diff -urN RC8-rc1-bk3-sys32_timer_create/drivers/block/nbd.c RC8-rc1-bk3-final-sans-XFS/drivers/block/nbd.c
--- RC8-rc1-bk3-sys32_timer_create/drivers/block/nbd.c	Wed Mar 17 15:29:41 2004
+++ RC8-rc1-bk3-final-sans-XFS/drivers/block/nbd.c	Thu Jul 15 04:11:11 2004
@@ -158,15 +158,12 @@
 static int sock_xmit(struct socket *sock, int send, void *buf, int size,
 		int msg_flags)
 {
-	mm_segment_t oldfs;
 	int result;
 	struct msghdr msg;
-	struct iovec iov;
+	struct kvec iov;
 	unsigned long flags;
 	sigset_t oldset;
 
-	oldfs = get_fs();
-	set_fs(get_ds());
 	/* Allow interception of SIGKILL only
 	 * Don't allow other signals to interrupt the transmission */
 	spin_lock_irqsave(&current->sighand->siglock, flags);
@@ -182,17 +179,15 @@
 		iov.iov_len = size;
 		msg.msg_name = NULL;
 		msg.msg_namelen = 0;
-		msg.msg_iov = &iov;
-		msg.msg_iovlen = 1;
 		msg.msg_control = NULL;
 		msg.msg_controllen = 0;
 		msg.msg_namelen = 0;
 		msg.msg_flags = msg_flags | MSG_NOSIGNAL;
 
 		if (send)
-			result = sock_sendmsg(sock, &msg, size);
+			result = kernel_sendmsg(sock, &msg, &iov, 1, size);
 		else
-			result = sock_recvmsg(sock, &msg, size, 0);
+			result = kernel_recvmsg(sock, &msg, &iov, 1, size, 0);
 
 		if (signal_pending(current)) {
 			siginfo_t info;
@@ -219,7 +214,6 @@
 	recalc_sigpending();
 	spin_unlock_irqrestore(&current->sighand->siglock, flags);
 
-	set_fs(oldfs);
 	return result;
 }
 
diff -urN RC8-rc1-bk3-sys32_timer_create/drivers/media/dvb/dvb-core/dvb_net.c RC8-rc1-bk3-final-sans-XFS/drivers/media/dvb/dvb-core/dvb_net.c
--- RC8-rc1-bk3-sys32_timer_create/drivers/media/dvb/dvb-core/dvb_net.c	Wed Jul 14 13:47:13 2004
+++ RC8-rc1-bk3-final-sans-XFS/drivers/media/dvb/dvb-core/dvb_net.c	Thu Jul 15 04:11:11 2004
@@ -43,7 +43,7 @@
 #include "dvb_functions.h"
 
 
-static inline __u32 iov_crc32( __u32 c, struct iovec *iov, unsigned int cnt )
+static inline __u32 iov_crc32( __u32 c, struct kvec *iov, unsigned int cnt )
 {
 	unsigned int j;
 	for (j = 0; j < cnt; j++)
@@ -481,7 +481,7 @@
 			/* Check CRC32, we've got it in our skb already. */
 			unsigned short ulen = htons(priv->ule_sndu_len);
 			unsigned short utype = htons(priv->ule_sndu_type);
-			struct iovec iov[4] = {
+			struct kvec iov[4] = {
 				{ &ulen, sizeof ulen },
 				{ &utype, sizeof utype },
 				{ NULL, 0 },
diff -urN RC8-rc1-bk3-sys32_timer_create/fs/cifs/connect.c RC8-rc1-bk3-final-sans-XFS/fs/cifs/connect.c
--- RC8-rc1-bk3-sys32_timer_create/fs/cifs/connect.c	Wed Jul 14 13:47:13 2004
+++ RC8-rc1-bk3-final-sans-XFS/fs/cifs/connect.c	Thu Jul 15 04:11:11 2004
@@ -189,8 +189,7 @@
 	unsigned int pdu_length, total_read;
 	struct smb_hdr *smb_buffer = NULL;
 	struct msghdr smb_msg;
-	mm_segment_t temp_fs;
-	struct iovec iov;
+	struct kvec iov;
 	struct socket *csocket = server->ssocket;
 	struct list_head *tmp;
 	struct cifsSesInfo *ses;
@@ -204,9 +203,6 @@
 	server->tsk = current;	/* save process info to wake at shutdown */
 	cFYI(1, ("Demultiplex PID: %d", current->pid));
 
-	temp_fs = get_fs();	/* we must turn off socket api parm checking */
-	set_fs(get_ds());
-
 	while (server->tcpStatus != CifsExiting) {
 		if (smb_buffer == NULL)
 			smb_buffer = cifs_buf_get();
@@ -222,16 +218,15 @@
 		iov.iov_base = smb_buffer;
 		iov.iov_len = sizeof (struct smb_hdr) - 1;	
         /* 1 byte less above since wct is not always returned in error cases */
-		smb_msg.msg_iov = &iov;
-		smb_msg.msg_iovlen = 1;
 		smb_msg.msg_control = NULL;
 		smb_msg.msg_controllen = 0;
 
 		length =
-		    sock_recvmsg(csocket, &smb_msg,
-				 sizeof (struct smb_hdr) -
-				 1 /* RFC1001 header and SMB header */ ,
-				 MSG_PEEK /* flags see socket.h */ );
+		    kernel_recvmsg(csocket, &smb_msg,
+				   &iov, 1,
+				   sizeof (struct smb_hdr) -
+				   1 /* RFC1001 header and SMB header */ ,
+				   MSG_PEEK /* flags see socket.h */ );
 
 		if(server->tcpStatus == CifsExiting) {
 			break;
@@ -276,12 +271,14 @@
 			if (temp[0] == (char) RFC1002_SESSION_KEEP_ALIVE) {
 				iov.iov_base = smb_buffer;
 				iov.iov_len = 4;
-				length = sock_recvmsg(csocket, &smb_msg, 4, 0);
+				length = kernel_recvmsg(csocket, &smb_msg,
+							&iov, 1, 4, 0);
 				cFYI(0,("Received 4 byte keep alive packet"));
 			} else if (temp[0] == (char) RFC1002_POSITIVE_SESSION_RESPONSE) {
-					iov.iov_base = smb_buffer;
-					iov.iov_len = 4;
-					length = sock_recvmsg(csocket, &smb_msg, 4, 0);
+				iov.iov_base = smb_buffer;
+				iov.iov_len = 4;
+				length = kernel_recvmsg(csocket, &smb_msg,
+							&iov, 1, 4, 0);
 					cFYI(1,("Good RFC 1002 session rsp"));
 			} else if ((temp[0] == (char)RFC1002_NEGATIVE_SESSION_RESPONSE)
 				   && (length == 5)) {
@@ -341,7 +338,8 @@
 					for (total_read = 0; 
 					     total_read < pdu_length;
 					     total_read += length) {	
-						length = sock_recvmsg(csocket, &smb_msg, 
+						length = kernel_recvmsg(csocket, &smb_msg, 
+							&iov, 1,
 							pdu_length - total_read, 0);
 						if (length == 0) {
 							cERROR(1,
@@ -392,7 +390,9 @@
 			     ("Frame less than four bytes received  %d bytes long.",
 			      length));
 			if (length > 0) {
-				length = sock_recvmsg(csocket, &smb_msg, length, 0);	/* throw away junk frame */
+				length = kernel_recvmsg(csocket, &smb_msg,
+					&iov, 1,
+					length, 0);	/* throw away junk frame */
 				cFYI(1,
 				     (" with junk  0x%x in it ",
 				      *(__u32 *) smb_buffer));
@@ -418,7 +418,6 @@
 		sock_release(csocket);
 		server->ssocket = NULL;
 	}
-	set_fs(temp_fs);
 	if (smb_buffer) /* buffer usually freed in free_mid - need to free it on error or exit */
 		cifs_buf_release(smb_buffer);
 
diff -urN RC8-rc1-bk3-sys32_timer_create/fs/cifs/transport.c RC8-rc1-bk3-final-sans-XFS/fs/cifs/transport.c
--- RC8-rc1-bk3-sys32_timer_create/fs/cifs/transport.c	Sun Jul 11 20:42:10 2004
+++ RC8-rc1-bk3-final-sans-XFS/fs/cifs/transport.c	Thu Jul 15 04:11:11 2004
@@ -122,8 +122,7 @@
 	int rc = 0;
 	int i = 0;
 	struct msghdr smb_msg;
-	struct iovec iov;
-	mm_segment_t temp_fs;
+	struct kvec iov;
 
 	if(ssocket == NULL)
 		return -ENOTSOCK; /* BB eventually add reconnect code here */
@@ -132,8 +131,6 @@
 
 	smb_msg.msg_name = sin;
 	smb_msg.msg_namelen = sizeof (struct sockaddr);
-	smb_msg.msg_iov = &iov;
-	smb_msg.msg_iovlen = 1;
 	smb_msg.msg_control = NULL;
 	smb_msg.msg_controllen = 0;
 	smb_msg.msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL; /* BB add more flags?*/
@@ -147,10 +144,8 @@
 	cFYI(1, ("Sending smb of length %d ", smb_buf_length));
 	dump_smb(smb_buffer, smb_buf_length + 4);
 
