## Automatically generated incremental diff
## From:   linux-2.4.26-rc2
## To:     linux-2.4.26-rc3
## Robot:  $Id: make-incremental-diff,v 1.12 2004/01/06 07:19:36 hpa Exp $

diff -urN linux-2.4.26-rc2/Makefile linux-2.4.26-rc3/Makefile
--- linux-2.4.26-rc2/Makefile	2004-04-12 12:31:05.000000000 -0700
+++ linux-2.4.26-rc3/Makefile	2004-04-12 12:31:09.000000000 -0700
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 4
 SUBLEVEL = 26
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
 
 KERNELRELEASE=$(VERSION).$(PATCHLEVEL).$(SUBLEVEL)$(EXTRAVERSION)
 
diff -urN linux-2.4.26-rc2/arch/alpha/lib/ev6-stxncpy.S linux-2.4.26-rc3/arch/alpha/lib/ev6-stxncpy.S
--- linux-2.4.26-rc2/arch/alpha/lib/ev6-stxncpy.S	2003-08-25 04:44:39.000000000 -0700
+++ linux-2.4.26-rc3/arch/alpha/lib/ev6-stxncpy.S	2004-04-12 12:31:10.000000000 -0700
@@ -365,7 +365,7 @@
 	andnot	t2, t6, t12	# E : dest mask for a single word copy
 	or	t8, t10, t5	# E : test for end-of-count too
 
-	cmpbge	zero, t2, t3	# E :
+	cmpbge	zero, t12, t3	# E :
 	cmoveq	a2, t5, t8	# E : Latency=2, extra map slot
 	nop			# E : keep with cmoveq
 	andnot	t8, t3, t8	# E : (stall)
diff -urN linux-2.4.26-rc2/arch/alpha/lib/stxncpy.S linux-2.4.26-rc3/arch/alpha/lib/stxncpy.S
--- linux-2.4.26-rc2/arch/alpha/lib/stxncpy.S	2003-08-25 04:44:39.000000000 -0700
+++ linux-2.4.26-rc3/arch/alpha/lib/stxncpy.S	2004-04-12 12:31:10.000000000 -0700
@@ -317,7 +317,7 @@
 	cmpbge	zero, t1, t8	# .. e1 : is there a zero?
 	andnot	t2, t6, t12	# e0    : dest mask for a single word copy
 	or	t8, t10, t5	# .. e1 : test for end-of-count too
-	cmpbge	zero, t2, t3	# e0    :
+	cmpbge	zero, t12, t3	# e0    :
 	cmoveq	a2, t5, t8	# .. e1 :
 	andnot	t8, t3, t8	# e0    :
 	beq	t8, $u_head	# .. e1 (zdb)
diff -urN linux-2.4.26-rc2/arch/x86_64/mm/k8topology.c linux-2.4.26-rc3/arch/x86_64/mm/k8topology.c
--- linux-2.4.26-rc2/arch/x86_64/mm/k8topology.c	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.26-rc3/arch/x86_64/mm/k8topology.c	2004-04-12 12:31:11.000000000 -0700
@@ -197,7 +197,7 @@
 			continue;		
 		if ((nodes_present >> rr) == 0) 
 			rr = 0; 
-		rr = ffz(~nodes_present >> rr); 
+		rr += ffz(~nodes_present >> rr); 
 		PLAT_NODE_DATA(i) = PLAT_NODE_DATA(rr); 
 		rr++; 
 	}
diff -urN linux-2.4.26-rc2/drivers/char/drm/r128_state.c linux-2.4.26-rc3/drivers/char/drm/r128_state.c
--- linux-2.4.26-rc2/drivers/char/drm/r128_state.c	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.26-rc3/drivers/char/drm/r128_state.c	2004-04-12 12:31:13.000000000 -0700
@@ -914,7 +914,7 @@
 
 	count = depth->n;
 	
-	if( count > 4096 )
+	if( count > 4096 || count <= 0)
 		return -EMSGSIZE;
 	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {
 		return -EFAULT;
@@ -1010,7 +1010,7 @@
 
 	count = depth->n;
 	
-	if( count > 4096 )
+	if( count > 4096 || count <= 0)
 		return -EMSGSIZE;
 
 	x = kmalloc( count * sizeof(*x), GFP_KERNEL );
@@ -1128,7 +1128,7 @@
 
 	count = depth->n;
 	
-	if ( count > 4096 )
+	if ( count > 4096 || count <= 0)
 		return -EMSGSIZE;
 	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {
 		return -EFAULT;
@@ -1172,6 +1172,9 @@
 	DRM_DEBUG( "%s\n", __FUNCTION__ );
 
 	count = depth->n;
+	if ( count > 4096 || count <= 0)
+		return -EMSGSIZE;
+
 	if ( count > dev_priv->depth_pitch ) {
 		count = dev_priv->depth_pitch;
 	}
diff -urN linux-2.4.26-rc2/drivers/char/drm-4.0/r128_state.c linux-2.4.26-rc3/drivers/char/drm-4.0/r128_state.c
--- linux-2.4.26-rc2/drivers/char/drm-4.0/r128_state.c	2002-02-25 11:37:57.000000000 -0800
+++ linux-2.4.26-rc3/drivers/char/drm-4.0/r128_state.c	2004-04-12 12:31:13.000000000 -0700
@@ -938,6 +938,9 @@
 	}
 
 	count = depth->n;
+
+	if (count > 4096 || count <= 0)
+		return -EMSGSIZE;
 	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {
 		return -EFAULT;
 	}
@@ -1048,6 +1051,9 @@
 
 	count = depth->n;
 
+	if (count > 4096 || count <= 0)
+		return -EMSGSIZE;
+
 	x = kmalloc( count * sizeof(*x), 0 );
 	if ( x == NULL ) {
 		return -ENOMEM;
@@ -1178,6 +1184,10 @@
 	}
 
 	count = depth->n;
+	
+	if (count > 4096 || count <= 0)
+		return -EMSGSIZE;
+
 	if ( copy_from_user( &x, depth->x, sizeof(x) ) ) {
 		return -EFAULT;
 	}
@@ -1235,6 +1245,8 @@
 	}
 
 	count = depth->n;
+	if (count > 4096 || count <= 0)
+		return -EMSGSIZE;
 	if ( count > dev_priv->depth_pitch ) {
 		count = dev_priv->depth_pitch;
 	}
diff -urN linux-2.4.26-rc2/drivers/net/sk_mca.c linux-2.4.26-rc3/drivers/net/sk_mca.c
--- linux-2.4.26-rc2/drivers/net/sk_mca.c	2001-10-16 21:56:29.000000000 -0700
+++ linux-2.4.26-rc3/drivers/net/sk_mca.c	2004-04-12 12:31:15.000000000 -0700
@@ -1048,13 +1048,13 @@
 		block.Mode &= ~LANCE_INIT_PROM;
 
 	if (dev->flags & IFF_ALLMULTI) {	/* get all multicasts */
-		memset(block.LAdrF, 8, 0xff);
+		memset(block.LAdrF, 0xff, sizeof(block.LAdrF));
 	} else {		/* get selected/no multicasts */
 
 		struct dev_mc_list *mptr;
 		int code;
 
-		memset(block.LAdrF, 8, 0x00);
+		memset(block.LAdrF, 0, sizeof(block.LAdrF));
 		for (mptr = dev->mc_list; mptr != NULL; mptr = mptr->next) {
 			code = GetHash(mptr->dmi_addr);
 			block.LAdrF[(code >> 3) & 7] |= 1 << (code & 7);
diff -urN linux-2.4.26-rc2/drivers/scsi/scsi_scan.c linux-2.4.26-rc3/drivers/scsi/scsi_scan.c
--- linux-2.4.26-rc2/drivers/scsi/scsi_scan.c	2004-04-12 12:31:06.000000000 -0700
+++ linux-2.4.26-rc3/drivers/scsi/scsi_scan.c	2004-04-12 12:31:15.000000000 -0700
@@ -176,6 +176,7 @@
 	{"HP", "NetRAID-4M", "*", BLIST_FORCELUN},
 	{"ADAPTEC", "AACRAID", "*", BLIST_FORCELUN},
 	{"ADAPTEC", "Adaptec 5400S", "*", BLIST_FORCELUN},
+	{"APPLE", "Xserve", "*", BLIST_SPARSELUN | BLIST_LARGELUN},
 	{"COMPAQ", "MSA1000", "*", BLIST_SPARSELUN | BLIST_LARGELUN | BLIST_NOSTARTONADD},
 	{"COMPAQ", "MSA1000 VOLUME", "*", BLIST_SPARSELUN | BLIST_LARGELUN | BLIST_NOSTARTONADD},
 	{"COMPAQ", "HSV110", "*", BLIST_SPARSELUN | BLIST_LARGELUN | BLIST_NOSTARTONADD},
diff -urN linux-2.4.26-rc2/drivers/usb/host/usb-ohci.c linux-2.4.26-rc3/drivers/usb/host/usb-ohci.c
--- linux-2.4.26-rc2/drivers/usb/host/usb-ohci.c	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.26-rc3/drivers/usb/host/usb-ohci.c	2004-04-12 12:31:16.000000000 -0700
@@ -104,10 +104,6 @@
 
 #define OHCI_UNLINK_TIMEOUT	(HZ / 10)
 
-static LIST_HEAD (ohci_hcd_list);
-static spinlock_t usb_ed_lock = SPIN_LOCK_UNLOCKED;
-
-
 /*-------------------------------------------------------------------------*/
 
 /* AMD-756 (D2 rev) reports corrupt register contents in some cases.
@@ -134,6 +130,57 @@
 /*-------------------------------------------------------------------------*
  * URB support functions 
  *-------------------------------------------------------------------------*/ 
+
+static void ohci_complete_add(struct ohci *ohci, struct urb *urb)
+{
+
+	if (urb->hcpriv != NULL) {
+		printk("completing with non-null priv!\n");
+		return;
+	}
+
+	if (ohci->complete_tail == NULL) {
+		ohci->complete_head = urb;
+		ohci->complete_tail = urb;
+	} else {
+		ohci->complete_head->hcpriv = urb;
+		ohci->complete_tail = urb;
+	}
+}
+
+static inline struct urb *ohci_complete_get(struct ohci *ohci)
+{
+	struct urb *urb;
+
+	if ((urb = ohci->complete_head) == NULL)
+		return NULL;
+	if (urb == ohci->complete_tail) {
+		ohci->complete_tail = NULL;
+		ohci->complete_head = NULL;
+	} else {
+		ohci->complete_head = urb->hcpriv;
+	}
+	urb->hcpriv = NULL;
+	return urb;
+}
+
+static inline void ohci_complete(struct ohci *ohci)
+{
+	struct urb *urb;
+
+	spin_lock(&ohci->ohci_lock);
+	while ((urb = ohci_complete_get(ohci)) != NULL) {
+		spin_unlock(&ohci->ohci_lock);
+		if (urb->dev) {
+			usb_dec_dev_use (urb->dev);
+			urb->dev = NULL;
+		}
+		if (urb->complete)
+			(*urb->complete)(urb);
+		spin_lock(&ohci->ohci_lock);
+	}
+	spin_unlock(&ohci->ohci_lock);
+}
  
