29 files changed, 324 insertions, 175 deletions

diff --git a/arch/powerpc/kernel/ppc_ksyms.c b/arch/powerpc/kernel/ppc_ksyms.c
index af4d1bc9a2eb..94db25708456 100644
--- a/arch/powerpc/kernel/ppc_ksyms.c
+++ b/arch/powerpc/kernel/ppc_ksyms.c
@@ -163,15 +163,13 @@ EXPORT_SYMBOL(giveup_altivec);
 EXPORT_SYMBOL(giveup_spe);
 #endif /* CONFIG_SPE */
 
-#ifdef CONFIG_PPC64
-EXPORT_SYMBOL(__flush_icache_range);
-#else
+#ifndef CONFIG_PPC64
 EXPORT_SYMBOL(flush_instruction_cache);
-EXPORT_SYMBOL(flush_icache_range);
 EXPORT_SYMBOL(flush_tlb_kernel_range);
 EXPORT_SYMBOL(flush_tlb_page);
 EXPORT_SYMBOL(_tlbie);
 #endif
+EXPORT_SYMBOL(__flush_icache_range);
 EXPORT_SYMBOL(flush_dcache_range);
 
 #ifdef CONFIG_SMP
diff --git a/arch/ppc/kernel/ppc_ksyms.c b/arch/ppc/kernel/ppc_ksyms.c
index 66073f775193..bb6a5c6a64be 100644
--- a/arch/ppc/kernel/ppc_ksyms.c
+++ b/arch/ppc/kernel/ppc_ksyms.c
@@ -184,7 +184,7 @@ EXPORT_SYMBOL(kernel_thread);
 
 EXPORT_SYMBOL(flush_instruction_cache);
 EXPORT_SYMBOL(giveup_fpu);
-EXPORT_SYMBOL(flush_icache_range);
+EXPORT_SYMBOL(__flush_icache_range);
 EXPORT_SYMBOL(flush_dcache_range);
 EXPORT_SYMBOL(flush_icache_user_range);
 EXPORT_SYMBOL(flush_dcache_page);
diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
index 74022316fc63..65c2ec5c421b 100644
--- a/drivers/message/fusion/mptbase.c
+++ b/drivers/message/fusion/mptbase.c
@@ -91,9 +91,9 @@ static int mfcounter = 0;
  *  Public data...
  */
 int mpt_lan_index = -1;
-static int mpt_stm_index = -1;
+int mpt_stm_index = -1;
 
-static struct proc_dir_entry *mpt_proc_root_dir;
+struct proc_dir_entry *mpt_proc_root_dir;
 
 #define WHOINIT_UNKNOWN         0xAA
 
@@ -6271,6 +6271,7 @@ EXPORT_SYMBOL(mpt_resume);
 EXPORT_SYMBOL(mpt_suspend);
 #endif
 EXPORT_SYMBOL(ioc_list);
+EXPORT_SYMBOL(mpt_proc_root_dir);
 EXPORT_SYMBOL(mpt_register);
 EXPORT_SYMBOL(mpt_deregister);
 EXPORT_SYMBOL(mpt_event_register);
@@ -6288,6 +6289,7 @@ EXPORT_SYMBOL(mpt_verify_adapter);
 EXPORT_SYMBOL(mpt_GetIocState);
 EXPORT_SYMBOL(mpt_print_ioc_summary);
 EXPORT_SYMBOL(mpt_lan_index);
+EXPORT_SYMBOL(mpt_stm_index);
 EXPORT_SYMBOL(mpt_HardResetHandler);
 EXPORT_SYMBOL(mpt_config);
 EXPORT_SYMBOL(mpt_toolbox);
diff --git a/drivers/message/fusion/mptbase.h b/drivers/message/fusion/mptbase.h
index 8ad277a9afa1..5f5b3fb5b4d7 100644
--- a/drivers/message/fusion/mptbase.h
+++ b/drivers/message/fusion/mptbase.h
@@ -1006,8 +1006,10 @@ extern int	 mptbase_sas_persist_operation(MPT_ADAPTER *ioc, u8 persist_opcode);
  *  Public data decl's...
  */
 extern struct list_head   ioc_list;
+extern struct proc_dir_entry    *mpt_proc_root_dir;
 
 extern int                mpt_lan_index;        /* needed by mptlan.c */
+extern int                mpt_stm_index;        /* needed by mptstm.c */
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 #endif          /* } __KERNEL__ */
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index 143f01a4c170..69c04945591f 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -4,7 +4,7 @@
  *
  * (C) 2000 Red Hat. GPL'd
  *
- * $Id: cfi_cmdset_0001.c,v 1.185 2005/11/07 11:14:22 gleixner Exp $
+ * $Id: cfi_cmdset_0001.c,v 1.186 2005/11/23 22:07:52 nico Exp $
  *
  *
  * 10/10/2000   Nicolas Pitre <nico@cam.org>
@@ -644,9 +644,8 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
                  *
                  * - contension arbitration is handled in the owner's context.
                  *
-                 * The 'shared' struct can be read when its lock is taken.
-                 * However any writes to it can only be made when the current
-                 * owner's lock is also held.
+                 * The 'shared' struct can be read and/or written only when
+                 * its lock is taken.
                  */
                 struct flchip_shared *shared = chip->priv;
                 struct flchip *contender;
@@ -675,14 +674,13 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
                         }
                         timeo = jiffies + HZ;
                         spin_lock(&shared->lock);
+                        spin_unlock(contender->mutex);
                 }
 
                 /* We now own it */
                 shared->writing = chip;
                 if (mode == FL_ERASING)
                         shared->erasing = chip;
-                if (contender && contender != chip)
-                        spin_unlock(contender->mutex);
                 spin_unlock(&shared->lock);
         }
 
diff --git a/drivers/mtd/chips/cfi_probe.c b/drivers/mtd/chips/cfi_probe.c
index 90eb30e06b7c..e636aa86bc24 100644
--- a/drivers/mtd/chips/cfi_probe.c
+++ b/drivers/mtd/chips/cfi_probe.c
@@ -1,7 +1,7 @@
 /*
    Common Flash Interface probe code.
    (C) 2000 Red Hat. GPL'd.
-   $Id: cfi_probe.c,v 1.84 2005/11/07 11:14:23 gleixner Exp $
+   $Id: cfi_probe.c,v 1.86 2005/11/29 14:48:31 gleixner Exp $
 */
 
