;
 
 /* call ubd_finish if you need to serialize */
 static void __ubd_finish(struct request *req, int error)
@@ -493,6 +495,8 @@ static void __ubd_finish(struct request *req, int error)
         end_request(req, 1);
 }
 
+/* Callable only from interrupt context - otherwise you need to do
+ * spin_lock_irq()/spin_lock_irqsave() */
 static inline void ubd_finish(struct request *req, int error)
 {
         spin_lock(&ubd_io_lock);
@@ -500,14 +504,15 @@ static inline void ubd_finish(struct request *req, int error)
         spin_unlock(&ubd_io_lock);
 }
 
-/* Called without ubd_io_lock held */
+/* XXX - move this inside ubd_intr. */
+/* Called without ubd_io_lock held, and only in interrupt context. */
 static void ubd_handler(void)
 {
         struct io_thread_req req;
         struct request *rq = elv_next_request(ubd_queue);
         int n;
 
-        do_ubd = NULL;
+        do_ubd = 0;
         intr_count++;
         n = os_read_file(thread_fd, &req, sizeof(req));
         if(n != sizeof(req)){
@@ -521,7 +526,9 @@ static void ubd_handler(void)
 
         ubd_finish(rq, req.error);
         reactivate_fd(thread_fd, UBD_IRQ);      
+        spin_lock(&ubd_io_lock);
         do_ubd_request(ubd_queue);
+        spin_unlock(&ubd_io_lock);
 }
 
 static irqreturn_t ubd_intr(int irq, void *dev)
@@ -541,87 +548,90 @@ void kill_io_thread(void)
 
 __uml_exitcall(kill_io_thread);
 
-static int ubd_file_size(struct ubd *dev, __u64 *size_out)
+static inline int ubd_file_size(struct ubd *ubd_dev, __u64 *size_out)
 {
         char *file;
 
-        file = dev->cow.file ? dev->cow.file : dev->file;
+        file = ubd_dev->cow.file ? ubd_dev->cow.file : ubd_dev->file;
         return(os_file_size(file, size_out));
 }
 
-static void ubd_close(struct ubd *dev)
+static void ubd_close_dev(struct ubd *ubd_dev)
 {
-        os_close_file(dev->fd);
-        if(dev->cow.file == NULL)
+        os_close_file(ubd_dev->fd);
+        if(ubd_dev->cow.file == NULL)
                 return;
 
-        os_close_file(dev->cow.fd);
-        vfree(dev->cow.bitmap);
-        dev->cow.bitmap = NULL;
+        os_close_file(ubd_dev->cow.fd);
+        vfree(ubd_dev->cow.bitmap);
+        ubd_dev->cow.bitmap = NULL;
 }
 
-static int ubd_open_dev(struct ubd *dev)
+static int ubd_open_dev(struct ubd *ubd_dev)
 {
         struct openflags flags;
         char **back_ptr;
         int err, create_cow, *create_ptr;
+        int fd;
 
-        dev->openflags = dev->boot_openflags;
+        ubd_dev->openflags = ubd_dev->boot_openflags;
         create_cow = 0;
-        create_ptr = (dev->cow.file != NULL) ? &create_cow : NULL;
-        back_ptr = dev->no_cow ? NULL : &dev->cow.file;
-        dev->fd = open_ubd_file(dev->file, &dev->openflags, dev->shared,
-                                back_ptr, &dev->cow.bitmap_offset,
-                                &dev->cow.bitmap_len, &dev->cow.data_offset,
+        create_ptr = (ubd_dev->cow.file != NULL) ? &create_cow : NULL;
+        back_ptr = ubd_dev->no_cow ? NULL : &ubd_dev->cow.file;
+
+        fd = open_ubd_file(ubd_dev->file, &ubd_dev->openflags, ubd_dev->shared,
+                                back_ptr, &ubd_dev->cow.bitmap_offset,
+                                &ubd_dev->cow.bitmap_len, &ubd_dev->cow.data_offset,
                                 create_ptr);
 