 /* free HCD-private data associated with this URB */
 
@@ -209,20 +256,14 @@
 		}
 
 		urb_free_priv ((struct ohci *)urb->dev->bus->hcpriv, urb_priv);
-		usb_dec_dev_use (urb->dev);
-		urb->dev = NULL;
+	} else {
+		if (urb->dev != NULL) {
+			err ("Non-null dev at rm_priv time");
+			// urb->dev = NULL;
+		}
 	}
 }
 
-static void urb_rm_priv (struct urb * urb)
-{
-	unsigned long flags;
-
-	spin_lock_irqsave (&usb_ed_lock, flags);
-	urb_rm_priv_locked (urb);
-	spin_unlock_irqrestore (&usb_ed_lock, flags);
-}
-
 /*-------------------------------------------------------------------------*/
  
 #ifdef DEBUG
@@ -466,7 +507,6 @@
 {
 	urb_priv_t * urb_priv = urb->hcpriv;
 	struct urb * urbt;
-	unsigned long flags;
 	int i;
 	
 	if (!urb_priv)
@@ -474,7 +514,8 @@
 
 	/* just to be sure */
 	if (!urb->complete) {
-		urb_rm_priv (urb);
+		urb_rm_priv_locked (urb);
+		ohci_complete_add(hc, urb);	/* Just usb_dec_dev_use */
 		return -1;
 	}
 	
@@ -490,20 +531,18 @@
 				usb_pipeout (urb->pipe)
 					? PCI_DMA_TODEVICE
 					: PCI_DMA_FROMDEVICE);
-
 			if (urb->interval) {
 				urb->complete (urb);
- 
+
 				/* implicitly requeued */
 				urb->actual_length = 0;
 				urb->status = -EINPROGRESS;
 				td_submit_urb (urb);
 			} else {
-				urb_rm_priv(urb);
-				urb->complete (urb);
+				urb_rm_priv_locked (urb);
+				ohci_complete_add(hc, urb);
 			}
-   			break;
-
+  			break;
   			
 		case PIPE_ISOCHRONOUS:
 			for (urbt = urb->next; urbt && (urbt != urb); urbt = urbt->next);
@@ -515,7 +554,6 @@
 						? PCI_DMA_TODEVICE
 						: PCI_DMA_FROMDEVICE);
 				urb->complete (urb);
-				spin_lock_irqsave (&usb_ed_lock, flags);
 				urb->actual_length = 0;
   				urb->status = USB_ST_URB_PENDING;
   				urb->start_frame = urb_priv->ed->last_iso + 1;
@@ -526,18 +564,17 @@
   					}
   					td_submit_urb (urb);
   				}
-  				spin_unlock_irqrestore (&usb_ed_lock, flags);
-  				
+
   			} else { /* unlink URB, call complete */
-				urb_rm_priv (urb);
-				urb->complete (urb); 	
+				urb_rm_priv_locked (urb);
+				ohci_complete_add(hc, urb);
 			}		
 			break;
   				
 		case PIPE_BULK:
 		case PIPE_CONTROL: /* unlink URB, call complete */
-			urb_rm_priv (urb);
-			urb->complete (urb);	
+			urb_rm_priv_locked (urb);
+			ohci_complete_add(hc, urb);
 			break;
 	}
 	return 0;
@@ -574,20 +611,24 @@
 #ifdef DEBUG
 	urb_print (urb, "SUB", usb_pipein (pipe));
 #endif
-	
+
 	/* handle a request to the virtual root hub */
 	if (usb_pipedevice (pipe) == ohci->rh.devnum) 
 		return rh_submit_urb (urb);
-	
+
+	spin_lock_irqsave(&ohci->ohci_lock, flags);
+
 	/* when controller's hung, permit only roothub cleanup attempts
 	 * such as powering down ports */
 	if (ohci->disabled) {
+		spin_unlock_irqrestore(&ohci->ohci_lock, flags);
 		usb_dec_dev_use (urb->dev);	
 		return -ESHUTDOWN;
 	}
 
 	/* every endpoint has a ed, locate and fill it */
 	if (!(ed = ep_add_ed (urb->dev, pipe, urb->interval, 1, mem_flags))) {
+		spin_unlock_irqrestore(&ohci->ohci_lock, flags);
 		usb_dec_dev_use (urb->dev);	
 		return -ENOMEM;
 	}
@@ -609,6 +650,7 @@
 		case PIPE_ISOCHRONOUS: /* number of packets from URB */
 			size = urb->number_of_packets;
 			if (size <= 0) {
+				spin_unlock_irqrestore(&ohci->ohci_lock, flags);
 				usb_dec_dev_use (urb->dev);	
 				return -EINVAL;
 			}
@@ -628,8 +670,9 @@
 
 	/* allocate the private part of the URB */
 	urb_priv = kmalloc (sizeof (urb_priv_t) + size * sizeof (td_t *), 
-							in_interrupt() ? GFP_ATOMIC : GFP_NOIO);
+							GFP_ATOMIC);
 	if (!urb_priv) {
+		spin_unlock_irqrestore(&ohci->ohci_lock, flags);
 		usb_dec_dev_use (urb->dev);	
 		return -ENOMEM;
 	}
@@ -640,13 +683,12 @@
 	urb_priv->ed = ed;	
 
 	/* allocate the TDs (updating hash chains) */
-	spin_lock_irqsave (&usb_ed_lock, flags);
 	for (i = 0; i < size; i++) { 
 		urb_priv->td[i] = td_alloc (ohci, SLAB_ATOMIC);
 		if (!urb_priv->td[i]) {
 			urb_priv->length = i;
 			urb_free_priv (ohci, urb_priv);
-			spin_unlock_irqrestore (&usb_ed_lock, flags);
+			spin_unlock_irqrestore(&ohci->ohci_lock, flags);
 			usb_dec_dev_use (urb->dev);	
 			return -ENOMEM;
 		}
@@ -654,7 +696,7 @@
 
 	if (ed->state == ED_NEW || (ed->state & ED_DEL)) {
 		urb_free_priv (ohci, urb_priv);
-		spin_unlock_irqrestore (&usb_ed_lock, flags);
+		spin_unlock_irqrestore(&ohci->ohci_lock, flags);
 		usb_dec_dev_use (urb->dev);	
 		return -EINVAL;
 	}
@@ -676,7 +718,7 @@
 			}
 			if (bustime < 0) {
 				urb_free_priv (ohci, urb_priv);
-				spin_unlock_irqrestore (&usb_ed_lock, flags);
+				spin_unlock_irqrestore(&ohci->ohci_lock, flags);
 				usb_dec_dev_use (urb->dev);	
 				return bustime;
 			}
@@ -719,7 +761,7 @@
 	}
 #endif
 
-	spin_unlock_irqrestore (&usb_ed_lock, flags);
+	spin_unlock_irqrestore(&ohci->ohci_lock, flags);
 
 	return 0;	
 }
@@ -750,6 +792,7 @@
 	if (usb_pipedevice (urb->pipe) == ohci->rh.devnum)
 		return rh_unlink_urb (urb);
 
+	spin_lock_irqsave(&ohci->ohci_lock, flags);
 	if (urb->hcpriv && (urb->status == USB_ST_URB_PENDING)) { 
 		if (!ohci->disabled) {
 			urb_priv_t  * urb_priv;
@@ -759,6 +802,7 @@
 			 */
 			if (!(urb->transfer_flags & USB_ASYNC_UNLINK)
 					&& in_interrupt ()) {
+				spin_unlock_irqrestore(&ohci->ohci_lock, flags);
 				err ("bug in call from %p; use async!",
 					__builtin_return_address(0));
 				return -EWOULDBLOCK;
@@ -767,11 +811,10 @@
 			/* flag the urb and its TDs for deletion in some
 			 * upcoming SF interrupt delete list processing
 			 */
-			spin_lock_irqsave (&usb_ed_lock, flags);
 			urb_priv = urb->hcpriv;
 
 			if (!urb_priv || (urb_priv->state == URB_DEL)) {
-				spin_unlock_irqrestore (&usb_ed_lock, flags);
+				spin_unlock_irqrestore(&ohci->ohci_lock, flags);
 				return 0;
 			}
 				
@@ -786,7 +829,7 @@
 
 				add_wait_queue (&unlink_wakeup, &wait);
 				urb_priv->wait = &unlink_wakeup;
-				spin_unlock_irqrestore (&usb_ed_lock, flags);
+				spin_unlock_irqrestore(&ohci->ohci_lock, flags);
 
 				/* wait until all TDs are deleted */
 				set_current_state(TASK_UNINTERRUPTIBLE);
@@ -800,14 +843,22 @@
 					err ("unlink URB timeout");
 					return -ETIMEDOUT;
 				}
+
+				usb_dec_dev_use (urb->dev);
+				urb->dev = NULL;
+				if (urb->complete)
+					urb->complete (urb); 
 			} else {
 				/* usb_dec_dev_use done in dl_del_list() */
 				urb->status = -EINPROGRESS;
-				spin_unlock_irqrestore (&usb_ed_lock, flags);
+				spin_unlock_irqrestore(&ohci->ohci_lock, flags);
 				return -EINPROGRESS;
 			}
 		} else {
-			urb_rm_priv (urb);
+			urb_rm_priv_locked (urb);
+			spin_unlock_irqrestore(&ohci->ohci_lock, flags);
+			usb_dec_dev_use (urb->dev);
+			urb->dev = NULL;
 			if (urb->transfer_flags & USB_ASYNC_UNLINK) {
 				urb->status = -ECONNRESET;
 				if (urb->complete)
@@ -815,6 +866,8 @@
 			} else 
 				urb->status = -ENOENT;
 		}	
+	} else {
+		spin_unlock_irqrestore(&ohci->ohci_lock, flags);
 	}	
 	return 0;
 }
@@ -857,7 +910,7 @@
 		 * (freeing all the TDs, unlinking EDs) but we need
 		 * to defend against bugs that prevent that.
 		 */
-		spin_lock_irqsave (&usb_ed_lock, flags);	
+		spin_lock_irqsave(&ohci->ohci_lock, flags);	
 		for(i = 0; i < NUM_EDS; i++) {
   			ed = &(dev->ed[i]);
   			if (ed->state != ED_NEW) {
@@ -872,7 +925,7 @@
   				cnt++;
   			}
   		}
-  		spin_unlock_irqrestore (&usb_ed_lock, flags);
+  		spin_unlock_irqrestore(&ohci->ohci_lock, flags);
   		
 		/* if the controller is running, tds for those unlinked
 		 * urbs get freed by dl_del_list at the next SF interrupt
@@ -1206,17 +1259,12 @@
 	td_t * td;
 	ed_t * ed_ret;
 	volatile ed_t * ed; 
-	unsigned long flags;
- 	
- 	
-	spin_lock_irqsave (&usb_ed_lock, flags);
 
 	ed = ed_ret = &(usb_to_ohci (usb_dev)->ed[(usb_pipeendpoint (pipe) << 1) | 
 			(usb_pipecontrol (pipe)? 0: usb_pipeout (pipe))]);
 
 	if ((ed->state & ED_DEL) || (ed->state & ED_URB_DEL)) {
 		/* pending delete request */
-		spin_unlock_irqrestore (&usb_ed_lock, flags);
 		return NULL;
 	}
 	