 #include <linux/config.h>
@@ -230,8 +230,8 @@ static int __xipram cfi_chip_setup(struct map_info *map,
         cfi_send_gen_cmd(0xaa, 0x555, base, map, cfi, cfi->device_type, NULL);
         cfi_send_gen_cmd(0x55, 0x2aa, base, map, cfi, cfi->device_type, NULL);
         cfi_send_gen_cmd(0x90, 0x555, base, map, cfi, cfi->device_type, NULL);
-        cfi->mfr = cfi_read_query(map, base);
-        cfi->id = cfi_read_query(map, base + ofs_factor);
+        cfi->mfr = cfi_read_query16(map, base);
+        cfi->id = cfi_read_query16(map, base + ofs_factor);
 
         /* Put it back into Read Mode */
         cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL);
@@ -426,7 +426,7 @@ static struct mtd_chip_driver cfi_chipdrv = {
         .module         = THIS_MODULE
 };
 
-int __init cfi_probe_init(void)
+static int __init cfi_probe_init(void)
 {
         register_mtd_chip_driver(&cfi_chipdrv);
         return 0;
diff --git a/drivers/mtd/chips/sharp.c b/drivers/mtd/chips/sharp.c
index 2d26bdef82d5..36f61a6a766e 100644
--- a/drivers/mtd/chips/sharp.c
+++ b/drivers/mtd/chips/sharp.c
@@ -4,7 +4,7 @@
  * Copyright 2000,2001 David A. Schleef <ds@schleef.org>
  *           2000,2001 Lineo, Inc.
  *
- * $Id: sharp.c,v 1.16 2005/11/07 11:14:23 gleixner Exp $
+ * $Id: sharp.c,v 1.17 2005/11/29 14:28:28 gleixner Exp $
  *
  * Devices supported:
  *   LH28F016SCT Symmetrical block flash memory, 2Mx8
@@ -160,22 +160,28 @@ struct mtd_info *sharp_probe(struct map_info *map)
         return mtd;
 }
 
+static inline void sharp_send_cmd(struct map_info *map, unsigned long cmd, unsigned long adr)
+{
+        map_word map_cmd;
+        map_cmd.x[0] = cmd;
+        map_write(map, map_cmd, adr);
+}
+
 static int sharp_probe_map(struct map_info *map,struct mtd_info *mtd)
 {
-        unsigned long tmp;
+        map_word tmp, read0, read4;
         unsigned long base = 0;
-        u32 read0, read4;
         int width = 4;
 
-        tmp = map_read32(map, base+0);
+        tmp = map_read(map, base+0);
 
-        map_write32(map, CMD_READ_ID, base+0);
+        sharp_send_cmd(map, CMD_READ_ID, base+0);
 
-        read0=map_read32(map, base+0);
-        read4=map_read32(map, base+4);
-        if(read0 == 0x89898989){
+        read0 = map_read(map, base+0);
+        read4 = map_read(map, base+4);
+        if(read0.x[0] == 0x89898989){
                 printk("Looks like sharp flash\n");
-                switch(read4){
+                switch(read4.x[0]){
                 case 0xaaaaaaaa:
                 case 0xa0a0a0a0:
                         /* aa - LH28F016SCT-L95 2Mx8, 32 64k blocks*/
@@ -197,16 +203,16 @@ static int sharp_probe_map(struct map_info *map,struct mtd_info *mtd)
                         return width;
 #endif
                 default:
-                        printk("Sort-of looks like sharp flash, 0x%08x 0x%08x\n",
-                                read0,read4);
+                        printk("Sort-of looks like sharp flash, 0x%08lx 0x%08lx\n",
+                                read0.x[0], read4.x[0]);
                 }
-        }else if((map_read32(map, base+0) == CMD_READ_ID)){
+        }else if((map_read(map, base+0).x[0] == CMD_READ_ID)){
                 /* RAM, probably */
                 printk("Looks like RAM\n");
-                map_write32(map, tmp, base+0);
+                map_write(map, tmp, base+0);
         }else{
-                printk("Doesn't look like sharp flash, 0x%08x 0x%08x\n",
-                        read0,read4);
+                printk("Doesn't look like sharp flash, 0x%08lx 0x%08lx\n",
+                        read0.x[0], read4.x[0]);
         }
 
         return 0;
@@ -215,7 +221,8 @@ static int sharp_probe_map(struct map_info *map,struct mtd_info *mtd)
 /* This function returns with the chip->mutex lock held. */
 static int sharp_wait(struct map_info *map, struct flchip *chip)
 {
-        int status, i;
+        int i;
+        map_word status;
         unsigned long timeo = jiffies + HZ;
         DECLARE_WAITQUEUE(wait, current);
         int adr = 0;
@@ -225,12 +232,12 @@ retry:
 
         switch(chip->state){
         case FL_READY:
-                map_write32(map,CMD_READ_STATUS,adr);
+                sharp_send_cmd(map, CMD_READ_STATUS, adr);
                 chip->state = FL_STATUS;
         case FL_STATUS:
                 for(i=0;i<100;i++){
-                        status = map_read32(map,adr);
-                        if((status & SR_READY)==SR_READY)
+                        status = map_read(map, adr);
+                        if((status.x[0] & SR_READY)==SR_READY)
                                 break;
                         udelay(1);
                 }
@@ -254,7 +261,7 @@ retry:
                 goto retry;
         }
 
-        map_write32(map,CMD_RESET, adr);
+        sharp_send_cmd(map, CMD_RESET, adr);
 
         chip->state = FL_READY;
 
@@ -351,37 +358,39 @@ static int sharp_write_oneword(struct map_info *map, struct flchip *chip,
         int timeo;
         int try;
         int i;
-        int status = 0;
+        map_word data, status;
 
+        status.x[0] = 0;
         ret = sharp_wait(map,chip);
 
         for(try=0;try<10;try++){
-                map_write32(map,CMD_BYTE_WRITE,adr);
+                sharp_send_cmd(map, CMD_BYTE_WRITE, adr);
                 /* cpu_to_le32 -> hack to fix the writel be->le conversion */
-                map_write32(map,cpu_to_le32(datum),adr);
+                data.x[0] = cpu_to_le32(datum);
+                map_write(map, data, adr);
 
                 chip->state = FL_WRITING;
 
                 timeo = jiffies + (HZ/2);
 