-	temp_fs = get_fs();	/* we must turn off socket api parm checking */
-	set_fs(get_ds());
 	while(iov.iov_len > 0) {
-		rc = sock_sendmsg(ssocket, &smb_msg, smb_buf_length + 4);
+		rc = kernel_sendmsg(ssocket, &smb_msg, &iov, 1, smb_buf_length + 4);
 		if ((rc == -ENOSPC) || (rc == -EAGAIN)) {
 			i++;
 			if(i > 60) {
@@ -169,7 +164,6 @@
 		iov.iov_base += rc;
 		iov.iov_len -= rc;
 	}
-	set_fs(temp_fs);
 
 	if (rc < 0) {
 		cERROR(1,("Error %d sending data on socket to server.", rc));
diff -urN RC8-rc1-bk3-sys32_timer_create/fs/ncpfs/sock.c RC8-rc1-bk3-final-sans-XFS/fs/ncpfs/sock.c
--- RC8-rc1-bk3-sys32_timer_create/fs/ncpfs/sock.c	Mon May 10 00:23:35 2004
+++ RC8-rc1-bk3-final-sans-XFS/fs/ncpfs/sock.c	Thu Jul 15 04:11:11 2004
@@ -31,40 +31,26 @@
 
 #include "ncpsign_kernel.h"
 
-static int _recv(struct socket *sock, unsigned char *ubuf, int size,
-		 unsigned flags)
+static int _recv(struct socket *sock, void *buf, int size, unsigned flags)
 {
-	struct iovec iov;
-	struct msghdr msg;
-
-	iov.iov_base = ubuf;
-	iov.iov_len = size;
-
-	msg.msg_name = NULL;
-	msg.msg_namelen = 0;
-	msg.msg_control = NULL;
-	msg.msg_iov = &iov;
-	msg.msg_iovlen = 1;
-
-	return sock_recvmsg(sock, &msg, size, flags);
+	struct msghdr msg = {NULL, };
+	struct kvec iov = {buf, size};
+	return kernel_recvmsg(sock, &msg, &iov, 1, size, flags);
 }
 
-static inline int _send(struct socket *sock, const void *buff, int len)
+static inline int do_send(struct socket *sock, struct kvec *vec, int count,
+			  int len, unsigned flags)
 {
-	struct iovec iov;
-	struct msghdr msg;
-
-	iov.iov_base = (void *) buff;
-	iov.iov_len = len;
-
-	msg.msg_name = NULL;
-	msg.msg_namelen = 0;
-	msg.msg_control = NULL;
-	msg.msg_iov = &iov;
-	msg.msg_iovlen = 1;
-	msg.msg_flags = 0;
+	struct msghdr msg = { .msg_flags = flags };
+	return kernel_sendmsg(sock, &msg, vec, count, len);
+}
 
-	return sock_sendmsg(sock, &msg, len);
+static int _send(struct socket *sock, const void *buff, int len)
+{
+	struct kvec vec;
+	vec.iov_base = (void *) buff;
+	vec.iov_len = len;
+	return do_send(sock, &vec, 1, len, 0);
 }
 
 struct ncp_request_reply {
@@ -74,52 +60,57 @@
 	size_t datalen;
 	int result;
 	enum { RQ_DONE, RQ_INPROGRESS, RQ_QUEUED, RQ_IDLE } status;
-	struct iovec* tx_ciov;
+	struct kvec* tx_ciov;
 	size_t tx_totallen;
 	size_t tx_iovlen;
-	struct iovec tx_iov[3];
+	struct kvec tx_iov[3];
 	u_int16_t tx_type;
 	u_int32_t sign[6];
 };
 
-void ncp_tcp_data_ready(struct sock *sk, int len) {
+void ncp_tcp_data_ready(struct sock *sk, int len)
+{
 	struct ncp_server *server = sk->sk_user_data;
 
 	server->data_ready(sk, len);
 	schedule_work(&server->rcv.tq);
 }
 
-void ncp_tcp_error_report(struct sock *sk) {
+void ncp_tcp_error_report(struct sock *sk)
+{
 	struct ncp_server *server = sk->sk_user_data;
 	
 	server->error_report(sk);
 	schedule_work(&server->rcv.tq);
 }
 
-void ncp_tcp_write_space(struct sock *sk) {
+void ncp_tcp_write_space(struct sock *sk)
+{
 	struct ncp_server *server = sk->sk_user_data;
 	
 	/* We do not need any locking: we first set tx.creq, and then we do sendmsg,
 	   not vice versa... */
 	server->write_space(sk);
-	if (server->tx.creq) {
+	if (server->tx.creq)
 		schedule_work(&server->tx.tq);
-	}
 }
 
-void ncpdgram_timeout_call(unsigned long v) {
+void ncpdgram_timeout_call(unsigned long v)
+{
 	struct ncp_server *server = (void*)v;
 	
 	schedule_work(&server->timeout_tq);
 }
 
-static inline void ncp_finish_request(struct ncp_request_reply *req, int result) {
+static inline void ncp_finish_request(struct ncp_request_reply *req, int result)
+{
 	req->result = result;
 	req->status = RQ_DONE;
 	wake_up_all(&req->wq);
 }
 
-static void __abort_ncp_connection(struct ncp_server *server, struct ncp_request_reply *aborted, int err) {
+static void __abort_ncp_connection(struct ncp_server *server, struct ncp_request_reply *aborted, int err)
+{
 	struct ncp_request_reply *req;
 
 	ncp_invalidate_conn(server);
@@ -156,11 +147,13 @@
 	}
 }
 
-static inline int get_conn_number(struct ncp_reply_header *rp) {
+static inline int get_conn_number(struct ncp_reply_header *rp)
+{
 	return rp->conn_low | (rp->conn_high << 8);
 }
 
-static inline void __ncp_abort_request(struct ncp_server *server, struct ncp_request_reply *req, int err) {
+static inline void __ncp_abort_request(struct ncp_server *server, struct ncp_request_reply *req, int err)
+{
 	/* If req is done, we got signal, but we also received answer... */
 	switch (req->status) {
 		case RQ_IDLE:
@@ -176,55 +169,46 @@
 	}
 }
 
-static inline void ncp_abort_request(struct ncp_server *server, struct ncp_request_reply *req, int err) {
+static inline void ncp_abort_request(struct ncp_server *server, struct ncp_request_reply *req, int err)
+{
 	down(&server->rcv.creq_sem);
 	__ncp_abort_request(server, req, err);
 	up(&server->rcv.creq_sem);
 }
 
-static inline void __ncptcp_abort(struct ncp_server *server) {
+static inline void __ncptcp_abort(struct ncp_server *server)
+{
 	__abort_ncp_connection(server, NULL, 0);
 }
 
-static int ncpdgram_send(struct socket *sock, struct ncp_request_reply *req) {
-	struct msghdr msg;
-	struct iovec iov[3];
-	
+static int ncpdgram_send(struct socket *sock, struct ncp_request_reply *req)
+{
+	struct kvec vec[3];
 	/* sock_sendmsg updates iov pointers for us :-( */
-	memcpy(iov, req->tx_ciov, req->tx_iovlen * sizeof(iov[0]));
-	msg.msg_name = NULL;
-	msg.msg_namelen = 0;
-	msg.msg_control = NULL;
-	msg.msg_iov = iov;
-	msg.msg_iovlen = req->tx_iovlen;
-	msg.msg_flags = MSG_DONTWAIT;
-	return sock_sendmsg(sock, &msg, req->tx_totallen);
+	memcpy(vec, req->tx_ciov, req->tx_iovlen * sizeof(vec[0]));
+	return do_send(sock, vec, req->tx_iovlen,
+		       req->tx_totallen, MSG_DONTWAIT);
 }
 