@@ -1229,7 +1277,6 @@
 			/* out of memory */
 		        if (td)
 		            td_free(ohci, td);
-			spin_unlock_irqrestore (&usb_ed_lock, flags);
 			return NULL;
 		}
 		ed->hwTailP = cpu_to_le32 (td->td_dma);
@@ -1252,8 +1299,7 @@
   		ed->int_period = interval;
   		ed->int_load = load;
   	}
-  	
-	spin_unlock_irqrestore (&usb_ed_lock, flags);
+
 	return ed_ret; 
 }
 
@@ -1512,7 +1558,7 @@
 
 /* handle an urb that is being unlinked */
 
-static void dl_del_urb (struct urb * urb)
+static void dl_del_urb (ohci_t *ohci, struct urb * urb)
 {
 	wait_queue_head_t * wait_head = ((urb_priv_t *)(urb->hcpriv))->wait;
 
@@ -1520,12 +1566,9 @@
 
 	if (urb->transfer_flags & USB_ASYNC_UNLINK) {
 		urb->status = -ECONNRESET;
-		if (urb->complete)
-			urb->complete (urb);
+		ohci_complete_add(ohci, urb);
 	} else {
 		urb->status = -ENOENT;
-		if (urb->complete)
-			urb->complete (urb);
 
 		/* unblock sohci_unlink_urb */
 		if (wait_head)
@@ -1544,10 +1587,7 @@
 	td_t * td_rev = NULL;
 	td_t * td_list = NULL;
   	urb_priv_t * urb_priv = NULL;
-  	unsigned long flags;
-  	
-  	spin_lock_irqsave (&usb_ed_lock, flags);
-  	
+
 	td_list_hc = le32_to_cpup (&ohci->hcca->done_head) & 0xfffffff0;
 	ohci->hcca->done_head = 0;
 	
@@ -1573,7 +1613,6 @@
 		td_rev = td_list;
 		td_list_hc = le32_to_cpup (&td_list->hwNextTD) & 0xfffffff0;	
 	}	
-	spin_unlock_irqrestore (&usb_ed_lock, flags);
 	return td_list;
 }
 
@@ -1585,7 +1624,6 @@
  
 static void dl_del_list (ohci_t  * ohci, unsigned int frame)
 {
-	unsigned long flags;
 	ed_t * ed;
 	__u32 edINFO;
 	__u32 tdINFO;
@@ -1593,8 +1631,6 @@
 	__u32 * td_p;
 	int ctrl = 0, bulk = 0;
 
-	spin_lock_irqsave (&usb_ed_lock, flags);
-
 	for (ed = ohci->ed_rm_list[frame]; ed != NULL; ed = ed->ed_rm_list) {
 
 		tdTailP = dma_to_td (ohci, le32_to_cpup (&ed->hwTailP) & 0xfffffff0);
@@ -1615,7 +1651,7 @@
 
 				/* URB is done; clean up */
 				if (++(urb_priv->td_cnt) == urb_priv->length)
-					dl_del_urb (urb);
+					dl_del_urb (ohci, urb);
 			} else {
 				td_p = &td->hwNextTD;
 			}
@@ -1672,7 +1708,6 @@
 	}
 
    	ohci->ed_rm_list[frame] = NULL;
-   	spin_unlock_irqrestore (&usb_ed_lock, flags);
 }
 
 
@@ -1689,9 +1724,7 @@
 	struct urb * urb;
 	urb_priv_t * urb_priv;
  	__u32 tdINFO, edHeadP, edTailP;
- 	
- 	unsigned long flags;
- 	
+ 
   	while (td_list) {
    		td_list_next = td_list->next_dl_td;
    		
@@ -1720,13 +1753,10 @@
   				urb->status = cc_to_error[cc];
   				sohci_return_urb (ohci, urb);
   			} else {
-				spin_lock_irqsave (&usb_ed_lock, flags);
-  				dl_del_urb (urb);
-				spin_unlock_irqrestore (&usb_ed_lock, flags);
+  				dl_del_urb (ohci, urb);
 			}
   		}
   		
-  		spin_lock_irqsave (&usb_ed_lock, flags);
   		if (ed->state != ED_NEW) { 
   			edHeadP = le32_to_cpup (&ed->hwHeadP) & 0xfffffff0;
   			edTailP = le32_to_cpup (&ed->hwTailP);
@@ -1735,7 +1765,6 @@
      			if ((edHeadP == edTailP) && (ed->state == ED_OPER)) 
      				ep_unlink (ohci, ed);
      		}	
-     		spin_unlock_irqrestore (&usb_ed_lock, flags);
      	
     		td_list = td_list_next;
   	}  
@@ -1926,7 +1955,8 @@
 	int leni = urb->transfer_buffer_length;
 	int len = 0;
 	int status = TD_CC_NOERROR;
-	
+	unsigned long flags;
+
 	__u32 datab[4];
 	__u8  * data_buf = (__u8 *) datab;
 	
@@ -1935,13 +1965,16 @@
 	__u16 wIndex;
 	__u16 wLength;
 
+	spin_lock_irqsave(&ohci->ohci_lock, flags);
+
 	if (usb_pipeint(pipe)) {
 		ohci->rh.urb =  urb;
 		ohci->rh.send = 1;
 		ohci->rh.interval = urb->interval;
 		rh_init_int_timer(urb);
 		urb->status = cc_to_error [TD_CC_NOERROR];
-		
+
+		spin_unlock_irqrestore(&ohci->ohci_lock, flags);
 		return 0;
 	}
 
@@ -2113,6 +2146,7 @@
 #endif
 
 	urb->hcpriv = NULL;
+	spin_unlock_irqrestore(&ohci->ohci_lock, flags);
 	usb_dec_dev_use (usb_dev);
 	urb->dev = NULL;
 	if (urb->complete)
@@ -2125,13 +2159,16 @@
 static int rh_unlink_urb (struct urb * urb)
 {
 	ohci_t * ohci = urb->dev->bus->hcpriv;
+	unsigned int flags;
  
+	spin_lock_irqsave(&ohci->ohci_lock, flags);
 	if (ohci->rh.urb == urb) {
 		ohci->rh.send = 0;
 		del_timer (&ohci->rh.rh_int_timer);
 		ohci->rh.urb = NULL;
 
 		urb->hcpriv = NULL;
+		spin_unlock_irqrestore(&ohci->ohci_lock, flags);
 		usb_dec_dev_use(urb->dev);
 		urb->dev = NULL;
 		if (urb->transfer_flags & USB_ASYNC_UNLINK) {
@@ -2140,6 +2177,8 @@
 				urb->complete (urb);
 		} else
 			urb->status = -ENOENT;
+	} else {
+		spin_unlock_irqrestore(&ohci->ohci_lock, flags);
 	}
 	return 0;
 }
@@ -2283,7 +2322,7 @@
 
 static void check_timeouts (struct ohci *ohci)
 {
-	spin_lock (&usb_ed_lock);
+	spin_lock (&ohci->ohci_lock);
 	while (!list_empty (&ohci->timeout_list)) {
 		struct urb	*urb;
 
@@ -2296,15 +2335,15 @@
 			continue;
 
 		urb->transfer_flags |= USB_TIMEOUT_KILLED | USB_ASYNC_UNLINK;
-		spin_unlock (&usb_ed_lock);
+		spin_unlock (&ohci->ohci_lock);
 
 		// outside the interrupt handler (in a timer...)
 		// this reference would race interrupts
 		sohci_unlink_urb (urb);
 
-		spin_lock (&usb_ed_lock);
+		spin_lock (&ohci->ohci_lock);
 	}
-	spin_unlock (&usb_ed_lock);
+	spin_unlock (&ohci->ohci_lock);
 }
 
 
@@ -2318,6 +2357,8 @@
 	struct ohci_regs * regs = ohci->regs;
  	int ints; 
 
+	spin_lock (&ohci->ohci_lock);
+
 	/* avoid (slow) readl if only WDH happened */
 	if ((ohci->hcca->done_head != 0)
 			&& !(le32_to_cpup (&ohci->hcca->done_head) & 0x01)) {
@@ -2326,11 +2367,13 @@
 	/* cardbus/... hardware gone before remove() */
 	} else if ((ints = readl (&regs->intrstatus)) == ~(u32)0) {
 		ohci->disabled++;
+		spin_unlock (&ohci->ohci_lock);
 		err ("%s device removed!", ohci->ohci_dev->slot_name);
 		return;
 
 	/* interrupt for some other device? */
 	} else if ((ints &= readl (&regs->intrenable)) == 0) {
+		spin_unlock (&ohci->ohci_lock);
 		return;
 	} 
 
@@ -2381,6 +2424,13 @@
 		}
 	}
 
+	/*
+	 * Finally, we are done with trashing about our hardware lists
+	 * and other CPUs are allowed in. The festive flipping of the lock
+	 * ensues as we struggle with the check_timeouts disaster.
+	 */
+	spin_unlock (&ohci->ohci_lock);
+
 	if (!list_empty (&ohci->timeout_list)) {
 		check_timeouts (ohci);
 // FIXME:  enable SF as needed in a timer;
@@ -2393,6 +2443,8 @@
 	writel (ints, &regs->intrstatus);
 	writel (OHCI_INTR_MIE, &regs->intrenable);	
 	(void)readl (&regs->intrdisable); /* PCI posting flush */
+
+	ohci_complete(ohci);
 }
 
 /*-------------------------------------------------------------------------*/
@@ -2425,10 +2477,8 @@
 	ohci->ohci_dev = dev;
 	pci_set_drvdata(dev, ohci);
  
-	INIT_LIST_HEAD (&ohci->ohci_hcd_list);
-	list_add (&ohci->ohci_hcd_list, &ohci_hcd_list);
-
 	INIT_LIST_HEAD (&ohci->timeout_list);
+	spin_lock_init(&ohci->ohci_lock);
 
 	ohci->bus = usb_alloc_bus (&sohci_device_operations);
 	if (!ohci->bus) {
@@ -2472,9 +2522,6 @@
 		usb_free_bus (ohci->bus);
 	}
 
-	list_del (&ohci->ohci_hcd_list);
-	INIT_LIST_HEAD (&ohci->ohci_hcd_list);
-
 	ohci_mem_cleanup (ohci);
     
 	/* unmap the IO address space */
@@ -2720,12 +2767,12 @@
 	ohci->sleeping = 1;
 
 	/* First stop processing */
-  	spin_lock_irqsave (&usb_ed_lock, flags);
+  	spin_lock_irqsave (&ohci->ohci_lock, flags);
 	ohci->hc_control &= ~(OHCI_CTRL_PLE|OHCI_CTRL_CLE|OHCI_CTRL_BLE|OHCI_CTRL_IE);
 	writel (ohci->hc_control, &ohci->regs->control);
 	writel (OHCI_INTR_SF, &ohci->regs->intrstatus);
 	(void) readl (&ohci->regs->intrstatus);
-  	spin_unlock_irqrestore (&usb_ed_lock, flags);
+  	spin_unlock_irqrestore (&ohci->ohci_lock, flags);
 
 	/* Wait a frame or two */
 	mdelay(1);
@@ -2851,7 +2898,7 @@
 		mdelay (3);
 