-                map_write32(map,CMD_READ_STATUS,adr);
+                sharp_send_cmd(map, CMD_READ_STATUS, adr);
                 for(i=0;i<100;i++){
-                        status = map_read32(map,adr);
-                        if((status & SR_READY)==SR_READY)
+                        status = map_read(map, adr);
+                        if((status.x[0] & SR_READY) == SR_READY)
                                 break;
                 }
                 if(i==100){
                         printk("sharp: timed out writing\n");
                 }
 
-                if(!(status&SR_ERRORS))
+                if(!(status.x[0] & SR_ERRORS))
                         break;
 
-                printk("sharp: error writing byte at addr=%08lx status=%08x\n",adr,status);
+                printk("sharp: error writing byte at addr=%08lx status=%08lx\n", adr, status.x[0]);
 
-                map_write32(map,CMD_CLEAR_STATUS,adr);
+                sharp_send_cmd(map, CMD_CLEAR_STATUS, adr);
         }
-        map_write32(map,CMD_RESET,adr);
+        sharp_send_cmd(map, CMD_RESET, adr);
         chip->state = FL_READY;
 
         wake_up(&chip->wq);
@@ -434,18 +443,18 @@ static int sharp_do_wait_for_ready(struct map_info *map, struct flchip *chip,
 {
         int ret;
         unsigned long timeo;
-        int status;
+        map_word status;
         DECLARE_WAITQUEUE(wait, current);
 
-        map_write32(map,CMD_READ_STATUS,adr);
-        status = map_read32(map,adr);
+        sharp_send_cmd(map, CMD_READ_STATUS, adr);
+        status = map_read(map, adr);
 
         timeo = jiffies + HZ;
 
         while(time_before(jiffies, timeo)){
-                map_write32(map,CMD_READ_STATUS,adr);
-                status = map_read32(map,adr);
-                if((status & SR_READY)==SR_READY){
+                sharp_send_cmd(map, CMD_READ_STATUS, adr);
+                status = map_read(map, adr);
+                if((status.x[0] & SR_READY)==SR_READY){
                         ret = 0;
                         goto out;
                 }
@@ -476,7 +485,7 @@ static int sharp_erase_oneblock(struct map_info *map, struct flchip *chip,
 {
         int ret;
         //int timeo;
-        int status;
+        map_word status;
         //int i;
 
 //printk("sharp_erase_oneblock()\n");
@@ -486,26 +495,26 @@ static int sharp_erase_oneblock(struct map_info *map, struct flchip *chip,
         sharp_unlock_oneblock(map,chip,adr);
 #endif
 
-        map_write32(map,CMD_BLOCK_ERASE_1,adr);
-        map_write32(map,CMD_BLOCK_ERASE_2,adr);
+        sharp_send_cmd(map, CMD_BLOCK_ERASE_1, adr);
+        sharp_send_cmd(map, CMD_BLOCK_ERASE_2, adr);
 
         chip->state = FL_ERASING;
 
         ret = sharp_do_wait_for_ready(map,chip,adr);
         if(ret<0)return ret;
 
-        map_write32(map,CMD_READ_STATUS,adr);
-        status = map_read32(map,adr);
+        sharp_send_cmd(map, CMD_READ_STATUS, adr);
+        status = map_read(map, adr);
 
-        if(!(status&SR_ERRORS)){
-                map_write32(map,CMD_RESET,adr);
+        if(!(status.x[0] & SR_ERRORS)){
+                sharp_send_cmd(map, CMD_RESET, adr);
                 chip->state = FL_READY;
                 //spin_unlock_bh(chip->mutex);
                 return 0;
         }
 
-        printk("sharp: error erasing block at addr=%08lx status=%08x\n",adr,status);
-        map_write32(map,CMD_CLEAR_STATUS,adr);
+        printk("sharp: error erasing block at addr=%08lx status=%08lx\n", adr, status.x[0]);
+        sharp_send_cmd(map, CMD_CLEAR_STATUS, adr);
 
         //spin_unlock_bh(chip->mutex);
 
@@ -517,20 +526,20 @@ static void sharp_unlock_oneblock(struct map_info *map, struct flchip *chip,
         unsigned long adr)
 {
         int i;
-        int status;
+        map_word status;
 
-        map_write32(map,CMD_CLEAR_BLOCK_LOCKS_1,adr);
-        map_write32(map,CMD_CLEAR_BLOCK_LOCKS_2,adr);
+        sharp_send_cmd(map, CMD_CLEAR_BLOCK_LOCKS_1, adr);
+        sharp_send_cmd(map, CMD_CLEAR_BLOCK_LOCKS_2, adr);
 
         udelay(100);
 
-        status = map_read32(map,adr);
-        printk("status=%08x\n",status);
+        status = map_read(map, adr);
+        printk("status=%08lx\n", status.x[0]);
 
         for(i=0;i<1000;i++){
-                //map_write32(map,CMD_READ_STATUS,adr);
-                status = map_read32(map,adr);
-                if((status & SR_READY)==SR_READY)
+                //sharp_send_cmd(map, CMD_READ_STATUS, adr);
+                status = map_read(map, adr);
+                if((status.x[0] & SR_READY) == SR_READY)
                         break;
                 udelay(100);
         }
@@ -538,14 +547,14 @@ static void sharp_unlock_oneblock(struct map_info *map, struct flchip *chip,
                 printk("sharp: timed out unlocking block\n");
         }
 
-        if(!(status&SR_ERRORS)){
-                map_write32(map,CMD_RESET,adr);
+        if(!(status.x[0] & SR_ERRORS)){
+                sharp_send_cmd(map, CMD_RESET, adr);
                 chip->state = FL_READY;
                 return;
         }
 
-        printk("sharp: error unlocking block at addr=%08lx status=%08x\n",adr,status);
-        map_write32(map,CMD_CLEAR_STATUS,adr);
+        printk("sharp: error unlocking block at addr=%08lx status=%08lx\n", adr, status.x[0]);
+        sharp_send_cmd(map, CMD_CLEAR_STATUS, adr);
 }
 #endif
 
diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c
index 0aaa0ced9aba..7ff403b2a0a0 100644
--- a/drivers/mtd/devices/block2mtd.c
+++ b/drivers/mtd/devices/block2mtd.c
@@ -1,5 +1,5 @@
 /*
- * $Id: block2mtd.c,v 1.29 2005/11/07 11:14:24 gleixner Exp $
+ * $Id: block2mtd.c,v 1.30 2005/11/29 14:48:32 gleixner Exp $
  *
  * block2mtd.c - create an mtd from a block device
  *
@@ -19,7 +19,7 @@
 #include <linux/mtd/mtd.h>
 #include <linux/buffer_head.h>
 