-static void __ncptcp_try_send(struct ncp_server *server) {
+static void __ncptcp_try_send(struct ncp_server *server)
+{
 	struct ncp_request_reply *rq;
-	struct msghdr msg;
-	struct iovec* iov;
-	struct iovec iovc[3];
+	struct kvec *iov;
+	struct kvec iovc[3];
 	int result;
 
 	rq = server->tx.creq;
-	if (!rq) {
+	if (!rq)
 		return;
-	}
 
 	/* sock_sendmsg updates iov pointers for us :-( */
 	memcpy(iovc, rq->tx_ciov, rq->tx_iovlen * sizeof(iov[0]));
-	msg.msg_name = NULL;
-	msg.msg_namelen = 0;
-	msg.msg_control = NULL;
-	msg.msg_iov = iovc;
-	msg.msg_iovlen = rq->tx_iovlen;
-	msg.msg_flags = MSG_NOSIGNAL | MSG_DONTWAIT;
-	result = sock_sendmsg(server->ncp_sock, &msg, rq->tx_totallen);
-	if (result == -EAGAIN) {
+	result = do_send(server->ncp_sock, iovc, rq->tx_iovlen,
+			 rq->tx_totallen, MSG_NOSIGNAL | MSG_DONTWAIT);
+
+	if (result == -EAGAIN)
 		return;
-	}
+
 	if (result < 0) {
 		printk(KERN_ERR "ncpfs: tcp: Send failed: %d\n", result);
 		__ncp_abort_request(server, rq, result);
@@ -247,14 +231,16 @@
 	rq->tx_ciov = iov;
 }
 
-static inline void ncp_init_header(struct ncp_server *server, struct ncp_request_reply *req, struct ncp_request_header *h) {
+static inline void ncp_init_header(struct ncp_server *server, struct ncp_request_reply *req, struct ncp_request_header *h)
+{
 	req->status = RQ_INPROGRESS;
 	h->conn_low = server->connection;
 	h->conn_high = server->connection >> 8;
 	h->sequence = ++server->sequence;
 }
 	
-static void ncpdgram_start_request(struct ncp_server *server, struct ncp_request_reply *req) {
+static void ncpdgram_start_request(struct ncp_server *server, struct ncp_request_reply *req)
+{
 	size_t signlen;
 	struct ncp_request_header* h;
 	
@@ -282,7 +268,8 @@
 #define NCP_TCP_XMIT_VERSION	(1)
 #define NCP_TCP_RCVD_MAGIC	(0x744E6350)
 
-static void ncptcp_start_request(struct ncp_server *server, struct ncp_request_reply *req) {
+static void ncptcp_start_request(struct ncp_server *server, struct ncp_request_reply *req)
+{
 	size_t signlen;
 	struct ncp_request_header* h;
 
@@ -306,14 +293,16 @@
 	__ncptcp_try_send(server);
 }
 
-static inline void __ncp_start_request(struct ncp_server *server, struct ncp_request_reply *req) {
+static inline void __ncp_start_request(struct ncp_server *server, struct ncp_request_reply *req)
+{
 	if (server->ncp_sock->type == SOCK_STREAM)
 		ncptcp_start_request(server, req);
 	else
 		ncpdgram_start_request(server, req);
 }
 
-static int ncp_add_request(struct ncp_server *server, struct ncp_request_reply *req) {
+static int ncp_add_request(struct ncp_server *server, struct ncp_request_reply *req)
+{
 	down(&server->rcv.creq_sem);
 	if (!ncp_conn_valid(server)) {
 		up(&server->rcv.creq_sem);
@@ -331,7 +320,8 @@
 	return 0;
 }
 
-static void __ncp_next_request(struct ncp_server *server) {
+static void __ncp_next_request(struct ncp_server *server)
+{
 	struct ncp_request_reply *req;
 
 	server->rcv.creq = NULL;
@@ -343,10 +333,10 @@
 	__ncp_start_request(server, req);
 }
 
-static void info_server(struct ncp_server *server, unsigned int id, const void * data, size_t len) {
+static void info_server(struct ncp_server *server, unsigned int id, const void * data, size_t len)
+{
 	if (server->info_sock) {
-		struct iovec iov[2];
-		struct msghdr msg;
+		struct kvec iov[2];
 		__u32 hdr[2];
 	
 		hdr[0] = cpu_to_be32(len + 8);
@@ -357,18 +347,12 @@
 		iov[1].iov_base = (void *) data;
 		iov[1].iov_len = len;
 
-		msg.msg_name = NULL;
-		msg.msg_namelen = 0;
-		msg.msg_control = NULL;
-		msg.msg_iov = iov;
-		msg.msg_iovlen = 2;
-		msg.msg_flags = MSG_NOSIGNAL;
-
-		sock_sendmsg(server->info_sock, &msg, len + 8);
+		do_send(server->info_sock, iov, 2, len + 8, MSG_NOSIGNAL);
 	}
 }
 
-static void __ncpdgram_rcv_proc(void *s) {
+void ncpdgram_rcv_proc(void *s)
+{
 	struct ncp_server *server = s;
 	struct socket* sock;
 	
@@ -378,7 +362,7 @@
 		struct ncp_reply_header reply;
 		int result;
 
-		result = _recv(sock, (void*)&reply, sizeof(reply), MSG_PEEK | MSG_DONTWAIT);
+		result = _recv(sock, &reply, sizeof(reply), MSG_PEEK | MSG_DONTWAIT);
 		if (result < 0) {
 			break;
 		}
@@ -453,21 +437,12 @@
 			up(&server->rcv.creq_sem);
 		}
 drop:;		
-		_recv(sock, (void*)&reply, sizeof(reply), MSG_DONTWAIT);
+		_recv(sock, &reply, sizeof(reply), MSG_DONTWAIT);
 	}
 }
 
-void ncpdgram_rcv_proc(void *s) {
-	mm_segment_t fs;
-	struct ncp_server *server = s;
-	
-	fs = get_fs();
-	set_fs(get_ds());
-	__ncpdgram_rcv_proc(server);
-	set_fs(fs);
-}
-
-static void __ncpdgram_timeout_proc(struct ncp_server *server) {
+static void __ncpdgram_timeout_proc(struct ncp_server *server)
+{
 	/* If timer is pending, we are processing another request... */
 	if (!timer_pending(&server->timeout_tm)) {
 		struct ncp_request_reply* req;
@@ -494,24 +469,22 @@
 	}
 }
 
-void ncpdgram_timeout_proc(void *s) {
-	mm_segment_t fs;
+void ncpdgram_timeout_proc(void *s)
+{
 	struct ncp_server *server = s;
-	
-	fs = get_fs();
-	set_fs(get_ds());
 	down(&server->rcv.creq_sem);
 	__ncpdgram_timeout_proc(server);
 	up(&server->rcv.creq_sem);
-	set_fs(fs);
 }
 
-static inline void ncp_init_req(struct ncp_request_reply* req) {
+static inline void ncp_init_req(struct ncp_request_reply* req)
+{
 	init_waitqueue_head(&req->wq);
 	req->status = RQ_IDLE;
 }
 
-static int do_tcp_rcv(struct ncp_server *server, void *buffer, size_t len) {
+static int do_tcp_rcv(struct ncp_server *server, void *buffer, size_t len)
+{
 	int result;
 	
 	if (buffer) {
@@ -534,7 +507,8 @@
 	return result;
 }	
 
-static int __ncptcp_rcv_proc(struct ncp_server *server) {
+static int __ncptcp_rcv_proc(struct ncp_server *server)
+{
 	/* We have to check the result, so store the complete header */
 	while (1) {
 		int result;
@@ -679,30 +653,22 @@
 	}
 }
 
-void ncp_tcp_rcv_proc(void *s) {
-	mm_segment_t fs;
+void ncp_tcp_rcv_proc(void *s)
+{
 	struct ncp_server *server = s;
 
-	fs = get_fs();
-	set_fs(get_ds());
 	down(&server->rcv.creq_sem);
 	__ncptcp_rcv_proc(server);
 	up(&server->rcv.creq_sem);
-	set_fs(fs);
-	return;
 }
 
-void ncp_tcp_tx_proc(void *s) {
-	mm_segment_t fs;
+void ncp_tcp_tx_proc(void *s)
+{
 	struct ncp_server *server = s;
 	