 		/* Then re-enable operations */
-		spin_lock_irqsave (&usb_ed_lock, flags);
+		spin_lock_irqsave (&ohci->ohci_lock, flags);
 		ohci->disabled = 0;
 		ohci->sleeping = 0;
 		ohci->hc_control = OHCI_CONTROL_INIT | OHCI_USB_OPER;
@@ -2867,7 +2914,6 @@
 		/* Check for a pending done list */
 		writel (OHCI_INTR_WDH, &ohci->regs->intrdisable);	
 		(void) readl (&ohci->regs->intrdisable);
-		spin_unlock_irqrestore (&usb_ed_lock, flags);
 #ifdef CONFIG_PMAC_PBOOK
 		if (_machine == _MACH_Pmac)
 			enable_irq (ohci->irq);
@@ -2877,6 +2923,7 @@
 		writel (OHCI_INTR_WDH, &ohci->regs->intrenable); 
 		writel (OHCI_BLF, &ohci->regs->cmdstatus); /* start bulk list */
 		writel (OHCI_CLF, &ohci->regs->cmdstatus); /* start Control list */
+		spin_unlock_irqrestore (&ohci->ohci_lock, flags);
 		break;
 
 	default:
diff -urN linux-2.4.26-rc2/drivers/usb/host/usb-ohci.h linux-2.4.26-rc3/drivers/usb/host/usb-ohci.h
--- linux-2.4.26-rc2/drivers/usb/host/usb-ohci.h	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.26-rc3/drivers/usb/host/usb-ohci.h	2004-04-12 12:31:16.000000000 -0700
@@ -384,12 +384,12 @@
 #define OHCI_QUIRK_SUCKYIO	0x02		/* NSC superio */
 
 	struct ohci_regs * regs;	/* OHCI controller's memory */
-	struct list_head ohci_hcd_list;	/* list of all ohci_hcd */
 
 	struct list_head timeout_list;
 	// struct list_head urb_list; 	// list of all pending urbs
-	// spinlock_t urb_list_lock; 	// lock to keep consistency 
-  
+	spinlock_t ohci_lock;		/* Covers all fields up & down */
+	struct urb *complete_head, *complete_tail;
+
 	int ohci_int_load[32];		/* load of the 32 Interrupt Chains (for load balancing)*/
 	ed_t * ed_rm_list[2];     /* lists of all endpoints to be removed */
 	ed_t * ed_bulktail;       /* last endpoint of bulk list */
diff -urN linux-2.4.26-rc2/drivers/usb/serial/ftdi_sio.c linux-2.4.26-rc3/drivers/usb/serial/ftdi_sio.c
--- linux-2.4.26-rc2/drivers/usb/serial/ftdi_sio.c	2004-04-12 12:31:06.000000000 -0700
+++ linux-2.4.26-rc3/drivers/usb/serial/ftdi_sio.c	2004-04-12 12:31:16.000000000 -0700
@@ -1343,15 +1343,16 @@
 			/* drop RTS */
 			if (set_rts(port, LOW) < 0) {
 				err("Error from RTS LOW urb");
-			}	
-			/* shutdown our bulk read */
-			if (port->read_urb) {
-				usb_unlink_urb (port->read_urb);	
 			}
-			/* unlink the running write urbs */
-			
-
 		} /* Note change no line is hupcl is off */
+
+		/* shutdown our bulk read */
+		if (port->read_urb) {
+			if(usb_unlink_urb (port->read_urb)<0)
+				err("Error unlinking urb");
+		}
+		/* unlink the running write urbs */
+
 	} /* if (serial->dev) */
 
 
diff -urN linux-2.4.26-rc2/drivers/usb/storage/datafab.c linux-2.4.26-rc3/drivers/usb/storage/datafab.c
--- linux-2.4.26-rc2/drivers/usb/storage/datafab.c	2003-06-13 07:51:37.000000000 -0700
+++ linux-2.4.26-rc3/drivers/usb/storage/datafab.c	2004-04-12 12:31:16.000000000 -0700
@@ -695,20 +695,24 @@
 	}
 
 	if (srb->cmnd[0] == READ_CAPACITY) {
+		unsigned int max_sector;
+
 		info->ssize = 0x200;  // hard coded 512 byte sectors as per ATA spec
 		rc = datafab_id_device(us, info);
 		if (rc != USB_STOR_TRANSPORT_GOOD)
 			return rc;
 
-		US_DEBUGP("datafab_transport:  READ_CAPACITY:  %ld sectors, %ld bytes per sector\n",
+		US_DEBUGP("datafab_transport:  READ_CAPACITY:  "
+			  "%ld sectors, %ld bytes per sector\n",
 			  info->sectors, info->ssize);
 
 		// build the reply
 		//
-		ptr[0] = (info->sectors >> 24) & 0xFF;
-		ptr[1] = (info->sectors >> 16) & 0xFF;
-		ptr[2] = (info->sectors >> 8) & 0xFF;
-		ptr[3] = (info->sectors) & 0xFF;
+		max_sector = info->sectors - 1;
+		ptr[0] = (max_sector >> 24) & 0xFF;
+		ptr[1] = (max_sector >> 16) & 0xFF;
+		ptr[2] = (max_sector >> 8) & 0xFF;
+		ptr[3] = (max_sector) & 0xFF;
 
 		ptr[4] = (info->ssize >> 24) & 0xFF;
 		ptr[5] = (info->ssize >> 16) & 0xFF;
diff -urN linux-2.4.26-rc2/drivers/usb/storage/unusual_devs.h linux-2.4.26-rc3/drivers/usb/storage/unusual_devs.h
--- linux-2.4.26-rc2/drivers/usb/storage/unusual_devs.h	2004-04-12 12:31:06.000000000 -0700
+++ linux-2.4.26-rc3/drivers/usb/storage/unusual_devs.h	2004-04-12 12:31:16.000000000 -0700
@@ -249,7 +249,7 @@
 UNUSUAL_DEV(  0x054c, 0x0025, 0x0100, 0x0100, 
 		"Sony",
 		"Memorystick NW-MS7",
-		US_SC_UFI, US_PR_CB, NULL,
+		US_SC_DEVICE, US_PR_DEVICE, NULL,
 		US_FL_SINGLE_LUN ),
 
 #ifdef CONFIG_USB_STORAGE_ISD200
@@ -360,7 +360,7 @@
 UNUSUAL_DEV(  0x05dc, 0xb002, 0x0000, 0x0113,
 		"Lexar",
 		"USB CF Reader",
-		US_SC_SCSI, US_PR_BULK, NULL,
+		US_SC_DEVICE, US_PR_DEVICE, NULL,
 		US_FL_FIX_INQUIRY ),
 
 /* Reported by Carlos Villegas <cav@uniscope.co.jp>
diff -urN linux-2.4.26-rc2/drivers/usb/usbnet.c linux-2.4.26-rc3/drivers/usb/usbnet.c
--- linux-2.4.26-rc2/drivers/usb/usbnet.c	2003-11-28 10:26:20.000000000 -0800
+++ linux-2.4.26-rc3/drivers/usb/usbnet.c	2004-04-12 12:31:16.000000000 -0700
@@ -2594,7 +2594,11 @@
 	// Hawking UF200, TrendNet TU2-ET100
 	USB_DEVICE (0x07b8, 0x420a),
 	.driver_info =	(unsigned long) &hawking_uf200_info,
-}, 
+}, {
+	// ATEN UC210T
+	USB_DEVICE (0x0557, 0x2009),
+	.driver_info =  (unsigned long) &ax8817x_info,
+},
 #endif
 
 #ifdef	CONFIG_USB_BELKIN
@@ -2724,6 +2728,15 @@
 	.bInterfaceSubClass	= 0x0a,
 	.bInterfaceProtocol	= 0x00,
 	.driver_info =	(unsigned long) &zaurus_pxa_info,
+}, {
+	.match_flags	=   USB_DEVICE_ID_MATCH_INT_INFO
+			  | USB_DEVICE_ID_MATCH_DEVICE,
+	.idVendor		= 0x04DD,
+	.idProduct		= 0x9032, /* SL-6000 */
+	.bInterfaceClass	= 0x02,
+	.bInterfaceSubClass	= 0x0a,
+	.bInterfaceProtocol	= 0x00,
+	.driver_info =	(unsigned long) &zaurus_pxa_info,
 },
 #endif
 
diff -urN linux-2.4.26-rc2/drivers/usb/w9968cf.c linux-2.4.26-rc3/drivers/usb/w9968cf.c
--- linux-2.4.26-rc2/drivers/usb/w9968cf.c	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.26-rc3/drivers/usb/w9968cf.c	2004-04-12 12:31:16.000000000 -0700
@@ -2943,7 +2943,7 @@
 		return -ENODEV;
 	}
 
-	if (cam->users) {
+	while (cam->users) {
 		DBG(2, "%s (/dev/video%d) has been already occupied by '%s'.",
 		    symbolic(camlist, cam->id),cam->v4ldev->minor,cam->command)
 		if ((filp->f_flags & O_NONBLOCK)||(filp->f_flags & O_NDELAY)) {
@@ -3632,7 +3632,7 @@
 		if (copy_from_user(&tuner, arg, sizeof(tuner)))
 			return -EFAULT;
 
-		if (tuner.tuner != 0);
+		if (tuner.tuner != 0)
 			return -EINVAL;
 
 		strcpy(tuner.name, "no_tuner");
diff -urN linux-2.4.26-rc2/fs/binfmt_elf.c linux-2.4.26-rc3/fs/binfmt_elf.c
--- linux-2.4.26-rc2/fs/binfmt_elf.c	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.26-rc3/fs/binfmt_elf.c	2004-04-12 12:31:17.000000000 -0700
@@ -479,7 +479,8 @@
 		goto out_free_ph;
 		
 	files = current->files;		/* Refcounted so ok */
-	if(unshare_files() < 0)
+	retval = unshare_files();
+	if (retval < 0)
 		goto out_free_ph;
 	if (files == current->files) {
 		put_files_struct(files);
@@ -820,7 +821,8 @@
 	/* error cleanup */
 out_free_dentry:
 	allow_write_access(interpreter);
-	fput(interpreter);
+	if (interpreter)
+		fput(interpreter);
 out_free_interp:
 	if (elf_interpreter)
 		kfree(elf_interpreter);
diff -urN linux-2.4.26-rc2/fs/jfs/jfs_dmap.c linux-2.4.26-rc3/fs/jfs/jfs_dmap.c
--- linux-2.4.26-rc2/fs/jfs/jfs_dmap.c	2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.26-rc3/fs/jfs/jfs_dmap.c	2004-04-12 12:31:17.000000000 -0700
@@ -125,7 +125,7 @@
 		     s64 * results);
 static int dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno,
 		      s64 * results);
-int dbExtend(struct inode *ip, s64 blkno, s64 nblocks, s64 addnblocks);
+static int dbExtend(struct inode *ip, s64 blkno, s64 nblocks, s64 addnblocks);
 static int dbFindBits(u32 word, int l2nb);
 static int dbFindCtl(struct bmap * bmp, int l2nb, int level, s64 * blkno);
 static int dbFindLeaf(dmtree_t * tp, int l2nb, int *leafidx);
@@ -135,10 +135,10 @@
 		      int nblocks);
 static int dbMaxBud(u8 * cp);
 s64 dbMapFileSizeToMapSize(struct inode *ipbmap);
-int blkstol2(s64 nb);
+static int blkstol2(s64 nb);
 