-#define VERSION "$Revision: 1.29 $"
+#define VERSION "$Revision: 1.30 $"
 
 
 #define ERROR(fmt, args...) printk(KERN_ERR "block2mtd: " fmt "\n" , ## args)
@@ -40,7 +40,7 @@ static LIST_HEAD(blkmtd_device_list);
 
 
 #define PAGE_READAHEAD 64
-void cache_readahead(struct address_space *mapping, int index)
+static void cache_readahead(struct address_space *mapping, int index)
 {
         filler_t *filler = (filler_t*)mapping->a_ops->readpage;
         int i, pagei;
diff --git a/drivers/mtd/devices/ms02-nv.c b/drivers/mtd/devices/ms02-nv.c
index f5026cee087f..0ff2e4378244 100644
--- a/drivers/mtd/devices/ms02-nv.c
+++ b/drivers/mtd/devices/ms02-nv.c
@@ -6,7 +6,7 @@
  *      as published by the Free Software Foundation; either version
  *      2 of the License, or (at your option) any later version.
  *
- *      $Id: ms02-nv.c,v 1.10 2005/06/20 12:24:41 macro Exp $
+ *      $Id: ms02-nv.c,v 1.11 2005/11/14 13:41:47 macro Exp $
  */
 
 #include <linux/init.h>
@@ -293,13 +293,13 @@ static int __init ms02nv_init(void)
 
         switch (mips_machtype) {
         case MACH_DS5000_200:
-                csr = (volatile u32 *)KN02_CSR_BASE;
+                csr = (volatile u32 *)CKSEG1ADDR(KN02_SLOT_BASE + KN02_CSR);
                 if (*csr & KN02_CSR_BNK32M)
                         stride = 2;
                 break;
         case MACH_DS5000_2X0:
         case MACH_DS5900:
-                csr = (volatile u32 *)KN03_MCR_BASE;
+                csr = (volatile u32 *)CKSEG1ADDR(KN03_SLOT_BASE + IOASIC_MCR);
                 if (*csr & KN03_MCR_BNK32M)
                         stride = 2;
                 break;
diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c
index de7e231d6d18..8a878b34eca0 100644
--- a/drivers/mtd/ftl.c
+++ b/drivers/mtd/ftl.c
@@ -1,5 +1,5 @@
 /* This version ported to the Linux-MTD system by dwmw2@infradead.org
- * $Id: ftl.c,v 1.58 2005/11/07 11:14:19 gleixner Exp $
+ * $Id: ftl.c,v 1.59 2005/11/29 14:48:31 gleixner Exp $
  *
  * Fixes: Arnaldo Carvalho de Melo <acme@conectiva.com.br>
  * - fixes some leaks on failure in build_maps and ftl_notify_add, cleanups
@@ -1084,9 +1084,9 @@ struct mtd_blktrans_ops ftl_tr = {
         .owner          = THIS_MODULE,
 };
 
-int init_ftl(void)
+static int init_ftl(void)
 {
-        DEBUG(0, "$Id: ftl.c,v 1.58 2005/11/07 11:14:19 gleixner Exp $\n");
+        DEBUG(0, "$Id: ftl.c,v 1.59 2005/11/29 14:48:31 gleixner Exp $\n");
 
         return register_mtd_blktrans(&ftl_tr);
 }
diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig
index 846a533323a8..452ccd5037c3 100644
--- a/drivers/mtd/maps/Kconfig
+++ b/drivers/mtd/maps/Kconfig
@@ -538,12 +538,6 @@ config MTD_MPC1211
           This enables access to the flash chips on the Interface MPC-1211(CTP/PCI/MPC-SH02).
           If you have such a board, say 'Y'.
 
-config MTD_PQ2FADS
-        tristate "JEDEC flash SIMM mapped on PQ2FADS and 8272ADS boards"
-        depends on (ADS8272 || PQ2FADS) && MTD_PARTITIONS && MTD_JEDECPROBE && MTD_PHYSMAP && MTD_CFI_GEOMETRY && MTD_CFI_INTELEXT
-        help
-         This enables access to flash SIMM on PQ2FADS-like boards
-
 config MTD_OMAP_NOR
         tristate "TI OMAP board mappings"
         depends on MTD_CFI && ARCH_OMAP
diff --git a/drivers/mtd/maps/Makefile b/drivers/mtd/maps/Makefile
index 7d9e940a1dcd..2f7e254912f0 100644
--- a/drivers/mtd/maps/Makefile
+++ b/drivers/mtd/maps/Makefile
@@ -70,6 +70,5 @@ obj-$(CONFIG_MTD_DMV182)	+= dmv182.o
 obj-$(CONFIG_MTD_SHARP_SL)      += sharpsl-flash.o
 obj-$(CONFIG_MTD_PLATRAM)       += plat-ram.o
 obj-$(CONFIG_MTD_OMAP_NOR)      += omap_nor.o
-obj-$(CONFIG_MTD_PQ2FADS)       += pq2fads.o
 obj-$(CONFIG_MTD_MTX1)          += mtx-1_flash.o
 obj-$(CONFIG_MTD_TQM834x)       += tqm834x.o
diff --git a/drivers/mtd/maps/ixp4xx.c b/drivers/mtd/maps/ixp4xx.c
index a59f8027903c..986c58628390 100644
--- a/drivers/mtd/maps/ixp4xx.c
+++ b/drivers/mtd/maps/ixp4xx.c
@@ -1,5 +1,5 @@
 /*
- * $Id: ixp4xx.c,v 1.12 2005/11/07 11:14:27 gleixner Exp $
+ * $Id: ixp4xx.c,v 1.13 2005/11/16 16:23:21 dvrabel Exp $
  *
  * drivers/mtd/maps/ixp4xx.c
  *
@@ -34,10 +34,55 @@
 