-        if((dev->fd == -ENOENT) && create_cow){
-                dev->fd = create_cow_file(dev->file, dev->cow.file,
-                                          dev->openflags, 1 << 9, PAGE_SIZE,
-                                          &dev->cow.bitmap_offset,
-                                          &dev->cow.bitmap_len,
-                                          &dev->cow.data_offset);
-                if(dev->fd >= 0){
+        if((fd == -ENOENT) && create_cow){
+                fd = create_cow_file(ubd_dev->file, ubd_dev->cow.file,
+                                          ubd_dev->openflags, 1 << 9, PAGE_SIZE,
+                                          &ubd_dev->cow.bitmap_offset,
+                                          &ubd_dev->cow.bitmap_len,
+                                          &ubd_dev->cow.data_offset);
+                if(fd >= 0){
                         printk(KERN_INFO "Creating \"%s\" as COW file for "
-                               "\"%s\"\n", dev->file, dev->cow.file);
+                               "\"%s\"\n", ubd_dev->file, ubd_dev->cow.file);
                 }
         }
 
-        if(dev->fd < 0){
-                printk("Failed to open '%s', errno = %d\n", dev->file,
-                       -dev->fd);
-                return(dev->fd);
+        if(fd < 0){
+                printk("Failed to open '%s', errno = %d\n", ubd_dev->file,
+                       -fd);
+                return fd;
         }
+        ubd_dev->fd = fd;
 
-        if(dev->cow.file != NULL){
+        if(ubd_dev->cow.file != NULL){
                 err = -ENOMEM;
-                dev->cow.bitmap = (void *) vmalloc(dev->cow.bitmap_len);
-                if(dev->cow.bitmap == NULL){
+                ubd_dev->cow.bitmap = (void *) vmalloc(ubd_dev->cow.bitmap_len);
+                if(ubd_dev->cow.bitmap == NULL){
                         printk(KERN_ERR "Failed to vmalloc COW bitmap\n");
                         goto error;
                 }
                 flush_tlb_kernel_vm();
 
-                err = read_cow_bitmap(dev->fd, dev->cow.bitmap,
-                                      dev->cow.bitmap_offset,
-                                      dev->cow.bitmap_len);
+                err = read_cow_bitmap(ubd_dev->fd, ubd_dev->cow.bitmap,
+                                      ubd_dev->cow.bitmap_offset,
+                                      ubd_dev->cow.bitmap_len);
                 if(err < 0)
                         goto error;
 
-                flags = dev->openflags;
+                flags = ubd_dev->openflags;
                 flags.w = 0;
-                err = open_ubd_file(dev->cow.file, &flags, dev->shared, NULL,
+                err = open_ubd_file(ubd_dev->cow.file, &flags, ubd_dev->shared, NULL,
                                     NULL, NULL, NULL, NULL);
                 if(err < 0) goto error;
-                dev->cow.fd = err;
+                ubd_dev->cow.fd = err;
         }
         return(0);
  error:
-        os_close_file(dev->fd);
+        os_close_file(ubd_dev->fd);
         return(err);
 }
 
-static int ubd_new_disk(int major, u64 size, int unit,
+static int ubd_disk_register(int major, u64 size, int unit,
                         struct gendisk **disk_out)
                         
 {
@@ -642,13 +652,13 @@ static int ubd_new_disk(int major, u64 size, int unit,
 
         /* sysfs register (not for ide fake devices) */
         if (major == MAJOR_NR) {
-                ubd_dev[unit].pdev.id   = unit;
-                ubd_dev[unit].pdev.name = DRIVER_NAME;
-                platform_device_register(&ubd_dev[unit].pdev);
-                disk->driverfs_dev = &ubd_dev[unit].pdev.dev;
+                ubd_devs[unit].pdev.id   = unit;
+                ubd_devs[unit].pdev.name = DRIVER_NAME;
+                platform_device_register(&ubd_devs[unit].pdev);
+                disk->driverfs_dev = &ubd_devs[unit].pdev.dev;
         }
 
-        disk->private_data = &ubd_dev[unit];
+        disk->private_data = &ubd_devs[unit];
         disk->queue = ubd_queue;
         add_disk(disk);
 
@@ -660,25 +670,25 @@ static int ubd_new_disk(int major, u64 size, int unit,
 
 static int ubd_add(int n)
 {
-        struct ubd *dev = &ubd_dev[n];
+        struct ubd *ubd_dev = &ubd_devs[n];
         int err;
 
         err = -ENODEV;
-        if(dev->file == NULL)
+        if(ubd_dev->file == NULL)
                 goto out;
 
-        err = ubd_file_size(dev, &dev->size);
+        err = ubd_file_size(ubd_dev, &ubd_dev->size);
         if(err < 0)
                 goto out;
 
-        dev->size = ROUND_BLOCK(dev->size);
+        ubd_dev->size = ROUND_BLOCK(ubd_dev->size);
 