-int cntlz(u32 value);
-int cnttz(u32 word);
+static int cntlz(u32 value);
+static int cnttz(u32 word);
 
 static int dbAllocDmapBU(struct bmap * bmp, struct dmap * dp, s64 blkno,
 			 int nblocks);
@@ -156,7 +156,7 @@
  * into the table, with the table elements yielding the maximum
  * binary buddy of free bits within the character.
  */
-signed char budtab[256] = {
+static s8 budtab[256] = {
 	3, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
 	2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
 	2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
@@ -943,7 +943,7 @@
 	return (rc);
 }
 
-
+#ifdef _NOTYET
 /*
  * NAME:	dbAllocExact()
  *
@@ -1010,7 +1010,7 @@
 
 	return (rc);
 }
-
+#endif /* _NOTYET */
 
 /*
  * NAME:	dbReAlloc()
@@ -1093,7 +1093,7 @@
  *      -ENOSPC	- insufficient disk resources
  *      -EIO	- i/o error
  */
-int dbExtend(struct inode *ip, s64 blkno, s64 nblocks, s64 addnblocks)
+static int dbExtend(struct inode *ip, s64 blkno, s64 nblocks, s64 addnblocks)
 {
 	struct jfs_sb_info *sbi = JFS_SBI(ip->i_sb);
 	s64 lblkno, lastblkno, extblkno;
@@ -1527,6 +1527,7 @@
 			if (n == 4) {
 				jfs_error(bmp->db_ipbmap->i_sb,
 					  "dbAllocAG: failed descending stree");
+				release_metapage(mp);
 				return -EIO;
 			}
 		}
@@ -3023,7 +3024,7 @@
  * RETURN VALUES:
  *      count of trailing zeros
  */
-int cnttz(u32 word)
+static int cnttz(u32 word)
 {
 	int n;
 
@@ -3048,7 +3049,7 @@
  * RETURN VALUES:
  *      count of leading zeros
  */
-int cntlz(u32 value)
+static int cntlz(u32 value)
 {
 	int n;
 
@@ -3311,7 +3312,7 @@
 	int i, i0 = TRUE, j, j0 = TRUE, k, n;
 	s64 newsize;
 	s64 p;
-	struct metapage *mp, *l2mp, *l1mp, *l0mp;
+	struct metapage *mp, *l2mp, *l1mp = NULL, *l0mp = NULL;
 	struct dmapctl *l2dcp, *l1dcp, *l0dcp;
 	struct dmap *dp;
 	s8 *l0leaf, *l1leaf, *l2leaf;
@@ -3514,6 +3515,7 @@
 			 */
 			*l1leaf = dbInitDmapCtl(l0dcp, 0, ++i);
 			write_metapage(l0mp);
+			l0mp = NULL;
 
 			if (nblocks)
 				l1leaf++;	/* continue for next L0 */
@@ -3537,6 +3539,7 @@
 		 */
 		*l2leaf = dbInitDmapCtl(l1dcp, 1, ++j);
 		write_metapage(l1mp);
+		l1mp = NULL;
 
 		if (nblocks)
 			l2leaf++;	/* continue for next L1 */
@@ -3555,17 +3558,20 @@
 
 	jfs_error(ipbmap->i_sb,
 		  "dbExtendFS: function has not returned as expected");
+errout:
+	if (l0mp)
+		release_metapage(l0mp);
+	if (l1mp)
+		release_metapage(l1mp);
+	release_metapage(l2mp);
 	return -EIO;
 
 	/*
 	 *      finalize bmap control page
 	 */
-      finalize:
+finalize:
 
 	return 0;
-
-      errout:
-	return -EIO;
 }
 
 
diff -urN linux-2.4.26-rc2/fs/jfs/jfs_dmap.h linux-2.4.26-rc3/fs/jfs/jfs_dmap.h
--- linux-2.4.26-rc2/fs/jfs/jfs_dmap.h	2002-11-28 15:53:15.000000000 -0800
+++ linux-2.4.26-rc3/fs/jfs/jfs_dmap.h	2004-04-12 12:31:17.000000000 -0700
@@ -286,8 +286,6 @@
 
 extern int dbAlloc(struct inode *ipbmap, s64 hint, s64 nblocks, s64 * results);
 
-extern int dbAllocExact(struct inode *ip, s64 blkno, int nblocks);
-
 extern int dbReAlloc(struct inode *ipbmap,
 		     s64 blkno, s64 nblocks, s64 addnblocks, s64 * results);
 
diff -urN linux-2.4.26-rc2/fs/jfs/jfs_dtree.c linux-2.4.26-rc3/fs/jfs/jfs_dtree.c
--- linux-2.4.26-rc2/fs/jfs/jfs_dtree.c	2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.26-rc3/fs/jfs/jfs_dtree.c	2004-04-12 12:31:17.000000000 -0700
@@ -162,9 +162,6 @@
 static int dtDeleteUp(tid_t tid, struct inode *ip, struct metapage * fmp,
 		      dtpage_t * fp, struct btstack * btstack);
 
-static int dtSearchNode(struct inode *ip,
-			s64 lmxaddr, pxd_t * kpxd, struct btstack * btstack);
-
 static int dtRelink(tid_t tid, struct inode *ip, dtpage_t * p);
 
 static int dtReadFirst(struct inode *ip, struct btstack * btstack);
@@ -1426,8 +1423,10 @@
 	 */
 	if (nextbn != 0) {
 		DT_GETPAGE(ip, nextbn, mp, PSIZE, p, rc);
-		if (rc)
+		if (rc) {
+			discard_metapage(rmp);
 			return rc;
+		}
 
 		BT_MARK_DIRTY(mp, ip);
 		/*
@@ -2238,8 +2237,10 @@
 	pxdlock->index = 1;
 
 	/* update sibling pointers */
-	if ((rc = dtRelink(tid, ip, fp)))
+	if ((rc = dtRelink(tid, ip, fp))) {
+		BT_PUTPAGE(fmp);
 		return rc;
+	}
 
 	xlen = lengthPXD(&fp->header.self);
 	ip->i_blocks -= LBLK2PBLK(ip->i_sb, xlen);
@@ -2310,8 +2311,10 @@
 				pxdlock->index = 1;
 
 				/* update sibling pointers */
-				if ((rc = dtRelink(tid, ip, p)))
+				if ((rc = dtRelink(tid, ip, p))) {
+					DT_PUTPAGE(mp);
 					return rc;
+				}
 
 				xlen = lengthPXD(&p->header.self);
 				ip->i_blocks -= LBLK2PBLK(ip->i_sb, xlen);
@@ -2380,7 +2383,7 @@
 	return 0;
 }
 
-
+#ifdef _NOTYET
 /*
  * NAME:        dtRelocate()
  *
@@ -2575,7 +2578,6 @@
 	return rc;
 }
 
-
 /*
  * NAME:	dtSearchNode()
  *
@@ -2625,8 +2627,10 @@
 		/*
 		 * descend down to leftmost child page
 		 */
-		if (p->header.flag & BT_LEAF)
+		if (p->header.flag & BT_LEAF) {
+			DT_PUTPAGE(mp);
 			return -ESTALE;
+		}
 
 		/* get the leftmost entry */
 		stbl = DT_GETSTBL(p);
@@ -2677,7 +2681,7 @@
 
 	goto loop;
 }
-
+#endif /* _NOTYET */
 
 /*
  *	dtRelink()
@@ -2933,7 +2937,7 @@
 /*
  * function to determine next variable-sized jfs_dirent in buffer
  */
-inline struct jfs_dirent *next_jfs_dirent(struct jfs_dirent *dirent)
+static inline struct jfs_dirent *next_jfs_dirent(struct jfs_dirent *dirent)
 {
 	return (struct jfs_dirent *)
 		((char *)dirent +
diff -urN linux-2.4.26-rc2/fs/jfs/jfs_dtree.h linux-2.4.26-rc3/fs/jfs/jfs_dtree.h
--- linux-2.4.26-rc2/fs/jfs/jfs_dtree.h	2002-11-28 15:53:15.000000000 -0800
+++ linux-2.4.26-rc3/fs/jfs/jfs_dtree.h	2004-04-12 12:31:17.000000000 -0700
@@ -265,9 +265,6 @@
 extern int dtDelete(tid_t tid, struct inode *ip, struct component_name * key,
 		    ino_t * data, int flag);
 
-extern int dtRelocate(tid_t tid,
-		      struct inode *ip, s64 lmxaddr, pxd_t * opxd, s64 nxaddr);
-
 extern int dtModify(tid_t tid, struct inode *ip, struct component_name * key,
 		    ino_t * orig_ino, ino_t new_ino, int flag);
 
diff -urN linux-2.4.26-rc2/fs/jfs/jfs_extent.c linux-2.4.26-rc3/fs/jfs/jfs_extent.c
--- linux-2.4.26-rc2/fs/jfs/jfs_extent.c	2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.26-rc3/fs/jfs/jfs_extent.c	2004-04-12 12:31:17.000000000 -0700
@@ -35,7 +35,6 @@
 /*
  * external references
  */
-extern int dbExtend(struct inode *, s64, s64, s64);
 extern int jfs_commit_inode(struct inode *, int);
 
 
diff -urN linux-2.4.26-rc2/fs/jfs/jfs_imap.c linux-2.4.26-rc3/fs/jfs/jfs_imap.c
--- linux-2.4.26-rc2/fs/jfs/jfs_imap.c	2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.26-rc3/fs/jfs/jfs_imap.c	2004-04-12 12:31:17.000000000 -0700
@@ -1552,6 +1552,7 @@
 						 0);
 				if (rem >= INOSPEREXT) {
 					IREAD_UNLOCK(ipimap);
+					release_metapage(mp);
 					AG_UNLOCK(imap, agno);
 					jfs_error(ip->i_sb,
 						  "diAlloc: can't find free bit "
@@ -1846,6 +1847,7 @@
 	 */
 	if (!iagp->nfreeinos) {
 		IREAD_UNLOCK(imap->im_ipimap);
+		release_metapage(mp);
 		jfs_error(ip->i_sb,
 			  "diAllocIno: nfreeinos = 0, but iag on freelist");
 		return -EIO;
@@ -1857,6 +1859,7 @@
 	for (sword = 0;; sword++) {
 		if (sword >= SMAPSZ) {
 			IREAD_UNLOCK(imap->im_ipimap);
+			release_metapage(mp);
 			jfs_error(ip->i_sb,
 				  "diAllocIno: free inode not found in summary map");
 			return -EIO;
@@ -1872,6 +1875,7 @@
 	rem = diFindFree(le32_to_cpu(iagp->inosmap[sword]), 0);
 	if (rem >= EXTSPERSUM) {
 		IREAD_UNLOCK(imap->im_ipimap);
+		release_metapage(mp);
 		jfs_error(ip->i_sb, "diAllocIno: no free extent found");
 		return -EIO;
 	}
@@ -1882,6 +1886,7 @@
 	rem = diFindFree(le32_to_cpu(iagp->wmap[extno]), 0);
 	if (rem >= INOSPEREXT) {
 		IREAD_UNLOCK(imap->im_ipimap);
+		release_metapage(mp);
 		jfs_error(ip->i_sb, "diAllocIno: free inode not found");
 		return -EIO;
 	}
@@ -2847,12 +2852,14 @@
 		 * and should be free in persistent map;
 		 */
 		if (!(le32_to_cpu(iagp->wmap[extno]) & mask)) {
+			release_metapage(mp);
 			jfs_error(ipimap->i_sb,
 				  "diUpdatePMap: the inode is not allocated in "
 				  "the working map");
 			return -EIO;
 		}
 		if ((le32_to_cpu(iagp->pmap[extno]) & mask) != 0) {
+			release_metapage(mp);
 			jfs_error(ipimap->i_sb,
 				  "diUpdatePMap: the inode is not free in the "
 				  "persistent map");
diff -urN linux-2.4.26-rc2/fs/jfs/jfs_logmgr.c linux-2.4.26-rc3/fs/jfs/jfs_logmgr.c
--- linux-2.4.26-rc2/fs/jfs/jfs_logmgr.c	2004-04-12 12:31:07.000000000 -0700
+++ linux-2.4.26-rc3/fs/jfs/jfs_logmgr.c	2004-04-12 12:31:17.000000000 -0700
@@ -185,6 +185,7 @@
 static void lbmIODone(struct buffer_head *bh, int);
 static void lbmStartIO(struct lbuf * bp);
 static void lmGCwrite(struct jfs_log * log, int cant_block);
+static int lmLogSync(struct jfs_log * log, int nosyncwait);
 