 #include <linux/reboot.h>
 
+/*
+ * Read/write a 16 bit word from flash address 'addr'.
+ *
+ * When the cpu is in little-endian mode it swizzles the address lines
+ * ('address coherency') so we need to undo the swizzling to ensure commands
+ * and the like end up on the correct flash address.
+ *
+ * To further complicate matters, due to the way the expansion bus controller
+ * handles 32 bit reads, the byte stream ABCD is stored on the flash as:
+ *     D15    D0
+ *     +---+---+
+ *     | A | B | 0
+ *     +---+---+
+ *     | C | D | 2
+ *     +---+---+
+ * This means that on LE systems each 16 bit word must be swapped. Note that
+ * this requires CONFIG_MTD_CFI_BE_BYTE_SWAP to be enabled to 'unswap' the CFI
+ * data and other flash commands which are always in D7-D0.
+ */
 #ifndef __ARMEB__
+#ifndef CONFIG_MTD_CFI_BE_BYTE_SWAP
+#  error CONFIG_MTD_CFI_BE_BYTE_SWAP required
+#endif
+
+static inline u16 flash_read16(void __iomem *addr)
+{
+        return be16_to_cpu(__raw_readw((void __iomem *)((unsigned long)addr ^ 0x2)));
+}
+
+static inline void flash_write16(u16 d, void __iomem *addr)
+{
+        __raw_writew(cpu_to_be16(d), (void __iomem *)((unsigned long)addr ^ 0x2));
+}
+
 #define BYTE0(h)        ((h) & 0xFF)
 #define BYTE1(h)        (((h) >> 8) & 0xFF)
+
 #else
+
+static inline u16 flash_read16(const void __iomem *addr)
+{
+        return __raw_readw(addr);
+}
+
+static inline void flash_write16(u16 d, void __iomem *addr)
+{
+        __raw_writew(d, addr);
+}
+
 #define BYTE0(h)        (((h) >> 8) & 0xFF)
 #define BYTE1(h)        ((h) & 0xFF)
 #endif
@@ -45,7 +90,7 @@
 static map_word ixp4xx_read16(struct map_info *map, unsigned long ofs)
 {
         map_word val;
-        val.x[0] = le16_to_cpu(readw(map->virt + ofs));
+        val.x[0] = flash_read16(map->virt + ofs);
         return val;
 }
 
@@ -57,19 +102,28 @@ static map_word ixp4xx_read16(struct map_info *map, unsigned long ofs)
 static void ixp4xx_copy_from(struct map_info *map, void *to,
                              unsigned long from, ssize_t len)
 {
-        int i;
         u8 *dest = (u8 *) to;
         void __iomem *src = map->virt + from;
-        u16 data;
 
-        for (i = 0; i < (len / 2); i++) {
-                data = le16_to_cpu(readw(src + 2*i));
-                dest[i * 2] = BYTE0(data);
-                dest[i * 2 + 1] = BYTE1(data);
+        if (len <= 0)
+                return;
+
+        if (from & 1) {
+                *dest++ = BYTE1(flash_read16(src));
+                src++;
+                --len;
         }
 
-        if (len & 1)
-                dest[len - 1] = BYTE0(le16_to_cpu(readw(src + 2*i)));
+        while (len >= 2) {
+                u16 data = flash_read16(src);
+                *dest++ = BYTE0(data);
+                *dest++ = BYTE1(data);
+                src += 2;
+                len -= 2;
+        }
+
+        if (len > 0)
+                *dest++ = BYTE0(flash_read16(src));
 }
 
 /*
@@ -79,7 +133,7 @@ static void ixp4xx_copy_from(struct map_info *map, void *to,
 static void ixp4xx_probe_write16(struct map_info *map, map_word d, unsigned long adr)
 {
         if (!(adr & 1))
-                writew(cpu_to_le16(d.x[0]), map->virt + adr);
+                flash_write16(d.x[0], map->virt + adr);
 }
 
 /*
@@ -87,7 +141,7 @@ static void ixp4xx_probe_write16(struct map_info *map, map_word d, unsigned long
  */
 static void ixp4xx_write16(struct map_info *map, map_word d, unsigned long adr)
 {
-        writew(cpu_to_le16(d.x[0]), map->virt + adr);
+        flash_write16(d.x[0], map->virt + adr);
 }
 
 struct ixp4xx_flash_info {
diff --git a/drivers/mtd/maps/nettel.c b/drivers/mtd/maps/nettel.c
index f00ee7e54dba..632eb2aa968f 100644
--- a/drivers/mtd/maps/nettel.c
+++ b/drivers/mtd/maps/nettel.c
@@ -6,7 +6,7 @@
  *      (C) Copyright 2000-2001, Greg Ungerer (gerg@snapgear.com)
  *      (C) Copyright 2001-2002, SnapGear (www.snapgear.com)
  *
- *      $Id: nettel.c,v 1.11 2005/11/07 11:14:27 gleixner Exp $
+ *      $Id: nettel.c,v 1.12 2005/11/29 14:30:00 gleixner Exp $
  */
 
 /****************************************************************************/
@@ -479,7 +479,7 @@ void __exit nettel_cleanup(void)
         }
         if (nettel_intel_map.virt) {
                 iounmap(nettel_intel_map.virt);
-                nettel_intel_map.virt = 0;
+                nettel_intel_map.virt = NULL;
         }
 #endif
 }
diff --git a/drivers/mtd/maps/pci.c b/drivers/mtd/maps/pci.c
index 8b3570b09095..21822c2edbe4 100644
--- a/drivers/mtd/maps/pci.c
+++ b/drivers/mtd/maps/pci.c
@@ -7,7 +7,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  *
- *  $Id: pci.c,v 1.13 2005/11/07 11:14:27 gleixner Exp $
+ *  $Id: pci.c,v 1.14 2005/11/17 08:20:27 dwmw2 Exp $
  *
  * Generic PCI memory map driver.  We support the following boards:
  *  - Intel IQ80310 ATU.
@@ -102,7 +102,7 @@ static void mtd_pci_copyto(struct map_info *_map, unsigned long to, const void *
         memcpy_toio(map->base + map->translate(map, to), from, len);
 }
 