-        err = ubd_new_disk(MAJOR_NR, dev->size, n, &ubd_gendisk[n]);
+        err = ubd_disk_register(MAJOR_NR, ubd_dev->size, n, &ubd_gendisk[n]);
         if(err)
                 goto out;
 
         if(fake_major != MAJOR_NR)
-                ubd_new_disk(fake_major, dev->size, n,
+                ubd_disk_register(fake_major, ubd_dev->size, n,
                              &fake_gendisk[n]);
 
         /* perhaps this should also be under the "if (fake_major)" above */
@@ -693,32 +703,41 @@ out:
 
 static int ubd_config(char *str)
 {
-        int n, err;
+        int n, ret;
 
         str = kstrdup(str, GFP_KERNEL);
-        if(str == NULL){
+        if (str == NULL) {
                 printk(KERN_ERR "ubd_config failed to strdup string\n");
-                return(1);
+                ret = 1;
+                goto out;
         }
-        err = ubd_setup_common(str, &n);
-        if(err){
-                kfree(str);
-                return(-1);
+        ret = ubd_setup_common(str, &n);
+        if (ret) {
+                ret = -1;
+                goto err_free;
+        }
+        if (n == -1) {
+                ret = 0;
+                goto err_free;
         }
-        if(n == -1) return(0);
 
-        spin_lock(&ubd_lock);
-        err = ubd_add(n);
-        if(err)
-                ubd_dev[n].file = NULL;
-        spin_unlock(&ubd_lock);
+        mutex_lock(&ubd_lock);
+        ret = ubd_add(n);
+        if (ret)
+                ubd_devs[n].file = NULL;
+        mutex_unlock(&ubd_lock);
 
-        return(err);
+out:
+        return ret;
+
+err_free:
+        kfree(str);
+        goto out;
 }
 
 static int ubd_get_config(char *name, char *str, int size, char **error_out)
 {
-        struct ubd *dev;
+        struct ubd *ubd_dev;
         int n, len = 0;
 
         n = parse_unit(&name);
@@ -727,24 +746,24 @@ static int ubd_get_config(char *name, char *str, int size, char **error_out)
                 return(-1);
         }
 
-        dev = &ubd_dev[n];
-        spin_lock(&ubd_lock);
+        ubd_dev = &ubd_devs[n];
+        mutex_lock(&ubd_lock);
 
-        if(dev->file == NULL){
+        if(ubd_dev->file == NULL){
                 CONFIG_CHUNK(str, size, len, "", 1);
                 goto out;
         }
 
-        CONFIG_CHUNK(str, size, len, dev->file, 0);
+        CONFIG_CHUNK(str, size, len, ubd_dev->file, 0);
 
-        if(dev->cow.file != NULL){
+        if(ubd_dev->cow.file != NULL){
                 CONFIG_CHUNK(str, size, len, ",", 0);
-                CONFIG_CHUNK(str, size, len, dev->cow.file, 1);
+                CONFIG_CHUNK(str, size, len, ubd_dev->cow.file, 1);
         }
         else CONFIG_CHUNK(str, size, len, "", 1);
 
  out:
-        spin_unlock(&ubd_lock);
+        mutex_unlock(&ubd_lock);
         return(len);
 }
 
@@ -760,22 +779,22 @@ static int ubd_id(char **str, int *start_out, int *end_out)
 
 static int ubd_remove(int n)
 {
-        struct ubd *dev;
+        struct ubd *ubd_dev;
         int err = -ENODEV;
 
-        spin_lock(&ubd_lock);
+        mutex_lock(&ubd_lock);
 
         if(ubd_gendisk[n] == NULL)
                 goto out;
 
-        dev = &ubd_dev[n];
+        ubd_dev = &ubd_devs[n];
 
-        if(dev->file == NULL)
+        if(ubd_dev->file == NULL)
                 goto out;
 
         /* you cannot remove a open disk */
         err = -EBUSY;
-        if(dev->count > 0)
+        if(ubd_dev->count > 0)
                 goto out;
 
         del_gendisk(ubd_gendisk[n]);
@@ -788,14 +807,15 @@ static int ubd_remove(int n)
                 fake_gendisk[n] = NULL;
         }
 
-        platform_device_unregister(&dev->pdev);
-        *dev = ((struct ubd) DEFAULT_UBD);
+        platform_device_unregister(&ubd_dev->pdev);
+        *ubd_dev = ((struct ubd) DEFAULT_UBD);
         err = 0;
 out:
-        spin_unlock(&ubd_lock);
+        mutex_unlock(&ubd_lock);
         return err;
 }
 