 
 /*
@@ -799,7 +800,7 @@
  * NOTE:
  *	This routine is called a interrupt time by lbmIODone
  */
-void lmPostGC(struct lbuf * bp)
+static void lmPostGC(struct lbuf * bp)
 {
 	unsigned long flags;
 	struct jfs_log *log = bp->l_log;
@@ -922,7 +923,7 @@
  *			
  * serialization: LOG_LOCK() held on entry/exit
  */
-int lmLogSync(struct jfs_log * log, int nosyncwait)
+static int lmLogSync(struct jfs_log * log, int nosyncwait)
 {
 	int logsize;
 	int written;		/* written since last syncpt */
diff -urN linux-2.4.26-rc2/fs/jfs/jfs_logmgr.h linux-2.4.26-rc3/fs/jfs/jfs_logmgr.h
--- linux-2.4.26-rc2/fs/jfs/jfs_logmgr.h	2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.26-rc3/fs/jfs/jfs_logmgr.h	2004-04-12 12:31:17.000000000 -0700
@@ -509,7 +509,6 @@
 
 extern int lmLogOpen(struct super_block *sb, struct jfs_log ** log);
 extern int lmLogClose(struct super_block *sb, struct jfs_log * log);
-extern int lmLogSync(struct jfs_log * log, int nosyncwait);
 extern int lmLogShutdown(struct jfs_log * log);
 extern int lmLogInit(struct jfs_log * log);
 extern int lmLogFormat(struct jfs_log *log, s64 logAddress, int logSize);
diff -urN linux-2.4.26-rc2/fs/jfs/jfs_txnmgr.c linux-2.4.26-rc3/fs/jfs/jfs_txnmgr.c
--- linux-2.4.26-rc2/fs/jfs/jfs_txnmgr.c	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.26-rc3/fs/jfs/jfs_txnmgr.c	2004-04-12 12:31:17.000000000 -0700
@@ -167,25 +167,23 @@
 /*
  * forward references
  */
-int diLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
-	  struct tlock * tlck, struct commit * cd);
-int dataLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
-	    struct tlock * tlck);
-void dtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
-	   struct tlock * tlck);
-void inlineLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
-	       struct tlock * tlck);
-void mapLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
-	    struct tlock * tlck);
+static int diLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
+		struct tlock * tlck, struct commit * cd);
+static int dataLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
+		struct tlock * tlck);
+static void dtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
+		struct tlock * tlck);
+static void mapLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
+		struct tlock * tlck);
 static void txAbortCommit(struct commit * cd);
 static void txAllocPMap(struct inode *ip, struct maplock * maplock,
-			struct tblock * tblk);
-void txForce(struct tblock * tblk);
-static int txLog(struct jfs_log * log, struct tblock * tblk, struct commit * cd);
-int txMoreLock(void);
+		struct tblock * tblk);
+static void txForce(struct tblock * tblk);
+static int txLog(struct jfs_log * log, struct tblock * tblk,
+		struct commit * cd);
 static void txUpdateMap(struct tblock * tblk);
 static void txRelease(struct tblock * tblk);
-void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
+static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
 	   struct tlock * tlck);
 static void LogSyncRelease(struct metapage * mp);
 
@@ -1338,9 +1336,6 @@
 		lrd->log.redopage.fileset = cpu_to_le32(JFS_IP(ip)->fileset);
 		lrd->log.redopage.inode = cpu_to_le32(ip->i_ino);
 
-		if (tlck->mp)
-			hold_metapage(tlck->mp, 0);
-
 		/* write log record of page from the tlock */
 		switch (tlck->type & tlckTYPE) {
 		case tlckXTREE:
@@ -1366,8 +1361,6 @@
 		default:
 			jfs_err("UFO tlock:0x%p", tlck);
 		}
-		if (tlck->mp)
-			release_metapage(tlck->mp);
 	}
 
 	return rc;
@@ -1379,7 +1372,7 @@
  *
  * function:    log inode tlock and format maplock to update bmap;
  */
-int diLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
+static int diLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
 	  struct tlock * tlck, struct commit * cd)
 {
 	int rc = 0;
@@ -1494,7 +1487,7 @@
  *
  * function:    log data tlock
  */
-int dataLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
+static int dataLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
 	    struct tlock * tlck)
 {
 	struct metapage *mp;
@@ -1517,6 +1510,7 @@
 		 * the last entry, so don't bother logging this
 		 */
 		mp->lid = 0;
+		hold_metapage(mp, 0);
 		atomic_dec(&mp->nohomeok);
 		discard_metapage(mp);
 		tlck->mp = 0;
@@ -1540,7 +1534,7 @@
  *
  * function:    log dtree tlock and format maplock to update bmap;
  */
-void dtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
+static void dtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
 	   struct tlock * tlck)
 {
 	struct metapage *mp;
@@ -1645,7 +1639,7 @@
  *
  * function:    log xtree tlock and format maplock to update bmap;
  */
-void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
+static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
 	   struct tlock * tlck)
 {
 	struct inode *ip;
@@ -2705,7 +2699,7 @@
  *	allocation maps are updated in order.  For synchronous transactions,
  *	let the user thread finish processing after txUpdateMap() is called.
  */
-void txLazyCommit(struct tblock * tblk)
+static void txLazyCommit(struct tblock * tblk)
 {
 	struct jfs_log *log;
 
@@ -2987,11 +2981,12 @@
 					    anon_inode_list);
 			ip = jfs_ip->inode;
 
-			/*
-			 * down_trylock returns 0 on success.  This is
-			 * inconsistent with spin_trylock.
-			 */
-			if (! down_trylock(&jfs_ip->commit_sem)) {
+			if (! igrab(ip)) {
+				/*
+				 * Inode is being freed
+				 */
+				list_del_init(&jfs_ip->anon_inode_list);
+			} else if (! down_trylock(&jfs_ip->commit_sem)) {
 				/*
 				 * inode will be removed from anonymous list
 				 * when it is committed
@@ -3001,6 +2996,8 @@
 				rc = txCommit(tid, 1, &ip, 0);
 				txEnd(tid);
 				up(&jfs_ip->commit_sem);
+
+				iput(ip);
 				/*
 				 * Just to be safe.  I don't know how
 				 * long we can run without blocking
@@ -3020,6 +3017,10 @@
 				/* Put on anon_list2 */
 				list_add(&jfs_ip->anon_inode_list,
 					 &TxAnchor.anon_list2);
+
+				TXN_UNLOCK();
+				iput(ip);
+				TXN_LOCK();
 			}
 		}
 		/* Add anon_list2 back to anon_list */
diff -urN linux-2.4.26-rc2/fs/jfs/jfs_unicode.c linux-2.4.26-rc3/fs/jfs/jfs_unicode.c
--- linux-2.4.26-rc2/fs/jfs/jfs_unicode.c	2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.26-rc3/fs/jfs/jfs_unicode.c	2004-04-12 12:31:17.000000000 -0700
@@ -56,8 +56,8 @@
  * FUNCTION:	Convert character string to unicode string
  *
  */
-int jfs_strtoUCS(wchar_t * to,
-		 const char *from, int len, struct nls_table *codepage)
+static int jfs_strtoUCS(wchar_t * to, const char *from, int len,
+		struct nls_table *codepage)
 {
 	int charlen;
 	int i;
diff -urN linux-2.4.26-rc2/fs/jfs/jfs_xtree.c linux-2.4.26-rc3/fs/jfs/jfs_xtree.c
--- linux-2.4.26-rc2/fs/jfs/jfs_xtree.c	2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.26-rc3/fs/jfs/jfs_xtree.c	2004-04-12 12:31:17.000000000 -0700
@@ -1032,11 +1032,11 @@
 	rc = (sp->header.flag & BT_ROOT) ?
 	    xtSplitRoot(tid, ip, split, &rmp) :
 	    xtSplitPage(tid, ip, split, &rmp, &rbn);
-	if (rc)
-		return -EIO;
 
 	XT_PUTPAGE(smp);
 
+	if (rc)
+		return -EIO;
 	/*
 	 * propagate up the router entry for the leaf page just split
 	 *
@@ -1611,14 +1611,16 @@
 	/* there must exist extent to be extended */
 	if ((rc = xtSearch(ip, xoff - 1, &cmp, &btstack, XT_INSERT)))
 		return rc;
+
+	/* retrieve search result */
+	XT_GETSEARCH(ip, btstack.top, bn, mp, p, index);
+
 	if (cmp != 0) {
+		XT_PUTPAGE(mp);
 		jfs_error(ip->i_sb, "xtExtend: xtSearch did not find extent");
 		return -EIO;
 	}
 
-	/* retrieve search result */
-	XT_GETSEARCH(ip, btstack.top, bn, mp, p, index);
-
 	/* extension must be contiguous */
 	xad = &p->xad[index];
 	if ((offsetXAD(xad) + lengthXAD(xad)) != xoff) {
@@ -1677,25 +1679,27 @@
 		 * resides on the new child page;
 		 */
 		if (rootsplit) {
-			if (p->header.nextindex ==
-			    cpu_to_le16(XTENTRYSTART + 1)) {
-				xad = &p->xad[XTENTRYSTART];
-				bn = addressXAD(xad);
-
-				/* get new child page */
-				XT_GETPAGE(ip, bn, mp, PSIZE, p, rc);
-
-				BT_MARK_DIRTY(mp, ip);
-				if (!test_cflag(COMMIT_Nolink, ip)) {
-					tlck = txLock(tid, ip, mp,
-						      tlckXTREE |
-						      tlckGROW);
-					xtlck = (struct xtlock *) & tlck->lock;
-				}
+			ASSERT(p->header.nextindex ==
+			       cpu_to_le16(XTENTRYSTART + 1));
+			xad = &p->xad[XTENTRYSTART];
+			bn = addressXAD(xad);
+
+			/* get new child page */
+			XT_GETPAGE(ip, bn, mp, PSIZE, p, rc);
+			if (rc)
+				return rc;
+
+			BT_MARK_DIRTY(mp, ip);
+			if (!test_cflag(COMMIT_Nolink, ip)) {
+				tlck = txLock(tid, ip, mp, tlckXTREE|tlckGROW);
+				xtlck = (struct xtlock *) & tlck->lock;
 			}
-		} else
+		} else {
 			/* get back old page */
 			XT_GETPAGE(ip, bn, mp, PSIZE, p, rc);
+			if (rc)
+				return rc;
+		}
 	}
 	/*
 	 *      insert the new entry into the leaf page
@@ -1736,7 +1740,7 @@
 	return rc;
 }
 