-static struct map_info mtd_pci_map = {
+static const struct map_info mtd_pci_map = {
         .phys =         NO_XIP,
         .copy_from =    mtd_pci_copyfrom,
         .copy_to =      mtd_pci_copyto,
diff --git a/drivers/mtd/maps/physmap.c b/drivers/mtd/maps/physmap.c
index 9ee760f97bc6..f49ebc3c4606 100644
--- a/drivers/mtd/maps/physmap.c
+++ b/drivers/mtd/maps/physmap.c
@@ -1,5 +1,5 @@
 /*
- * $Id: physmap.c,v 1.38 2005/11/07 11:14:28 gleixner Exp $
+ * $Id: physmap.c,v 1.39 2005/11/29 14:49:36 gleixner Exp $
  *
  * Normal mappings of chips in physical memory
  *
@@ -19,6 +19,7 @@
 #include <linux/mtd/map.h>
 #include <linux/config.h>
 #include <linux/mtd/partitions.h>
+#include <linux/mtd/physmap.h>
 
 static struct mtd_info *mymtd;
 
diff --git a/drivers/mtd/maps/sc520cdp.c b/drivers/mtd/maps/sc520cdp.c
index 6fb9f3c57aab..ed92afadd8a9 100644
--- a/drivers/mtd/maps/sc520cdp.c
+++ b/drivers/mtd/maps/sc520cdp.c
@@ -16,7 +16,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
  *
- * $Id: sc520cdp.c,v 1.22 2005/11/07 11:14:28 gleixner Exp $
+ * $Id: sc520cdp.c,v 1.23 2005/11/17 08:20:27 dwmw2 Exp $
  *
  *
  * The SC520CDP is an evaluation board for the Elan SC520 processor available
@@ -164,7 +164,7 @@ struct sc520_par_table
         unsigned long default_address;
 };
 
-static struct sc520_par_table par_table[NUM_FLASH_BANKS] =
+static const struct sc520_par_table par_table[NUM_FLASH_BANKS] =
 {
         {       /* Flash Bank #0: selected by ROMCS0 */
                 SC520_PAR_ROMCS0,
diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
index de4500395300..a0af92cc7efd 100644
--- a/drivers/mtd/nand/nandsim.c
+++ b/drivers/mtd/nand/nandsim.c
@@ -1486,7 +1486,7 @@ ns_nand_verify_buf(struct mtd_info *mtd, const u_char *buf, int len)
 /*
  * Module initialization function
  */
-int __init ns_init_module(void)
+static int __init ns_init_module(void)
 {
         struct nand_chip *chip;
         struct nandsim *nand;
diff --git a/drivers/mtd/rfd_ftl.c b/drivers/mtd/rfd_ftl.c
index 0ab8d29caeea..20ce212638fc 100644
--- a/drivers/mtd/rfd_ftl.c
+++ b/drivers/mtd/rfd_ftl.c
@@ -30,11 +30,9 @@ MODULE_PARM_DESC(block_size, "Block size to use by RFD, defaults to erase unit s
 
 #define PREFIX "rfd_ftl: "
 
-/* Major device # for FTL device */
-
-/* A request for this major has been sent to device@lanana.org */
+/* This major has been assigned by device@lanana.org */
 #ifndef RFD_FTL_MAJOR
-#define RFD_FTL_MAJOR           95
+#define RFD_FTL_MAJOR           256
 #endif
 
 /* Maximum number of partitions in an FTL region */
diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
index dfea346b00a5..f9792528e33f 100644
--- a/drivers/scsi/megaraid.c
+++ b/drivers/scsi/megaraid.c
@@ -380,23 +380,23 @@ megaraid_queue(Scsi_Cmnd *scmd, void (*done)(Scsi_Cmnd *))
 
         spin_lock_irqsave(&adapter->lock, flags);
         scb = mega_build_cmd(adapter, scmd, &busy);
+        if (!scb)
+                goto out;
 
-        if(scb) {
-                scb->state |= SCB_PENDQ;
-                list_add_tail(&scb->list, &adapter->pending_list);
+        scb->state |= SCB_PENDQ;
+        list_add_tail(&scb->list, &adapter->pending_list);
 
-                /*
-                 * Check if the HBA is in quiescent state, e.g., during a
-                 * delete logical drive opertion. If it is, don't run
-                 * the pending_list.
-                 */
-                if(atomic_read(&adapter->quiescent) == 0) {
-                        mega_runpendq(adapter);
-                }
-                return 0;
-        }
-        spin_unlock_irqrestore(&adapter->lock, flags);
+        /*
+         * Check if the HBA is in quiescent state, e.g., during a
+         * delete logical drive opertion. If it is, don't run
+         * the pending_list.
+         */
+        if (atomic_read(&adapter->quiescent) == 0)
+                mega_runpendq(adapter);
 
+        busy = 0;
+ out:
+        spin_unlock_irqrestore(&adapter->lock, flags);
         return busy;
 }
 
@@ -4677,7 +4677,6 @@ megaraid_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
 
         adapter->flag = flag;
         spin_lock_init(&adapter->lock);
-        scsi_assign_lock(host, &adapter->lock);
 
         host->cmd_per_lun = max_cmd_per_lun;
         host->max_sectors = max_sectors_per_io;
diff --git a/fs/exec.c b/fs/exec.c
index 1f8a9fd2c9ed..22533cce0611 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -306,9 +306,6 @@ void install_arg_page(struct vm_area_struct *vma,
                         struct page *page, unsigned long address)
 {
         struct mm_struct *mm = vma->vm_mm;
-        pgd_t * pgd;
-        pud_t * pud;
-        pmd_t * pmd;
         pte_t * pte;
         spinlock_t *ptl;
 
@@ -316,14 +313,7 @@ void install_arg_page(struct vm_area_struct *vma,
                 goto out;
 
         flush_dcache_page(page);
-        pgd = pgd_offset(mm, address);
-        pud = pud_alloc(mm, pgd, address);
-        if (!pud)
-                goto out;
-        pmd = pmd_alloc(mm, pud, address);
-        if (!pmd)
-                goto out;
-        pte = pte_alloc_map_lock(mm, pmd, address, &ptl);
+        pte = get_locked_pte(mm, address, &ptl);
         if (!pte)
                 goto out;
         if (!pte_none(*pte)) {
diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
index 543420665c5b..d0fcc5f3497e 100644
--- a/fs/jffs2/fs.c
+++ b/fs/jffs2/fs.c
@@ -234,6 +234,7 @@ void jffs2_read_inode (struct inode *inode)
         c = JFFS2_SB_INFO(inode->i_sb);
 
         jffs2_init_inode_info(f);
+        down(&f->sem);
 
         ret = jffs2_do_read_inode(c, f, inode->i_ino, &latest_node);
 