-	fs = get_fs();
-	set_fs(get_ds());
 	down(&server->rcv.creq_sem);
 	__ncptcp_try_send(server);
 	up(&server->rcv.creq_sem);
-	set_fs(fs);
-	return;
 }
 
 static int do_ncp_rpc_call(struct ncp_server *server, int size,
@@ -714,7 +680,7 @@
 	ncp_init_req(&req);
 	req.reply_buf = reply_buf;
 	req.datalen = max_reply_size;
-	req.tx_iov[1].iov_base = (void *) server->packet;
+	req.tx_iov[1].iov_base = server->packet;
 	req.tx_iov[1].iov_len = size;
 	req.tx_iovlen = 1;
 	req.tx_totallen = size;
@@ -748,7 +714,6 @@
 		return -EIO;
 	}
 	{
-		mm_segment_t fs;
 		sigset_t old_set;
 		unsigned long mask, flags;
 
@@ -773,12 +738,7 @@
 		recalc_sigpending();
 		spin_unlock_irqrestore(&current->sighand->siglock, flags);
 		
-		fs = get_fs();
-		set_fs(get_ds());
-
 		result = do_ncp_rpc_call(server, size, reply, max_reply_size);
-
-		set_fs(fs);
 
 		spin_lock_irqsave(&current->sighand->siglock, flags);
 		current->blocked = old_set;
diff -urN RC8-rc1-bk3-sys32_timer_create/fs/nfs/nfs2xdr.c RC8-rc1-bk3-final-sans-XFS/fs/nfs/nfs2xdr.c
--- RC8-rc1-bk3-sys32_timer_create/fs/nfs/nfs2xdr.c	Wed Jun 16 10:26:23 2004
+++ RC8-rc1-bk3-final-sans-XFS/fs/nfs/nfs2xdr.c	Thu Jul 15 04:11:11 2004
@@ -231,7 +231,7 @@
 static int
 nfs_xdr_readres(struct rpc_rqst *req, u32 *p, struct nfs_readres *res)
 {
-	struct iovec *iov = req->rq_rcv_buf.head;
+	struct kvec *iov = req->rq_rcv_buf.head;
 	int	status, count, recvd, hdrlen;
 
 	if ((status = ntohl(*p++)))
@@ -375,7 +375,7 @@
 nfs_xdr_readdirres(struct rpc_rqst *req, u32 *p, void *dummy)
 {
 	struct xdr_buf *rcvbuf = &req->rq_rcv_buf;
-	struct iovec *iov = rcvbuf->head;
+	struct kvec *iov = rcvbuf->head;
 	struct page **page;
 	int hdrlen, recvd;
 	int status, nr;
@@ -530,7 +530,7 @@
 nfs_xdr_readlinkres(struct rpc_rqst *req, u32 *p, void *dummy)
 {
 	struct xdr_buf *rcvbuf = &req->rq_rcv_buf;
-	struct iovec *iov = rcvbuf->head;
+	struct kvec *iov = rcvbuf->head;
 	unsigned int hdrlen;
 	u32	*strlen, len;
 	char	*string;
diff -urN RC8-rc1-bk3-sys32_timer_create/fs/nfs/nfs3xdr.c RC8-rc1-bk3-final-sans-XFS/fs/nfs/nfs3xdr.c
--- RC8-rc1-bk3-sys32_timer_create/fs/nfs/nfs3xdr.c	Wed Jun 16 10:26:23 2004
+++ RC8-rc1-bk3-final-sans-XFS/fs/nfs/nfs3xdr.c	Thu Jul 15 04:11:11 2004
@@ -484,7 +484,7 @@
 nfs3_xdr_readdirres(struct rpc_rqst *req, u32 *p, struct nfs3_readdirres *res)
 {
 	struct xdr_buf *rcvbuf = &req->rq_rcv_buf;
-	struct iovec *iov = rcvbuf->head;
+	struct kvec *iov = rcvbuf->head;
 	struct page **page;
 	int hdrlen, recvd;
 	int status, nr;
@@ -721,7 +721,7 @@
 nfs3_xdr_readlinkres(struct rpc_rqst *req, u32 *p, struct nfs_fattr *fattr)
 {
 	struct xdr_buf *rcvbuf = &req->rq_rcv_buf;
-	struct iovec *iov = rcvbuf->head;
+	struct kvec *iov = rcvbuf->head;
 	unsigned int hdrlen;
 	u32	*strlen, len;
 	char	*string;
@@ -761,7 +761,7 @@
 static int
 nfs3_xdr_readres(struct rpc_rqst *req, u32 *p, struct nfs_readres *res)
 {
-	struct iovec *iov = req->rq_rcv_buf.head;
+	struct kvec *iov = req->rq_rcv_buf.head;
 	int	status, count, ocount, recvd, hdrlen;
 
 	status = ntohl(*p++);
diff -urN RC8-rc1-bk3-sys32_timer_create/fs/nfs/nfs4xdr.c RC8-rc1-bk3-final-sans-XFS/fs/nfs/nfs4xdr.c
--- RC8-rc1-bk3-sys32_timer_create/fs/nfs/nfs4xdr.c	Wed Jun 16 10:26:23 2004
+++ RC8-rc1-bk3-final-sans-XFS/fs/nfs/nfs4xdr.c	Thu Jul 15 04:11:11 2004
@@ -933,7 +933,7 @@
 	WRITE32(FATTR4_WORD0_FILEID);
 	WRITE32(0);
 
-	/* set up reply iovec
+	/* set up reply kvec
 	 *    toplevel_status + taglen + rescount + OP_PUTFH + status
 	 *      + OP_READDIR + status + verifer(2)  = 9
 	 */
@@ -954,7 +954,7 @@
 	RESERVE_SPACE(4);
 	WRITE32(OP_READLINK);
 
-	/* set up reply iovec
+	/* set up reply kvec
 	 *    toplevel_status + taglen + rescount + OP_PUTFH + status
 	 *      + OP_READLINK + status  = 7
 	 */
@@ -1501,7 +1501,7 @@
 	if (status)
 		goto out;
 
-	/* set up reply iovec
+	/* set up reply kvec
 	 *    toplevel status + taglen=0 + rescount + OP_PUTFH + status
 	 *       + OP_READ + status + eof + datalen = 9
 	 */
@@ -2785,7 +2785,7 @@
 
 static int decode_read(struct xdr_stream *xdr, struct rpc_rqst *req, struct nfs_readres *res)
 {
-	struct iovec *iov = req->rq_rcv_buf.head;
+	struct kvec *iov = req->rq_rcv_buf.head;
 	uint32_t *p;
 	uint32_t count, eof, recvd, hdrlen;
 	int status;
@@ -2814,7 +2814,7 @@
 {
 	struct xdr_buf	*rcvbuf = &req->rq_rcv_buf;
 	struct page	*page = *rcvbuf->pages;
-	struct iovec	*iov = rcvbuf->head;
+	struct kvec	*iov = rcvbuf->head;
 	unsigned int	nr, pglen = rcvbuf->page_len;
 	uint32_t	*end, *entry, *p, *kaddr;
 	uint32_t	len, attrlen, word;
@@ -2897,7 +2897,7 @@
 static int decode_readlink(struct xdr_stream *xdr, struct rpc_rqst *req)
 {
 	struct xdr_buf *rcvbuf = &req->rq_rcv_buf;
-	struct iovec *iov = rcvbuf->head;
+	struct kvec *iov = rcvbuf->head;
 	uint32_t *strlen;
 	unsigned int hdrlen, len;
 	char *string;
diff -urN RC8-rc1-bk3-sys32_timer_create/fs/nfsd/nfs3xdr.c RC8-rc1-bk3-final-sans-XFS/fs/nfsd/nfs3xdr.c
--- RC8-rc1-bk3-sys32_timer_create/fs/nfsd/nfs3xdr.c	Wed Jun 16 10:26:23 2004
+++ RC8-rc1-bk3-final-sans-XFS/fs/nfsd/nfs3xdr.c	Thu Jul 15 04:11:11 2004
@@ -340,7 +340,7 @@
 	if (len > NFSSVC_MAXBLKSIZE)
 		len = NFSSVC_MAXBLKSIZE;
 