-
+#ifdef _NOTYET
 /*
  *      xtTailgate()
  *
@@ -1778,14 +1782,16 @@
 	/* there must exist extent to be tailgated */
 	if ((rc = xtSearch(ip, xoff, &cmp, &btstack, XT_INSERT)))
 		return rc;
+
+	/* retrieve search result */
+	XT_GETSEARCH(ip, btstack.top, bn, mp, p, index);
+
 	if (cmp != 0) {
+		XT_PUTPAGE(mp);
 		jfs_error(ip->i_sb, "xtTailgate: couldn't find extent");
 		return -EIO;
 	}
 
-	/* retrieve search result */
-	XT_GETSEARCH(ip, btstack.top, bn, mp, p, index);
-
 	/* entry found must be last entry */
 	nextindex = le16_to_cpu(p->header.nextindex);
 	if (index != nextindex - 1) {
@@ -1843,25 +1849,27 @@
 		 * resides on the new child page;
 		 */
 		if (rootsplit) {
-			if (p->header.nextindex ==
-			    cpu_to_le16(XTENTRYSTART + 1)) {
-				xad = &p->xad[XTENTRYSTART];
-				bn = addressXAD(xad);
-
-				/* get new child page */
-				XT_GETPAGE(ip, bn, mp, PSIZE, p, rc);
-
-				BT_MARK_DIRTY(mp, ip);
-				if (!test_cflag(COMMIT_Nolink, ip)) {
-					tlck = txLock(tid, ip, mp,
-						      tlckXTREE |
-						      tlckGROW);
-					xtlck = (struct xtlock *) & tlck->lock;
-				}
+			ASSERT(p->header.nextindex ==
+			       cpu_to_le16(XTENTRYSTART + 1));
+			xad = &p->xad[XTENTRYSTART];
+			bn = addressXAD(xad);
+
+			/* get new child page */
+			XT_GETPAGE(ip, bn, mp, PSIZE, p, rc);
+			if (rc)
+				return rc;
+
+			BT_MARK_DIRTY(mp, ip);
+			if (!test_cflag(COMMIT_Nolink, ip)) {
+				tlck = txLock(tid, ip, mp, tlckXTREE|tlckGROW);
+				xtlck = (struct xtlock *) & tlck->lock;
 			}
-		} else
+		} else {
 			/* get back old page */
 			XT_GETPAGE(ip, bn, mp, PSIZE, p, rc);
+			if (rc)
+				return rc;
+		}
 	}
 	/*
 	 *      insert the new entry into the leaf page
@@ -1918,7 +1926,7 @@
 
 	return rc;
 }
-
+#endif /* _NOTYET */
 
 /*
  *      xtUpdate()
@@ -1960,14 +1968,15 @@
 	if ((rc = xtSearch(ip, nxoff, &cmp, &btstack, XT_INSERT)))
 		return rc;
 
+	/* retrieve search result */
+	XT_GETSEARCH(ip, btstack.top, bn, mp, p, index0);
+
 	if (cmp != 0) {
+		XT_PUTPAGE(mp);
 		jfs_error(ip->i_sb, "xtUpdate: Could not find extent");
 		return -EIO;
 	}
 
-	/* retrieve search result */
-	XT_GETSEARCH(ip, btstack.top, bn, mp, p, index0);
-
 	BT_MARK_DIRTY(mp, ip);
 	/*
 	 * acquire tlock of the leaf page containing original entry
@@ -2175,25 +2184,26 @@
 		 * resides on the new child page;
 		 */
 		if (rootsplit) {
-			if (p->header.nextindex ==
-			    cpu_to_le16(XTENTRYSTART + 1)) {
-				xad = &p->xad[XTENTRYSTART];
-				bn = addressXAD(xad);
-
-				/* get new child page */
-				XT_GETPAGE(ip, bn, mp, PSIZE, p, rc);
-
-				BT_MARK_DIRTY(mp, ip);
-				if (!test_cflag(COMMIT_Nolink, ip)) {
-					tlck = txLock(tid, ip, mp,
-						      tlckXTREE |
-						      tlckGROW);
-					xtlck = (struct xtlock *) & tlck->lock;
-				}
+			ASSERT(p->header.nextindex ==
+			       cpu_to_le16(XTENTRYSTART + 1));
+			xad = &p->xad[XTENTRYSTART];
+			bn = addressXAD(xad);
+
+			/* get new child page */
+			XT_GETPAGE(ip, bn, mp, PSIZE, p, rc);
+			if (rc)
+				return rc;
+
+			BT_MARK_DIRTY(mp, ip);
+			if (!test_cflag(COMMIT_Nolink, ip)) {
+				tlck = txLock(tid, ip, mp, tlckXTREE|tlckGROW);
+				xtlck = (struct xtlock *) & tlck->lock;
 			}
 		} else {
 			/* get back old page */
 			XT_GETPAGE(ip, bn, mp, PSIZE, p, rc);
+			if (rc)
+				return rc;
 
 			/* is nXAD on new page ? */
 			if (newindex >
@@ -2247,6 +2257,8 @@
 
 		/* get new right page */
 		XT_GETPAGE(ip, bn, mp, PSIZE, p, rc);
+		if (rc)
+			return rc;
 
 		BT_MARK_DIRTY(mp, ip);
 		if (!test_cflag(COMMIT_Nolink, ip)) {
@@ -2270,13 +2282,16 @@
 
 		if ((rc = xtSearch(ip, nxoff, &cmp, &btstack, XT_INSERT)))
 			return rc;
+
+		/* retrieve search result */
+		XT_GETSEARCH(ip, btstack.top, bn, mp, p, index0);
+
 		if (cmp != 0) {
+			XT_PUTPAGE(mp);
 			jfs_error(ip->i_sb, "xtUpdate: xtSearch failed");
 			return -EIO;
 		}
 
-		/* retrieve search result */
-		XT_GETSEARCH(ip, btstack.top, bn, mp, p, index0);
 		if (index0 != index) {
 			XT_PUTPAGE(mp);
 			jfs_error(ip->i_sb,
@@ -2325,25 +2340,27 @@
 		 * resides on the new child page;
 		 */
 		if (rootsplit) {
-			if (p->header.nextindex ==
-			    cpu_to_le16(XTENTRYSTART + 1)) {
-				xad = &p->xad[XTENTRYSTART];
-				bn = addressXAD(xad);
-
-				/* get new child page */
-				XT_GETPAGE(ip, bn, mp, PSIZE, p, rc);
-
-				BT_MARK_DIRTY(mp, ip);
-				if (!test_cflag(COMMIT_Nolink, ip)) {
-					tlck = txLock(tid, ip, mp,
-						      tlckXTREE |
-						      tlckGROW);
-					xtlck = (struct xtlock *) & tlck->lock;
-				}
+			ASSERT(p->header.nextindex ==
+			       cpu_to_le16(XTENTRYSTART + 1));
+			xad = &p->xad[XTENTRYSTART];
+			bn = addressXAD(xad);
+
+			/* get new child page */
+			XT_GETPAGE(ip, bn, mp, PSIZE, p, rc);
+			if (rc)
+				return rc;
+
+			BT_MARK_DIRTY(mp, ip);
+			if (!test_cflag(COMMIT_Nolink, ip)) {
+				tlck = txLock(tid, ip, mp, tlckXTREE|tlckGROW);
+				xtlck = (struct xtlock *) & tlck->lock;
 			}
-		} else
+		} else {
 			/* get back old page */
 			XT_GETPAGE(ip, bn, mp, PSIZE, p, rc);
+			if (rc)
+				return rc;
+		}
 	} else {
 		/* if insert into middle, shift right remaining entries */
 		if (newindex < nextindex)
@@ -2660,8 +2677,10 @@
 	/*
 	 * free non-root leaf page
 	 */
-	if ((rc = xtRelink(tid, ip, fp)))
+	if ((rc = xtRelink(tid, ip, fp))) {
+		XT_PUTPAGE(fmp);
 		return rc;
+	}
 
 	xaddr = addressPXD(&fp->header.self);
 	xlen = lengthPXD(&fp->header.self);
@@ -2703,7 +2722,7 @@
 				p->header.nextindex =
 				    cpu_to_le16(XTENTRYSTART);
 
-				/* XT_PUTPAGE(fmp); */
+				/* XT_PUTPAGE(mp); */
 
 				break;
 			} else {
@@ -2717,7 +2736,7 @@
 				       (s64) JFS_SBI(ip->i_sb)->nbperpage);
 
 				/* unpin/free the buffer page */
-				discard_metapage(fmp);
+				discard_metapage(mp);
 
 				/* propagate up */
 				continue;
@@ -2826,14 +2845,15 @@
 		rc = xtSearch(ip, xoff, &cmp, &btstack, 0);
 		if (rc)
 			return rc;
+
+		/* retrieve search result */
+		XT_GETSEARCH(ip, btstack.top, bn, pmp, pp, index);
+
 		if (cmp) {
 			XT_PUTPAGE(pmp);
 			return -ESTALE;
 		}
 
-		/* retrieve search result */
-		XT_GETSEARCH(ip, btstack.top, bn, pmp, pp, index);
-
 		/* validate for exact match with a single entry */
 		xad = &pp->xad[index];
 		if (addressXAD(xad) != oxaddr || lengthXAD(xad) != xlen) {
@@ -2846,14 +2866,15 @@
 		rc = xtSearchNode(ip, oxad, &cmp, &btstack, 0);
 		if (rc)
 			return rc;
+
+		/* retrieve search result */
+		XT_GETSEARCH(ip, btstack.top, bn, pmp, pp, index);
+
 		if (cmp) {
 			XT_PUTPAGE(pmp);
 			return -ESTALE;
 		}
 
-		/* retrieve search result */
-		XT_GETSEARCH(ip, btstack.top, bn, pmp, pp, index);
-
 		/* xtSearchNode() validated for exact match with a single entry
 		 */
 		xad = &pp->xad[index];
@@ -2927,7 +2948,9 @@
 		}
 
 		/* get back parent page */
-		rc = xtSearch(ip, xoff, &cmp, &btstack, 0);
+		if ((rc = xtSearch(ip, xoff, &cmp, &btstack, 0)))
+			return rc;
+
 		XT_GETSEARCH(ip, btstack.top, bn, pmp, pp, index);
 		jfs_info("xtRelocate: target data extent relocated.");
 	} else {		/* (xtype  == XTPAGE) */
@@ -3150,8 +3173,10 @@
 		XT_GETPAGE(ip, bn, mp, PSIZE, p, rc);
 		if (rc)
 			return rc;
-		if (p->header.flag & BT_LEAF)
+		if (p->header.flag & BT_LEAF) {
+			XT_PUTPAGE(mp);
 			return -ESTALE;
+		}
 
 		lim = le16_to_cpu(p->header.nextindex) - XTENTRYSTART;
 