@@ -400,6 +401,7 @@ struct inode *jffs2_new_inode (struct inode *dir_i, int mode, struct jffs2_raw_i
 
         f = JFFS2_INODE_INFO(inode);
         jffs2_init_inode_info(f);
+        down(&f->sem);
 
         memset(ri, 0, sizeof(*ri));
         /* Set OS-specific defaults for new inodes */
diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
index 9e0b5458d9c0..93883817cbd0 100644
--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -51,7 +51,7 @@ static void jffs2_i_init_once(void * foo, kmem_cache_t * cachep, unsigned long f
 
         if ((flags & (SLAB_CTOR_VERIFY|SLAB_CTOR_CONSTRUCTOR)) ==
             SLAB_CTOR_CONSTRUCTOR) {
-                init_MUTEX_LOCKED(&ei->sem);
+                init_MUTEX(&ei->sem);
                 inode_init_once(&ei->vfs_inode);
         }
 }
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 6a75a7a78bf1..0e73f1539d08 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -163,6 +163,7 @@ extern unsigned int kobjsize(const void *objp);
 #define VM_HUGETLB      0x00400000      /* Huge TLB Page VM */
 #define VM_NONLINEAR    0x00800000      /* Is non-linear (remap_file_pages) */
 #define VM_MAPPED_COPY  0x01000000      /* T if mapped copy of data (nommu mmap) */
+#define VM_INCOMPLETE   0x02000000      /* Strange partial PFN mapping marker */
 
 #ifndef VM_STACK_DEFAULT_FLAGS          /* arch can override this */
 #define VM_STACK_DEFAULT_FLAGS VM_DATA_DEFAULT_FLAGS
@@ -741,6 +742,8 @@ struct shrinker;
 extern struct shrinker *set_shrinker(int, shrinker_t);
 extern void remove_shrinker(struct shrinker *shrinker);
 
+extern pte_t *FASTCALL(get_locked_pte(struct mm_struct *mm, unsigned long addr, spinlock_t **ptl));
+
 int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address);
 int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address);
 int __pte_alloc(struct mm_struct *mm, pmd_t *pmd, unsigned long address);
diff --git a/include/linux/mtd/cfi.h b/include/linux/mtd/cfi.h
index 3c9ea4b7adda..23a568910341 100644
--- a/include/linux/mtd/cfi.h
+++ b/include/linux/mtd/cfi.h
@@ -1,7 +1,7 @@
 
 /* Common Flash Interface structures
  * See http://support.intel.com/design/flash/technote/index.htm
- * $Id: cfi.h,v 1.56 2005/11/07 11:14:54 gleixner Exp $
+ * $Id: cfi.h,v 1.57 2005/11/15 23:28:17 tpoynor Exp $
  */
 
 #ifndef __MTD_CFI_H__
@@ -426,6 +426,22 @@ static inline uint8_t cfi_read_query(struct map_info *map, uint32_t addr)
         }
 }
 
+static inline uint16_t cfi_read_query16(struct map_info *map, uint32_t addr)
+{
+        map_word val = map_read(map, addr);
+
+        if (map_bankwidth_is_1(map)) {
+                return val.x[0] & 0xff;
+        } else if (map_bankwidth_is_2(map)) {
+                return cfi16_to_cpu(val.x[0]);
+        } else {
+                /* No point in a 64-bit byteswap since that would just be
+                   swapping the responses from different chips, and we are
+                   only interested in one chip (a representative sample) */
+                return cfi32_to_cpu(val.x[0]);
+        }
+}
+
 static inline void cfi_udelay(int us)
 {
         if (us >= 1000) {
diff --git a/mm/fremap.c b/mm/fremap.c
index f851775e09c2..9f381e58bf44 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -55,20 +55,10 @@ int install_page(struct mm_struct *mm, struct vm_area_struct *vma,
         pgoff_t size;
         int err = -ENOMEM;
         pte_t *pte;
-        pmd_t *pmd;
-        pud_t *pud;
-        pgd_t *pgd;
         pte_t pte_val;
         spinlock_t *ptl;
 
-        pgd = pgd_offset(mm, addr);
-        pud = pud_alloc(mm, pgd, addr);
-        if (!pud)
-                goto out;
-        pmd = pmd_alloc(mm, pud, addr);
-        if (!pmd)
-                goto out;
-        pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
+        pte = get_locked_pte(mm, addr, &ptl);
         if (!pte)
                 goto out;
 
@@ -110,20 +100,10 @@ int install_file_pte(struct mm_struct *mm, struct vm_area_struct *vma,
 {
         int err = -ENOMEM;
         pte_t *pte;
-        pmd_t *pmd;
-        pud_t *pud;
-        pgd_t *pgd;
         pte_t pte_val;
         spinlock_t *ptl;
 
-        pgd = pgd_offset(mm, addr);
-        pud = pud_alloc(mm, pgd, addr);
-        if (!pud)
-                goto out;
-        pmd = pmd_alloc(mm, pud, addr);
-        if (!pmd)
-                goto out;
-        pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
+        pte = get_locked_pte(mm, addr, &ptl);
         if (!pte)
                 goto out;
 
diff --git a/mm/memory.c b/mm/memory.c
index 9ab206b829a2..5bfa52a98630 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -988,7 +988,7 @@ int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                                 return i ? : -EFAULT;
                         }
                         if (pages) {
-                                struct page *page = vm_normal_page(vma, start, *pte);
+                                struct page *page = vm_normal_page(gate_vma, start, *pte);
                                 pages[i] = page;
                                 if (page)
                                         get_page(page);
@@ -1146,6 +1146,97 @@ int zeromap_page_range(struct vm_area_struct *vma,
         return err;
 }
 
+pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr, spinlock_t **ptl)
+{
+        pgd_t * pgd = pgd_offset(mm, addr);
+        pud_t * pud = pud_alloc(mm, pgd, addr);
+        if (pud) {
+                pmd_t * pmd = pmd_alloc(mm, pgd, addr);
+                if (pmd)
+                        return pte_alloc_map_lock(mm, pmd, addr, ptl);
+        }
+        return NULL;
+}
+
+/*
+ * This is the old fallback for page remapping.
+ *
+ * For historical reasons, it only allows reserved pages. Only
+ * old drivers should use this, and they needed to mark their
+ * pages reserved for the old functions anyway.
+ */
+static int insert_page(struct mm_struct *mm, unsigned long addr, struct page *page, pgprot_t prot)
+{
+        int retval;
+        pte_t *pte;
+        spinlock_t *ptl;  
+
+        retval = -EINVAL;
+        if (PageAnon(page) || !PageReserved(page))
+                goto out;
+        retval = -ENOMEM;
+        flush_dcache_page(page);
+        pte = get_locked_pte(mm, addr, &ptl);
+        if (!pte)
+                goto out;
+        retval = -EBUSY;
+        if (!pte_none(*pte))
+                goto out_unlock;
+
+        /* Ok, finally just insert the thing.. */
+        get_page(page);
+        inc_mm_counter(mm, file_rss);
+        page_add_file_rmap(page);
+        set_pte_at(mm, addr, pte, mk_pte(page, prot));
+
+        retval = 0;
+out_unlock:
+        pte_unmap_unlock(pte, ptl);
+out:
+        return retval;
+}
+
+/*
+ * Somebody does a pfn remapping that doesn't actually work as a vma.
+ *
+ * Do it as individual pages instead, and warn about it. It's bad form,
+ * and very inefficient.
+ */
+static int incomplete_pfn_remap(struct vm_area_struct *vma,
+                unsigned long start, unsigned long end,
+                unsigned long pfn, pgprot_t prot)
+{
+        static int warn = 10;
+        struct page *page;
+        int retval;
+
+        if (!(vma->vm_flags & VM_INCOMPLETE)) {
+                if (warn) {
+                        warn--;
+                        printk("%s does an incomplete pfn remapping", current->comm);
+                        dump_stack();
+                }
+        }
+        vma->vm_flags |= VM_INCOMPLETE | VM_IO | VM_RESERVED;
+
+        if (start < vma->vm_start || end > vma->vm_end)
+                return -EINVAL;
+
+        if (!pfn_valid(pfn))
+                return -EINVAL;
+
+        retval = 0;
+        page = pfn_to_page(pfn);
+        while (start < end) {
+                retval = insert_page(vma->vm_mm, start, page, prot);
+                if (retval < 0)
+                        break;
+                start += PAGE_SIZE;
+                page++;
+        }
+        return retval;
+}
+
 /*
  * maps a range of physical memory into the requested pages. the old
  * mappings are removed. any references to nonexistent pages results
@@ -1220,6 +1311,9 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
         struct mm_struct *mm = vma->vm_mm;
         int err;
 
+        if (addr != vma->vm_start || end != vma->vm_end)
+                return incomplete_pfn_remap(vma, addr, end, pfn, prot);
+
         /*
          * Physically remapped pages are special. Tell the
          * rest of the world about it:
@@ -1300,8 +1394,15 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
          */
         if (unlikely(!src)) {
                 void *kaddr = kmap_atomic(dst, KM_USER0);
-                unsigned long left = __copy_from_user_inatomic(kaddr, (void __user *)va, PAGE_SIZE);
-                if (left)
+                void __user *uaddr = (void __user *)(va & PAGE_MASK);
+
+                /*
+                 * This really shouldn't fail, because the page is there
+                 * in the page tables. But it might just be unreadable,
+                 * in which case we just give up and fill the result with
+                 * zeroes.
+                 */
+                if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE))
                         memset(kaddr, 0, PAGE_SIZE);
                 kunmap_atomic(kaddr, KM_USER0);
                 return;
@@ -1332,12 +1433,11 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 unsigned long address, pte_t *page_table, pmd_t *pmd,
                 spinlock_t *ptl, pte_t orig_pte)
 {
-        struct page *old_page, *src_page, *new_page;
+        struct page *old_page, *new_page;
         pte_t entry;
         int ret = VM_FAULT_MINOR;
 
         old_page = vm_normal_page(vma, address, orig_pte);
-        src_page = old_page;
         if (!old_page)
                 goto gotten;
 
@@ -1345,7 +1445,7 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 int reuse = can_share_swap_page(old_page);
                 unlock_page(old_page);
                 if (reuse) {
-                        flush_cache_page(vma, address, pfn);
+                        flush_cache_page(vma, address, pte_pfn(orig_pte));
                         entry = pte_mkyoung(orig_pte);
                         entry = maybe_mkwrite(pte_mkdirty(entry), vma);
                         ptep_set_access_flags(vma, address, page_table, entry, 1);
@@ -1365,7 +1465,7 @@ gotten:
 
         if (unlikely(anon_vma_prepare(vma)))
                 goto oom;
-        if (src_page == ZERO_PAGE(address)) {
+        if (old_page == ZERO_PAGE(address)) {
                 new_page = alloc_zeroed_user_highpage(vma, address);
                 if (!new_page)
                         goto oom;
@@ -1373,7 +1473,7 @@ gotten:
                 new_page = alloc_page_vma(GFP_HIGHUSER, vma, address);
                 if (!new_page)
                         goto oom;
-                cow_user_page(new_page, src_page, address);
+                cow_user_page(new_page, old_page, address);
         }
 
         /*
@@ -1389,7 +1489,7 @@ gotten:
                         }
                 } else
                         inc_mm_counter(mm, anon_rss);
-                flush_cache_page(vma, address, pfn);
+                flush_cache_page(vma, address, pte_pfn(orig_pte));
                 entry = mk_pte(new_page, vma->vm_page_prot);
                 entry = maybe_mkwrite(pte_mkdirty(entry), vma);
                 ptep_establish(vma, address, page_table, entry);
@@ -1909,6 +2009,8 @@ static int do_no_page(struct mm_struct *mm, struct vm_area_struct *vma,
         int anon = 0;
 
         pte_unmap(page_table);
+        BUG_ON(vma->vm_flags & VM_PFNMAP);
+
         if (vma->vm_file) {
                 mapping = vma->vm_file->f_mapping;
                 sequence = mapping->truncate_count;
@@ -1941,7 +2043,7 @@ retry:
                 page = alloc_page_vma(GFP_HIGHUSER, vma, address);
                 if (!page)
                         goto oom;
-                cow_user_page(page, new_page, address);
+                copy_user_highpage(page, new_page, address);
                 page_cache_release(new_page);
                 new_page = page;
                 anon = 1;
diff --git a/mm/rmap.c b/mm/rmap.c
index 491ac350048f..f853c6def159 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -641,7 +641,7 @@ static void try_to_unmap_cluster(unsigned long cursor,
                         continue;
 
                 /* Nuke the page table entry. */
-                flush_cache_page(vma, address, pfn);
+                flush_cache_page(vma, address, pte_pfn(*pte));
                 pteval = ptep_clear_flush(vma, address, pte);
 
                 /* If nonlinear, store the file page offset in the pte. */
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index a16064ba0caf..76ff9f4fe89d 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -985,6 +985,8 @@ int ipv6_dev_get_saddr(struct net_device *daddr_dev,
                         }
 
                         /* Rule 4: Prefer home address -- not implemented yet */
+                        if (hiscore.rule < 4)
+                                hiscore.rule++;
 
                         /* Rule 5: Prefer outgoing interface */
                         if (hiscore.rule < 5) {