-	/* set up the iovec */
+	/* set up the kvec */
 	v=0;
 	while (len > 0) {
 		pn = rqstp->rq_resused;
@@ -430,7 +430,7 @@
 	int len;
 	int avail;
 	char *old, *new;
-	struct iovec *vec;
+	struct kvec *vec;
 
 	if (!(p = decode_fh(p, &args->ffh))
 	 || !(p = decode_filename(p, &args->fname, &args->flen))
diff -urN RC8-rc1-bk3-sys32_timer_create/fs/nfsd/nfs4xdr.c RC8-rc1-bk3-final-sans-XFS/fs/nfsd/nfs4xdr.c
--- RC8-rc1-bk3-sys32_timer_create/fs/nfsd/nfs4xdr.c	Sun Jul 11 20:42:11 2004
+++ RC8-rc1-bk3-final-sans-XFS/fs/nfsd/nfs4xdr.c	Thu Jul 15 04:11:11 2004
@@ -2519,7 +2519,7 @@
 	/*
 	 * All that remains is to write the tag and operation count...
 	 */
-	struct iovec *iov;
+	struct kvec *iov;
 	p = resp->tagp;
 	*p++ = htonl(resp->taglen);
 	memcpy(p, resp->tag, resp->taglen);
diff -urN RC8-rc1-bk3-sys32_timer_create/fs/nfsd/nfscache.c RC8-rc1-bk3-final-sans-XFS/fs/nfsd/nfscache.c
--- RC8-rc1-bk3-sys32_timer_create/fs/nfsd/nfscache.c	Tue Dec 10 13:12:46 2002
+++ RC8-rc1-bk3-final-sans-XFS/fs/nfsd/nfscache.c	Thu Jul 15 04:11:11 2004
@@ -41,7 +41,7 @@
 static struct svc_cacherep *	nfscache;
 static int			cache_disabled = 1;
 
-static int	nfsd_cache_append(struct svc_rqst *rqstp, struct iovec *vec);
+static int	nfsd_cache_append(struct svc_rqst *rqstp, struct kvec *vec);
 
 /* 
  * locking for the reply cache:
@@ -308,7 +308,7 @@
 nfsd_cache_update(struct svc_rqst *rqstp, int cachetype, u32 *statp)
 {
 	struct svc_cacherep *rp;
-	struct iovec	*resv = &rqstp->rq_res.head[0], *cachv;
+	struct kvec	*resv = &rqstp->rq_res.head[0], *cachv;
 	int		len;
 
 	if (!(rp = rqstp->rq_cacherep) || cache_disabled)
@@ -358,9 +358,9 @@
  * keep a refcount....
  */
 static int
-nfsd_cache_append(struct svc_rqst *rqstp, struct iovec *data)
+nfsd_cache_append(struct svc_rqst *rqstp, struct kvec *data)
 {
-	struct iovec	*vec = &rqstp->rq_res.head[0];
+	struct kvec	*vec = &rqstp->rq_res.head[0];
 
 	if (vec->iov_len + data->iov_len > PAGE_SIZE) {
 		printk(KERN_WARNING "nfsd: cached reply too large (%Zd).\n",
diff -urN RC8-rc1-bk3-sys32_timer_create/fs/nfsd/vfs.c RC8-rc1-bk3-final-sans-XFS/fs/nfsd/vfs.c
--- RC8-rc1-bk3-sys32_timer_create/fs/nfsd/vfs.c	Wed Jul 14 13:56:24 2004
+++ RC8-rc1-bk3-final-sans-XFS/fs/nfsd/vfs.c	Thu Jul 15 04:11:11 2004
@@ -641,7 +641,7 @@
  */
 int
 nfsd_read(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t offset,
-          struct iovec *vec, int vlen, unsigned long *count)
+          struct kvec *vec, int vlen, unsigned long *count)
 {
 	struct raparms	*ra;
 	mm_segment_t	oldfs;
@@ -673,7 +673,7 @@
 	} else {
 		oldfs = get_fs();
 		set_fs(KERNEL_DS);
-		err = vfs_readv(&file, vec, vlen, &offset);
+		err = vfs_readv(&file, (struct iovec __user *)vec, vlen, &offset);
 		set_fs(oldfs);
 	}
 
@@ -704,7 +704,7 @@
  */
 int
 nfsd_write(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t offset,
-				struct iovec *vec, int vlen,
+				struct kvec *vec, int vlen,
 	   			unsigned long cnt, int *stablep)
 {
 	struct svc_export	*exp;
@@ -753,7 +753,7 @@
 
 	/* Write the data. */
 	oldfs = get_fs(); set_fs(KERNEL_DS);
-	err = vfs_writev(&file, vec, vlen, &offset);
+	err = vfs_writev(&file, (struct iovec __user *)vec, vlen, &offset);
 	set_fs(oldfs);
 	if (err >= 0) {
 		nfsdstats.io_write += cnt;
diff -urN RC8-rc1-bk3-sys32_timer_create/fs/smbfs/request.h RC8-rc1-bk3-final-sans-XFS/fs/smbfs/request.h
--- RC8-rc1-bk3-sys32_timer_create/fs/smbfs/request.h	Sat Nov 23 18:44:49 2002
+++ RC8-rc1-bk3-final-sans-XFS/fs/smbfs/request.h	Wed Jul 14 13:59:20 2004
@@ -34,7 +34,7 @@
 	int rq_bytes_sent;
 
 	int rq_iovlen;
-	struct iovec rq_iov[4];
+	struct kvec rq_iov[4];
 
 	int (*rq_setup_read) (struct smb_request *);
 	void (*rq_callback) (struct smb_request *);
diff -urN RC8-rc1-bk3-sys32_timer_create/fs/smbfs/sock.c RC8-rc1-bk3-final-sans-XFS/fs/smbfs/sock.c
--- RC8-rc1-bk3-sys32_timer_create/fs/smbfs/sock.c	Sat Apr  3 23:40:45 2004
+++ RC8-rc1-bk3-final-sans-XFS/fs/smbfs/sock.c	Thu Jul 15 04:11:11 2004
@@ -38,27 +38,10 @@
 static int
 _recvfrom(struct socket *socket, unsigned char *ubuf, int size, unsigned flags)
 {
-	struct iovec iov;
-	struct msghdr msg;
-	mm_segment_t fs;
-
-	fs = get_fs();
-	set_fs(get_ds());
-	flags |= MSG_DONTWAIT | MSG_NOSIGNAL;
-
-	msg.msg_flags = flags;
-	msg.msg_name = NULL;
-	msg.msg_namelen = 0;
-	msg.msg_iov = &iov;
-	msg.msg_iovlen = 1;
-	msg.msg_control = NULL;
-	iov.iov_base = ubuf;
-	iov.iov_len = size;
-
-	size = sock_recvmsg(socket, &msg, size, flags);
-
-	set_fs(fs);
-	return size;
+	struct kvec iov = {ubuf, size};
+	struct msghdr msg = {.msg_flags = flags};
+	msg.msg_flags |= MSG_DONTWAIT | MSG_NOSIGNAL;
+	return kernel_recvmsg(socket, &msg, &iov, 1, size, msg.msg_flags);
 }
 
 /*
@@ -171,42 +154,42 @@
 }
 
 /*
- * Adjust the iovec to move on 'n' bytes (from nfs/sunrpc)
+ * Adjust the kvec to move on 'n' bytes (from nfs/sunrpc)
  */
 static int
-smb_move_iov(struct msghdr *msg, struct iovec *niv, unsigned amount)
+smb_move_iov(struct kvec **data, size_t *num, struct kvec *vec, unsigned amount)
 {
-	struct iovec *iv = msg->msg_iov;
+	struct kvec *iv = *data;
 	int i;
 	int len;
 
 	/*
-	 *	Eat any sent iovecs
+	 *	Eat any sent kvecs
 	 */
 	while (iv->iov_len <= amount) {
 		amount -= iv->iov_len;
 		iv++;
-		msg->msg_iovlen--;
+		(*num)--;
 	}
 
 	/*
 	 *	And chew down the partial one
 	 */
-	niv[0].iov_len = iv->iov_len-amount;
-	niv[0].iov_base =((unsigned char *)iv->iov_base)+amount;
+	vec[0].iov_len = iv->iov_len-amount;
+	vec[0].iov_base =((unsigned char *)iv->iov_base)+amount;
 	iv++;
 
-	len = niv[0].iov_len;
+	len = vec[0].iov_len;
 
 	/*
 	 *	And copy any others
 	 */
-	for (i = 1; i < msg->msg_iovlen; i++) {
-		niv[i] = *iv++;
-		len += niv[i].iov_len;
+	for (i = 1; i < *num; i++) {
+		vec[i] = *iv++;
+		len += vec[i].iov_len;
 	}
 