@@ -3949,12 +3974,15 @@
 		rc = xtSearch(ip, xoff, &cmp, &btstack, 0);
 		if (rc)
 			return rc;
+
+		XT_GETSEARCH(ip, btstack.top, bn, mp, p, index);
+
 		if (cmp != 0) {
+			XT_PUTPAGE(mp);
 			jfs_error(ip->i_sb,
 				  "xtTruncate_pmap: did not find extent");
 			return -EIO;
 		}
-		XT_GETSEARCH(ip, btstack.top, bn, mp, p, index);
 	} else {
 		/*
 		 * start with root
@@ -4202,17 +4230,10 @@
 int xtDisplayPage(struct inode *ip, s64 bn, xtpage_t * p)
 {
 	int rc = 0;
-	struct metapage *mp;
 	xad_t *xad;
 	s64 xaddr, xoff;
 	int xlen, i, j;
 
-	if (p == NULL) {
-		XT_GETPAGE(ip, bn, mp, PSIZE, p, rc);
-		if (rc)
-			return rc;
-	}
-
 	/* display page control */
 	printf("bn:0x%lx flag:0x%x nextindex:%d\n",
 	       (ulong) bn, p->header.flag,
diff -urN linux-2.4.26-rc2/fs/jfs/jfs_xtree.h linux-2.4.26-rc3/fs/jfs/jfs_xtree.h
--- linux-2.4.26-rc2/fs/jfs/jfs_xtree.h	2002-11-28 15:53:15.000000000 -0800
+++ linux-2.4.26-rc3/fs/jfs/jfs_xtree.h	2004-04-12 12:31:17.000000000 -0700
@@ -117,8 +117,10 @@
 		    int xflag, s64 xoff, int xlen, s64 * xaddrp, int flag);
 extern int xtExtend(tid_t tid, struct inode *ip, s64 xoff, int xlen,
 		    int flag);
+#ifdef _NOTYET
 extern int xtTailgate(tid_t tid, struct inode *ip,
 		      s64 xoff, int xlen, s64 xaddr, int flag);
+#endif
 extern int xtUpdate(tid_t tid, struct inode *ip, struct xad *nxad);
 extern int xtDelete(tid_t tid, struct inode *ip, s64 xoff, int xlen,
 		    int flag);
diff -urN linux-2.4.26-rc2/fs/jfs/namei.c linux-2.4.26-rc3/fs/jfs/namei.c
--- linux-2.4.26-rc2/fs/jfs/namei.c	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.26-rc3/fs/jfs/namei.c	2004-04-12 12:31:17.000000000 -0700
@@ -42,7 +42,7 @@
 struct inode_operations jfs_dir_inode_operations;
 struct file_operations jfs_dir_operations;
 
-s64 commitZeroLink(tid_t, struct inode *);
+static s64 commitZeroLink(tid_t, struct inode *);
 
 /*
  * NAME:	jfs_create(dip, dentry, mode)
@@ -57,7 +57,7 @@
  * RETURN:	Errors from subroutines
  *
  */
-int jfs_create(struct inode *dip, struct dentry *dentry, int mode)
+static int jfs_create(struct inode *dip, struct dentry *dentry, int mode)
 {
 	int rc = 0;
 	tid_t tid;		/* transaction id */
@@ -172,7 +172,7 @@
  * note:
  * EACCESS: user needs search+write permission on the parent directory
  */
-int jfs_mkdir(struct inode *dip, struct dentry *dentry, int mode)
+static int jfs_mkdir(struct inode *dip, struct dentry *dentry, int mode)
 {
 	int rc = 0;
 	tid_t tid;		/* transaction id */
@@ -300,7 +300,7 @@
  * but the directory is not removed until the last reference to 
  * the directory is released (cf.unlink() of regular file).
  */
-int jfs_rmdir(struct inode *dip, struct dentry *dentry)
+static int jfs_rmdir(struct inode *dip, struct dentry *dentry)
 {
 	int rc;
 	tid_t tid;		/* transaction id */
@@ -423,7 +423,7 @@
  * JFS does NOT support unlink() on directories.
  *
  */
-int jfs_unlink(struct inode *dip, struct dentry *dentry)
+static int jfs_unlink(struct inode *dip, struct dentry *dentry)
 {
 	int rc;
 	tid_t tid;		/* transaction id */
@@ -576,7 +576,7 @@
  *
  * RETURN:	Errors from subroutines
  */
-s64 commitZeroLink(tid_t tid, struct inode *ip)
+static s64 commitZeroLink(tid_t tid, struct inode *ip)
 {
 	int filetype;
 	struct tblock *tblk;
@@ -744,7 +744,7 @@
  * EXDEV: target object and new link are on different file systems and
  * implementation does not support links between file systems [XPG4.2].
  */
-int jfs_link(struct dentry *old_dentry,
+static int jfs_link(struct dentry *old_dentry,
 	     struct inode *dir, struct dentry *dentry)
 {
 	int rc;
@@ -832,7 +832,8 @@
  * an intermediate result whose length exceeds PATH_MAX [XPG4.2]
 */
 
-int jfs_symlink(struct inode *dip, struct dentry *dentry, const char *name)
+static int jfs_symlink(struct inode *dip, struct dentry *dentry,
+		const char *name)
 {
 	int rc;
 	tid_t tid;
@@ -1033,7 +1034,7 @@
  *
  * FUNCTION:    rename a file or directory
  */
-int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+static int jfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 	       struct inode *new_dir, struct dentry *new_dentry)
 {
 	struct btstack btstack;
@@ -1303,7 +1304,8 @@
  *
  * FUNCTION:    Create a special file (device)
  */
-int jfs_mknod(struct inode *dir, struct dentry *dentry, int mode, int rdev)
+static int jfs_mknod(struct inode *dir, struct dentry *dentry,
+		     int mode, int rdev)
 {
 	struct btstack btstack;
 	struct component_name dname;
diff -urN linux-2.4.26-rc2/fs/jfs/super.c linux-2.4.26-rc3/fs/jfs/super.c
--- linux-2.4.26-rc2/fs/jfs/super.c	2004-04-12 12:31:07.000000000 -0700
+++ linux-2.4.26-rc3/fs/jfs/super.c	2004-04-12 12:31:17.000000000 -0700
@@ -265,7 +265,7 @@
 	return 0;
 }
 
-int jfs_remount(struct super_block *sb, int *flags, char *data)
+static int jfs_remount(struct super_block *sb, int *flags, char *data)
 {
 	s64 newLVSize = 0;
 	int rc = 0;
diff -urN linux-2.4.26-rc2/include/linux/compiler.h linux-2.4.26-rc3/include/linux/compiler.h
--- linux-2.4.26-rc2/include/linux/compiler.h	2001-09-18 14:12:45.000000000 -0700
+++ linux-2.4.26-rc3/include/linux/compiler.h	2004-04-12 12:31:18.000000000 -0700
@@ -13,4 +13,18 @@
 #define likely(x)	__builtin_expect((x),1)
 #define unlikely(x)	__builtin_expect((x),0)
 
+#if __GNUC__ > 3
+#define __attribute_used__	__attribute((__used__))
+#elif __GNUC__ == 3
+#if  __GNUC_MINOR__ >= 3
+# define __attribute_used__	__attribute__((__used__))
+#else
+# define __attribute_used__	__attribute__((__unused__))
+#endif /* __GNUC_MINOR__ >= 3 */
+#elif __GNUC__ == 2
+#define __attribute_used__	__attribute__((__unused__))
+#else
+#define __attribute_used__	/* not implemented */
+#endif /* __GNUC__ */
+
 #endif /* __LINUX_COMPILER_H */
diff -urN linux-2.4.26-rc2/include/linux/init.h linux-2.4.26-rc3/include/linux/init.h
--- linux-2.4.26-rc2/include/linux/init.h	2001-12-21 09:42:03.000000000 -0800
+++ linux-2.4.26-rc3/include/linux/init.h	2004-04-12 12:31:18.000000000 -0700
@@ -2,6 +2,7 @@
 #define _LINUX_INIT_H
 
 #include <linux/config.h>
+#include <linux/compiler.h>
 
 /* These macros are used to mark some functions or 
  * initialized data (doesn't apply to uninitialized data)
@@ -51,7 +52,7 @@
 extern initcall_t __initcall_start, __initcall_end;
 
 #define __initcall(fn)								\
-	static initcall_t __initcall_##fn __init_call = fn
+	static initcall_t __initcall_##fn __attribute_used__ __init_call = fn
 #define __exitcall(fn)								\
 	static exitcall_t __exitcall_##fn __exit_call = fn
 
@@ -67,7 +68,7 @@
 
 #define __setup(str, fn)								\
 	static char __setup_str_##fn[] __initdata = str;				\
-	static struct kernel_param __setup_##fn __attribute__((unused)) __initsetup = { __setup_str_##fn, fn }
+	static struct kernel_param __setup_##fn __attribute_used__ __initsetup = { __setup_str_##fn, fn }
 
 #endif /* __ASSEMBLY__ */
 
@@ -76,12 +77,12 @@
  * or exit time.
  */
 #define __init		__attribute__ ((__section__ (".text.init")))
-#define __exit		__attribute__ ((unused, __section__(".text.exit")))
+#define __exit		__attribute_used__ __attribute__ (( __section__(".text.exit")))
 #define __initdata	__attribute__ ((__section__ (".data.init")))
-#define __exitdata	__attribute__ ((unused, __section__ (".data.exit")))
-#define __initsetup	__attribute__ ((unused,__section__ (".setup.init")))
-#define __init_call	__attribute__ ((unused,__section__ (".initcall.init")))
-#define __exit_call	__attribute__ ((unused,__section__ (".exitcall.exit")))
+#define __exitdata	__attribute_used__ __attribute__ ((__section__ (".data.exit")))
+#define __initsetup	__attribute_used__ __attribute__ ((__section__ (".setup.init")))
+#define __init_call	__attribute_used__ __attribute__ ((__section__ (".initcall.init")))
+#define __exit_call	__attribute_used__ __attribute__ ((__section__ (".exitcall.exit")))
 
 /* For assembly routines */
 #define __INIT		.section	".text.init","ax"
diff -urN linux-2.4.26-rc2/include/linux/module.h linux-2.4.26-rc3/include/linux/module.h
--- linux-2.4.26-rc2/include/linux/module.h	2002-08-02 17:39:45.000000000 -0700
+++ linux-2.4.26-rc3/include/linux/module.h	2004-04-12 12:31:18.000000000 -0700
@@ -254,9 +254,9 @@
  */
 #define MODULE_GENERIC_TABLE(gtype,name)	\
 static const unsigned long __module_##gtype##_size \
-  __attribute__ ((unused)) = sizeof(struct gtype##_id); \
+  __attribute_used__ = sizeof(struct gtype##_id); \
 static const struct gtype##_id * __module_##gtype##_table \
-  __attribute__ ((unused)) = name
+  __attribute_used__ = name
 
 /*
  * The following license idents are currently accepted as indicating free
@@ -319,7 +319,7 @@
  */
 #define MODULE_GENERIC_TABLE(gtype,name) \
 static const struct gtype##_id * __module_##gtype##_table \
-  __attribute__ ((unused, __section__(".data.exit"))) = name
+  __attribute_used__ __attribute__ ((__section__(".data.exit"))) = name
 
 #ifndef __GENKSYMS__
 