+/* All these are called by mconsole in process context and without ubd-specific locks. */
 static struct mc_device ubd_mc = {
         .name           = "ubd",
         .config         = ubd_config,
@@ -804,7 +824,7 @@ static struct mc_device ubd_mc = {
         .remove         = ubd_remove,
 };
 
-static int ubd_mc_init(void)
+static int __init ubd_mc_init(void)
 {
         mconsole_register_dev(&ubd_mc);
         return 0;
@@ -812,13 +832,24 @@ static int ubd_mc_init(void)
 
 __initcall(ubd_mc_init);
 
+static int __init ubd0_init(void)
+{
+        struct ubd *ubd_dev = &ubd_devs[0];
+
+        if(ubd_dev->file == NULL)
+                ubd_dev->file = "root_fs";
+        return(0);
+}
+
+__initcall(ubd0_init);
+
 static struct platform_driver ubd_driver = {
         .driver = {
                 .name  = DRIVER_NAME,
         },
 };
 
-int ubd_init(void)
+static int __init ubd_init(void)
 {
         int i;
 
@@ -846,7 +877,7 @@ int ubd_init(void)
 
 late_initcall(ubd_init);
 
-int ubd_driver_init(void){
+static int __init ubd_driver_init(void){
         unsigned long stack;
         int err;
 
@@ -867,7 +898,7 @@ int ubd_driver_init(void){
                 return(0);
         }
         err = um_request_irq(UBD_IRQ, thread_fd, IRQ_READ, ubd_intr,
-                             IRQF_DISABLED, "ubd", ubd_dev);
+                             IRQF_DISABLED, "ubd", ubd_devs);
         if(err != 0)
                 printk(KERN_ERR "um_request_irq failed - errno = %d\n", -err);
         return 0;
@@ -878,24 +909,24 @@ device_initcall(ubd_driver_init);
 static int ubd_open(struct inode *inode, struct file *filp)
 {
         struct gendisk *disk = inode->i_bdev->bd_disk;
-        struct ubd *dev = disk->private_data;
+        struct ubd *ubd_dev = disk->private_data;
         int err = 0;
 
-        if(dev->count == 0){
-                err = ubd_open_dev(dev);
+        if(ubd_dev->count == 0){
+                err = ubd_open_dev(ubd_dev);
                 if(err){
                         printk(KERN_ERR "%s: Can't open \"%s\": errno = %d\n",
-                               disk->disk_name, dev->file, -err);
+                               disk->disk_name, ubd_dev->file, -err);
                         goto out;
                 }
         }
-        dev->count++;
-        set_disk_ro(disk, !dev->openflags.w);
+        ubd_dev->count++;
+        set_disk_ro(disk, !ubd_dev->openflags.w);
 
         /* This should no more be needed. And it didn't work anyway to exclude
          * read-write remounting of filesystems.*/
-        /*if((filp->f_mode & FMODE_WRITE) && !dev->openflags.w){
-                if(--dev->count == 0) ubd_close(dev);
+        /*if((filp->f_mode & FMODE_WRITE) && !ubd_dev->openflags.w){
+                if(--ubd_dev->count == 0) ubd_close_dev(ubd_dev);
                 err = -EROFS;
         }*/
  out:
@@ -905,10 +936,10 @@ static int ubd_open(struct inode *inode, struct file *filp)
 static int ubd_release(struct inode * inode, struct file * file)
 {
         struct gendisk *disk = inode->i_bdev->bd_disk;
-        struct ubd *dev = disk->private_data;
+        struct ubd *ubd_dev = disk->private_data;
 
-        if(--dev->count == 0)
-                ubd_close(dev);
+        if(--ubd_dev->count == 0)
+                ubd_close_dev(ubd_dev);
         return(0);
 }
 
@@ -976,12 +1007,12 @@ static void cowify_req(struct io_thread_req *req, unsigned long *bitmap,
 static int prepare_request(struct request *req, struct io_thread_req *io_req)
 {
         struct gendisk *disk = req->rq_disk;
-        struct ubd *dev = disk->private_data;
+        struct ubd *ubd_dev = disk->private_data;
         __u64 offset;
         int len;
 