-	msg->msg_iov = niv;
+	*data = vec;
 	return len;
 }
 
@@ -280,37 +263,29 @@
 {
 	struct socket *sock;
 	unsigned int flags;
-	struct iovec iov;
+	struct kvec iov;
 	struct msghdr msg;
-	mm_segment_t fs;
 	int rlen = smb_len(server->header) - server->smb_read + 4;
 	int result = -EIO;
 
+	if (rlen > PAGE_SIZE)
+		rlen = PAGE_SIZE;
+
 	sock = server_sock(server);
 	if (!sock)
 		goto out;
 	if (sock->sk->sk_state != TCP_ESTABLISHED)
 		goto out;
 
-	fs = get_fs();
-	set_fs(get_ds());
-
 	flags = MSG_DONTWAIT | MSG_NOSIGNAL;
 	iov.iov_base = drop_buffer;
 	iov.iov_len = PAGE_SIZE;
 	msg.msg_flags = flags;
 	msg.msg_name = NULL;
 	msg.msg_namelen = 0;
-	msg.msg_iov = &iov;
-	msg.msg_iovlen = 1;
 	msg.msg_control = NULL;
 
-	if (rlen > PAGE_SIZE)
-		rlen = PAGE_SIZE;
-
-	result = sock_recvmsg(sock, &msg, rlen, flags);
-
-	set_fs(fs);
+	result = kernel_recvmsg(sock, &msg, &iov, 1, rlen, flags);
 
 	VERBOSE("read: %d\n", result);
 	if (result < 0) {
@@ -335,9 +310,10 @@
 {
 	struct socket *sock;
 	unsigned int flags;
-	struct iovec iov[4];
+	struct kvec iov[4];
+	struct kvec *p = req->rq_iov;
+	size_t num = req->rq_iovlen;
 	struct msghdr msg;
-	mm_segment_t fs;
 	int rlen;
 	int result = -EIO;
 
@@ -347,25 +323,18 @@
 	if (sock->sk->sk_state != TCP_ESTABLISHED)
 		goto out;
 
-	fs = get_fs();
-	set_fs(get_ds());
-
 	flags = MSG_DONTWAIT | MSG_NOSIGNAL;
 	msg.msg_flags = flags;
 	msg.msg_name = NULL;
 	msg.msg_namelen = 0;
-	msg.msg_iov = req->rq_iov;
-	msg.msg_iovlen = req->rq_iovlen;
 	msg.msg_control = NULL;
 
 	/* Dont repeat bytes and count available bufferspace */
-	rlen = smb_move_iov(&msg, iov, req->rq_bytes_recvd);
+	rlen = smb_move_iov(&p, &num, iov, req->rq_bytes_recvd);
 	if (req->rq_rlen < rlen)
 		rlen = req->rq_rlen;
 
-	result = sock_recvmsg(sock, &msg, rlen, flags);
-
-	set_fs(fs);
+	result = kernel_recvmsg(sock, &msg, p, num, rlen, flags);
 
 	VERBOSE("read: %d\n", result);
 	if (result < 0) {
@@ -388,13 +357,14 @@
 int
 smb_send_request(struct smb_request *req)
 {
-	mm_segment_t fs;
 	struct smb_sb_info *server = req->rq_server;
 	struct socket *sock;
-	struct msghdr msg;
+	struct msghdr msg = {.msg_flags = MSG_NOSIGNAL | MSG_DONTWAIT};
         int slen = req->rq_slen - req->rq_bytes_sent;
 	int result = -EIO;
-	struct iovec iov[4];
+	struct kvec iov[4];
+	struct kvec *p = req->rq_iov;
+	size_t num = req->rq_iovlen;
 
 	sock = server_sock(server);
 	if (!sock)
@@ -402,22 +372,11 @@
 	if (sock->sk->sk_state != TCP_ESTABLISHED)
 		goto out;
 
-	msg.msg_name = NULL;
-	msg.msg_namelen = 0;
-	msg.msg_control = NULL;
-	msg.msg_controllen = 0;
-	msg.msg_iov = req->rq_iov;
-	msg.msg_iovlen = req->rq_iovlen;
-	msg.msg_flags = MSG_NOSIGNAL | MSG_DONTWAIT;
-
 	/* Dont repeat bytes */
 	if (req->rq_bytes_sent)
-		smb_move_iov(&msg, iov, req->rq_bytes_sent);
+		smb_move_iov(&p, &num, iov, req->rq_bytes_sent);
 
-	fs = get_fs();
-	set_fs(get_ds());
-	result = sock_sendmsg(sock, &msg, slen);
-	set_fs(fs);
+	result = kernel_sendmsg(sock, &msg, p, num, slen);
 
 	if (result >= 0) {
 		req->rq_bytes_sent += result;
diff -urN RC8-rc1-bk3-sys32_timer_create/include/linux/net.h RC8-rc1-bk3-final-sans-XFS/include/linux/net.h
--- RC8-rc1-bk3-sys32_timer_create/include/linux/net.h	Wed Jun 16 10:26:29 2004
+++ RC8-rc1-bk3-final-sans-XFS/include/linux/net.h	Thu Jul 15 04:11:11 2004
@@ -142,6 +142,7 @@
 };
 
 struct iovec;
+struct kvec;
 
 extern int	     sock_wake_async(struct socket *sk, int how, int band);
 extern int	     sock_register(struct net_proto_family *fam);
@@ -168,6 +169,12 @@
 extern int	     net_ratelimit(void);
 extern unsigned long net_random(void);
 extern void	     net_srandom(unsigned long);
+
+extern int   	     kernel_sendmsg(struct socket *sock, struct msghdr *msg,
+				    struct kvec *vec, size_t num, size_t len);
+extern int   	     kernel_recvmsg(struct socket *sock, struct msghdr *msg,
+				    struct kvec *vec, size_t num,
+				    size_t len, int flags);
 
 #ifndef CONFIG_SMP
 #define SOCKOPS_WRAPPED(name) name
diff -urN RC8-rc1-bk3-sys32_timer_create/include/linux/nfsd/cache.h RC8-rc1-bk3-final-sans-XFS/include/linux/nfsd/cache.h
--- RC8-rc1-bk3-sys32_timer_create/include/linux/nfsd/cache.h	Mon Nov 18 00:17:39 2002
+++ RC8-rc1-bk3-final-sans-XFS/include/linux/nfsd/cache.h	Thu Jul 15 04:11:11 2004
@@ -33,7 +33,7 @@
 	u32			c_vers;
 	unsigned long		c_timestamp;
 	union {
-		struct iovec	u_vec;
+		struct kvec	u_vec;
 		u32		u_status;
 	}			c_u;
 };
diff -urN RC8-rc1-bk3-sys32_timer_create/include/linux/nfsd/nfsd.h RC8-rc1-bk3-final-sans-XFS/include/linux/nfsd/nfsd.h
--- RC8-rc1-bk3-sys32_timer_create/include/linux/nfsd/nfsd.h	Sun Jul 11 20:42:17 2004
+++ RC8-rc1-bk3-final-sans-XFS/include/linux/nfsd/nfsd.h	Thu Jul 15 04:11:11 2004
@@ -92,9 +92,9 @@
 				int, struct file *);
 void		nfsd_close(struct file *);
 int		nfsd_read(struct svc_rqst *, struct svc_fh *,
-				loff_t, struct iovec *,int, unsigned long *);
+				loff_t, struct kvec *,int, unsigned long *);
 int		nfsd_write(struct svc_rqst *, struct svc_fh *,
-				loff_t, struct iovec *,int, unsigned long, int *);
+				loff_t, struct kvec *,int, unsigned long, int *);
 int		nfsd_readlink(struct svc_rqst *, struct svc_fh *,
 				char *, int *);
 int		nfsd_symlink(struct svc_rqst *, struct svc_fh *,
diff -urN RC8-rc1-bk3-sys32_timer_create/include/linux/nfsd/xdr.h RC8-rc1-bk3-final-sans-XFS/include/linux/nfsd/xdr.h
--- RC8-rc1-bk3-sys32_timer_create/include/linux/nfsd/xdr.h	Mon Jun 23 07:23:11 2003
+++ RC8-rc1-bk3-final-sans-XFS/include/linux/nfsd/xdr.h	Thu Jul 15 04:11:11 2004
@@ -30,7 +30,7 @@
 	struct svc_fh		fh;
 	__u32			offset;
 	__u32			count;
-	struct iovec		vec[RPCSVC_MAXPAGES];
+	struct kvec		vec[RPCSVC_MAXPAGES];
 	int			vlen;
 };
 
@@ -38,7 +38,7 @@
 	svc_fh			fh;
 	__u32			offset;
 	int			len;
-	struct iovec		vec[RPCSVC_MAXPAGES];
+	struct kvec		vec[RPCSVC_MAXPAGES];
 	int			vlen;
 };
 
diff -urN RC8-rc1-bk3-sys32_timer_create/include/linux/nfsd/xdr3.h RC8-rc1-bk3-final-sans-XFS/include/linux/nfsd/xdr3.h
--- RC8-rc1-bk3-sys32_timer_create/include/linux/nfsd/xdr3.h	Wed Jun 16 10:26:29 2004
+++ RC8-rc1-bk3-final-sans-XFS/include/linux/nfsd/xdr3.h	Thu Jul 15 04:11:11 2004
@@ -33,7 +33,7 @@
 	struct svc_fh		fh;
 	__u64			offset;
 	__u32			count;
-	struct iovec		vec[RPCSVC_MAXPAGES];
+	struct kvec		vec[RPCSVC_MAXPAGES];
 	int			vlen;
 };
 
@@ -43,7 +43,7 @@
 	__u32			count;
 	int			stable;
 	int			len;
-	struct iovec		vec[RPCSVC_MAXPAGES];
+	struct kvec		vec[RPCSVC_MAXPAGES];
 	int			vlen;
 };
 
diff -urN RC8-rc1-bk3-sys32_timer_create/include/linux/nfsd/xdr4.h RC8-rc1-bk3-final-sans-XFS/include/linux/nfsd/xdr4.h
--- RC8-rc1-bk3-sys32_timer_create/include/linux/nfsd/xdr4.h	Sun Jul 11 20:42:17 2004
+++ RC8-rc1-bk3-final-sans-XFS/include/linux/nfsd/xdr4.h	Thu Jul 15 04:11:12 2004
@@ -241,7 +241,7 @@
 	stateid_t	rd_stateid;         /* request */
 	u64		rd_offset;          /* request */
 	u32		rd_length;          /* request */
-	struct iovec	rd_iov[RPCSVC_MAXPAGES];
+	struct kvec	rd_iov[RPCSVC_MAXPAGES];
 	int		rd_vlen;
 	
 	struct svc_rqst *rd_rqstp;          /* response */
@@ -324,7 +324,7 @@
 	u64		wr_offset;          /* request */
 	u32		wr_stable_how;      /* request */
 	u32		wr_buflen;          /* request */
-	struct iovec	wr_vec[RPCSVC_MAXPAGES]; /* request */
+	struct kvec	wr_vec[RPCSVC_MAXPAGES]; /* request */
 	int		wr_vlen;
 
 	u32		wr_bytes_written;   /* response */
diff -urN RC8-rc1-bk3-sys32_timer_create/include/linux/sunrpc/svc.h RC8-rc1-bk3-final-sans-XFS/include/linux/sunrpc/svc.h
--- RC8-rc1-bk3-sys32_timer_create/include/linux/sunrpc/svc.h	Wed Mar 17 15:30:05 2004
+++ RC8-rc1-bk3-final-sans-XFS/include/linux/sunrpc/svc.h	Thu Jul 15 04:11:12 2004
@@ -67,7 +67,7 @@
  * read responses (that have a header, and some data pages, and possibly
  * a tail) and means we can share some client side routines.
  *
- * The xdr_buf.head iovec always points to the first page in the rq_*pages
+ * The xdr_buf.head kvec always points to the first page in the rq_*pages
  * list.  The xdr_buf.pages pointer points to the second page on that
  * list.  xdr_buf.tail points to the end of the first page.
  * This assumes that the non-page part of an rpc reply will fit
@@ -78,7 +78,7 @@
  */
 #define RPCSVC_MAXPAGES		((RPCSVC_MAXPAYLOAD+PAGE_SIZE-1)/PAGE_SIZE + 2)
 
-static inline u32 svc_getu32(struct iovec *iov)
+static inline u32 svc_getu32(struct kvec *iov)
 {
 	u32 val, *vp;
 	vp = iov->iov_base;
@@ -87,7 +87,7 @@
 	iov->iov_len -= sizeof(u32);
 	return val;
 }
-static inline void svc_putu32(struct iovec *iov, u32 val)
+static inline void svc_putu32(struct kvec *iov, u32 val)
 {
 	u32 *vp = iov->iov_base + iov->iov_len;
 	*vp = val;
@@ -162,14 +162,14 @@
 xdr_argsize_check(struct svc_rqst *rqstp, u32 *p)
 {
 	char *cp = (char *)p;
-	struct iovec *vec = &rqstp->rq_arg.head[0];
+	struct kvec *vec = &rqstp->rq_arg.head[0];
 	return cp - (char*)vec->iov_base <= vec->iov_len;
 }
 
 static inline int
 xdr_ressize_check(struct svc_rqst *rqstp, u32 *p)
 {
-	struct iovec *vec = &rqstp->rq_res.head[0];
+	struct kvec *vec = &rqstp->rq_res.head[0];
 	char *cp = (char*)p;
 
 	vec->iov_len = cp - (char*)vec->iov_base;
diff -urN RC8-rc1-bk3-sys32_timer_create/include/linux/sunrpc/xdr.h RC8-rc1-bk3-final-sans-XFS/include/linux/sunrpc/xdr.h
--- RC8-rc1-bk3-sys32_timer_create/include/linux/sunrpc/xdr.h	Mon May 10 00:23:41 2004
+++ RC8-rc1-bk3-final-sans-XFS/include/linux/sunrpc/xdr.h	Thu Jul 15 04:11:12 2004
@@ -48,7 +48,7 @@
  * operations and/or has a need for scatter/gather involving pages.
  */
 struct xdr_buf {
-	struct iovec	head[1],	/* RPC header + non-page data */
+	struct kvec	head[1],	/* RPC header + non-page data */
 			tail[1];	/* Appended after page data */
 
 	struct page **	pages;		/* Array of contiguous pages */
@@ -127,15 +127,15 @@
 }
 
 /*
- * Adjust iovec to reflect end of xdr'ed data (RPC client XDR)
+ * Adjust kvec to reflect end of xdr'ed data (RPC client XDR)
  */
 static inline int
-xdr_adjust_iovec(struct iovec *iov, u32 *p)
+xdr_adjust_iovec(struct kvec *iov, u32 *p)
 {
 	return iov->iov_len = ((u8 *) p - (u8 *) iov->iov_base);
 }
 
-void xdr_shift_iovec(struct iovec *, int, size_t);
+void xdr_shift_iovec(struct kvec *, int, size_t);
 
 /*
  * Maximum number of iov's we use.
@@ -145,11 +145,11 @@
 /*
  * XDR buffer helper functions
  */
-extern int xdr_kmap(struct iovec *, struct xdr_buf *, size_t);
+extern int xdr_kmap(struct kvec *, struct xdr_buf *, size_t);
 extern void xdr_kunmap(struct xdr_buf *, size_t);
 extern void xdr_shift_buf(struct xdr_buf *, size_t);
 extern void _copy_from_pages(char *, struct page **, size_t, size_t);
-extern void xdr_buf_from_iov(struct iovec *, struct xdr_buf *);
+extern void xdr_buf_from_iov(struct kvec *, struct xdr_buf *);
 extern int xdr_buf_subsegment(struct xdr_buf *, struct xdr_buf *, int, int);
 extern int xdr_buf_read_netobj(struct xdr_buf *, struct xdr_netobj *, int);
 extern int read_bytes_from_xdr_buf(struct xdr_buf *buf, int base, void *obj, int len);
@@ -182,7 +182,7 @@
 	struct xdr_buf *buf;	/* XDR buffer to read/write */
 
 	uint32_t *end;		/* end of available buffer space */
-	struct iovec *iov;	/* pointer to the current iovec */
+	struct kvec *iov;	/* pointer to the current kvec */
 };
 
 extern void xdr_init_encode(struct xdr_stream *xdr, struct xdr_buf *buf, uint32_t *p);
diff -urN RC8-rc1-bk3-sys32_timer_create/include/net/ip.h RC8-rc1-bk3-final-sans-XFS/include/net/ip.h
--- RC8-rc1-bk3-sys32_timer_create/include/net/ip.h	Sun Jul 11 20:42:18 2004
+++ RC8-rc1-bk3-final-sans-XFS/include/net/ip.h	Thu Jul 15 04:11:12 2004
@@ -128,10 +128,10 @@
 }
 