         /* This should be impossible now */
-        if((rq_data_dir(req) == WRITE) && !dev->openflags.w){
+        if((rq_data_dir(req) == WRITE) && !ubd_dev->openflags.w){
                 printk("Write attempted on readonly ubd device %s\n",
                        disk->disk_name);
                 end_request(req, 0);
@@ -991,8 +1022,8 @@ static int prepare_request(struct request *req, struct io_thread_req *io_req)
         offset = ((__u64) req->sector) << 9;
         len = req->current_nr_sectors << 9;
 
-        io_req->fds[0] = (dev->cow.file != NULL) ? dev->cow.fd : dev->fd;
-        io_req->fds[1] = dev->fd;
+        io_req->fds[0] = (ubd_dev->cow.file != NULL) ? ubd_dev->cow.fd : ubd_dev->fd;
+        io_req->fds[1] = ubd_dev->fd;
         io_req->cow_offset = -1;
         io_req->offset = offset;
         io_req->length = len;
@@ -1001,13 +1032,13 @@ static int prepare_request(struct request *req, struct io_thread_req *io_req)
 
         io_req->op = (rq_data_dir(req) == READ) ? UBD_READ : UBD_WRITE;
         io_req->offsets[0] = 0;
-        io_req->offsets[1] = dev->cow.data_offset;
+        io_req->offsets[1] = ubd_dev->cow.data_offset;
         io_req->buffer = req->buffer;
         io_req->sectorsize = 1 << 9;
 
-        if(dev->cow.file != NULL)
-                cowify_req(io_req, dev->cow.bitmap, dev->cow.bitmap_offset,
-                           dev->cow.bitmap_len);
+        if(ubd_dev->cow.file != NULL)
+                cowify_req(io_req, ubd_dev->cow.bitmap, ubd_dev->cow.bitmap_offset,
+                           ubd_dev->cow.bitmap_len);
 
         return(0);
 }
@@ -1033,7 +1064,7 @@ static void do_ubd_request(request_queue_t *q)
                         return;
                 err = prepare_request(req, &io_req);
                 if(!err){
-                        do_ubd = ubd_handler;
+                        do_ubd = 1;
                         n = os_write_file(thread_fd, (char *) &io_req,
                                          sizeof(io_req));
                         if(n != sizeof(io_req))
@@ -1045,18 +1076,18 @@ static void do_ubd_request(request_queue_t *q)
 
 static int ubd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 {
-        struct ubd *dev = bdev->bd_disk->private_data;
+        struct ubd *ubd_dev = bdev->bd_disk->private_data;
 
         geo->heads = 128;
         geo->sectors = 32;
-        geo->cylinders = dev->size / (128 * 32 * 512);
+        geo->cylinders = ubd_dev->size / (128 * 32 * 512);
         return 0;
 }
 
 static int ubd_ioctl(struct inode * inode, struct file * file,
                      unsigned int cmd, unsigned long arg)
 {
-        struct ubd *dev = inode->i_bdev->bd_disk->private_data;
+        struct ubd *ubd_dev = inode->i_bdev->bd_disk->private_data;
         struct hd_driveid ubd_id = {
                 .cyls           = 0,
                 .heads          = 128,
@@ -1066,7 +1097,7 @@ static int ubd_ioctl(struct inode * inode, struct file * file,
         switch (cmd) {
                 struct cdrom_volctrl volume;
         case HDIO_GET_IDENTITY:
-                ubd_id.cyls = dev->size / (128 * 32 * 512);
+                ubd_id.cyls = ubd_dev->size / (128 * 32 * 512);
                 if(copy_to_user((char __user *) arg, (char *) &ubd_id,
                                  sizeof(ubd_id)))
                         return(-EFAULT);
@@ -1353,8 +1384,8 @@ void do_io(struct io_thread_req *req)
  */
 int kernel_fd = -1;
 
-/* Only changed by the io thread */
-int io_count = 0;
+/* Only changed by the io thread. XXX: currently unused. */
+static int io_count = 0;
 
 int io_thread(void *arg)
 {
diff --git a/arch/um/drivers/xterm.c b/arch/um/drivers/xterm.c
index 386f8b95298..850221d9b4c 100644
--- a/arch/um/drivers/xterm.c
+++ b/arch/um/drivers/xterm.c
@@ -136,8 +136,6 @@ int xterm_open(int input, int output, int primary, void *d,
                 return(pid);
         }
 
-        if(data->stack == 0) free_stack(stack, 0);
-
         if (data->direct_rcv) {
                 new = os_rcv_fd(fd, &data->helper_pid);
         } else {