 struct ip_reply_arg {
-	struct iovec iov[1];   
-	u32 	     csum; 
-	int	     csumoffset; /* u16 offset of csum in iov[0].iov_base */
-				 /* -1 if not needed */ 
+	struct kvec iov[1];   
+	u32 	    csum; 
+	int	    csumoffset; /* u16 offset of csum in iov[0].iov_base */
+				/* -1 if not needed */ 
 }; 
 
 void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *arg,
diff -urN RC8-rc1-bk3-sys32_timer_create/net/core/sock.c RC8-rc1-bk3-final-sans-XFS/net/core/sock.c
--- RC8-rc1-bk3-sys32_timer_create/net/core/sock.c	Wed Jul 14 13:47:14 2004
+++ RC8-rc1-bk3-final-sans-XFS/net/core/sock.c	Thu Jul 15 04:11:12 2004
@@ -1064,30 +1064,12 @@
 ssize_t sock_no_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags)
 {
 	ssize_t res;
-	struct msghdr msg;
-	struct iovec iov;
-	mm_segment_t old_fs;
-	char *kaddr;
-
-	kaddr = kmap(page);
-
-	msg.msg_name = NULL;
-	msg.msg_namelen = 0;
-	msg.msg_iov = &iov;
-	msg.msg_iovlen = 1;
-	msg.msg_control = NULL;
-	msg.msg_controllen = 0;
-	msg.msg_flags = flags;
-
-	/* This cast is ok because of the "set_fs(KERNEL_DS)" */
-	iov.iov_base = (void __user *) (kaddr + offset);
+	struct msghdr msg = {.msg_flags = flags};
+	struct kvec iov;
+	char *kaddr = kmap(page);
+	iov.iov_base = kaddr + offset;
 	iov.iov_len = size;
-
-	old_fs = get_fs();
-	set_fs(KERNEL_DS);
-	res = sock_sendmsg(sock, &msg, size);
-	set_fs(old_fs);
-
+	res = kernel_sendmsg(sock, &msg, &iov, 1, size);
 	kunmap(page);
 	return res;
 }
diff -urN RC8-rc1-bk3-sys32_timer_create/net/econet/af_econet.c RC8-rc1-bk3-final-sans-XFS/net/econet/af_econet.c
--- RC8-rc1-bk3-sys32_timer_create/net/econet/af_econet.c	Wed Jul 14 13:47:14 2004
+++ RC8-rc1-bk3-final-sans-XFS/net/econet/af_econet.c	Thu Jul 15 04:11:12 2004
@@ -774,38 +774,22 @@
 
 static void aun_send_response(__u32 addr, unsigned long seq, int code, int cb)
 {
-	struct sockaddr_in sin;
-	struct iovec iov;
-	struct aunhdr ah;
+	struct sockaddr_in sin = {
+		.sin_family = AF_INET,
+		.sin_port = htons(AUN_PORT),
+		.sin_addr = {.s_addr = addr}
+	};
+	struct aunhdr ah = {.code = code, .cb = cb, .handle = seq};
+	struct kvec iov = {.iov_base = (void *)&ah, .iov_len = sizeof(ah)};
 	struct msghdr udpmsg;
-	int err;
-	mm_segment_t oldfs;
 	
-	memset(&sin, 0, sizeof(sin));
-	sin.sin_family = AF_INET;
-	sin.sin_port = htons(AUN_PORT);
-	sin.sin_addr.s_addr = addr;
-
-	ah.code = code;
-	ah.pad = 0;
-	ah.port = 0;
-	ah.cb = cb;
-	ah.handle = seq;
-
-	iov.iov_base = (void *)&ah;
-	iov.iov_len = sizeof(ah);
-
 	udpmsg.msg_name = (void *)&sin;
 	udpmsg.msg_namelen = sizeof(sin);
-	udpmsg.msg_iov = &iov;
-	udpmsg.msg_iovlen = 1;
 	udpmsg.msg_control = NULL;
 	udpmsg.msg_controllen = 0;
 	udpmsg.msg_flags=0;
 
-	oldfs = get_fs(); set_fs(KERNEL_DS);
-	err = sock_sendmsg(udpsock, &udpmsg, sizeof(ah));
-	set_fs(oldfs);
+	kernel_sendmsg(udpsock, &udpmsg, &iov, 1, sizeof(ah));
 }
 
 
diff -urN RC8-rc1-bk3-sys32_timer_create/net/ipv4/ipvs/ip_vs_sync.c RC8-rc1-bk3-final-sans-XFS/net/ipv4/ipvs/ip_vs_sync.c
--- RC8-rc1-bk3-sys32_timer_create/net/ipv4/ipvs/ip_vs_sync.c	Wed Jul 14 13:47:14 2004
+++ RC8-rc1-bk3-final-sans-XFS/net/ipv4/ipvs/ip_vs_sync.c	Thu Jul 15 04:11:12 2004
@@ -555,25 +555,15 @@
 static int
 ip_vs_send_async(struct socket *sock, const char *buffer, const size_t length)
 {
-	struct msghdr	msg;
-	mm_segment_t	oldfs;
-	struct iovec	iov;
+	struct msghdr	msg = {.msg_flags = MSG_DONTWAIT|MSG_NOSIGNAL};
+	struct kvec	iov;
 	int		len;
 
 	EnterFunction(7);
 	iov.iov_base     = (void *)buffer;
 	iov.iov_len      = length;
-	msg.msg_name     = 0;
-	msg.msg_namelen  = 0;
-	msg.msg_iov	 = &iov;
-	msg.msg_iovlen   = 1;
-	msg.msg_control  = NULL;
-	msg.msg_controllen = 0;
-	msg.msg_flags    = MSG_DONTWAIT|MSG_NOSIGNAL;
-
-	oldfs = get_fs(); set_fs(KERNEL_DS);
-	len = sock_sendmsg(sock, &msg, (size_t)(length));
-	set_fs(oldfs);
+
+	len = kernel_sendmsg(sock, &msg, &iov, 1, (size_t)(length));
 
 	LeaveFunction(7);
 	return len;
@@ -583,27 +573,17 @@
 static int
 ip_vs_receive(struct socket *sock, char *buffer, const size_t buflen)
 {
-	struct msghdr		msg;
-	struct iovec		iov;
+	struct msghdr		msg = {NULL,};
+	struct kvec		iov;
 	int			len;
-	mm_segment_t		oldfs;
 
 	EnterFunction(7);
 
 	/* Receive a packet */
 	iov.iov_base     = buffer;
 	iov.iov_len      = (size_t)buflen;
-	msg.msg_name     = NULL;
-	msg.msg_namelen  = 0;
-	msg.msg_iov	 = &iov;
-	msg.msg_iovlen   = 1;
-	msg.msg_control  = NULL;
-	msg.msg_controllen = 0;
-	msg.msg_flags    = 0;
-
-	oldfs = get_fs(); set_fs(KERNEL_DS);
-	len = sock_recvmsg(sock, &msg, buflen, 0);
-	set_fs(oldfs);
+
+	len = kernel_recvmsg(sock, &msg, &iov, 1, buflen, 0);
 
 	if (len < 0)
 		return -1;
diff -urN RC8-rc1-bk3-sys32_timer_create/net/rxrpc/connection.c RC8-rc1-bk3-final-sans-XFS/net/rxrpc/connection.c
--- RC8-rc1-bk3-sys32_timer_create/net/rxrpc/connection.c	Wed Jul 14 13:47:14 2004
+++ RC8-rc1-bk3-final-sans-XFS/net/rxrpc/connection.c	Thu Jul 15 04:11:12 2004
@@ -620,7 +620,6 @@
 		       struct rxrpc_message *msg)
 {
 	struct msghdr msghdr;
-	mm_segment_t oldfs;
 	int ret;
 
 	_enter("%p{%d}", conn, ntohs(conn->addr.sin_port));
@@ -634,12 +633,6 @@
 	/* set up the message to be transmitted */
 	msghdr.msg_name		= &conn->addr;
 	msghdr.msg_namelen	= sizeof(conn->addr);
-	/*
-	 * the following is safe, since for compiler definitions of kvec and
-	 * iovec are identical, yielding the same in-core layout and alignment
-	 */
-	msghdr.msg_iov		= (struct iovec *)msg->data;
-	msghdr.msg_iovlen	= msg->dcount;
 	msghdr.msg_control	= NULL;
 	msghdr.msg_controllen	= 0;
 	msghdr.msg_flags	= MSG_CONFIRM | MSG_DONTWAIT;
@@ -651,15 +644,11 @@
 	     htons(conn->addr.sin_port));
 
 	/* send the message */
-	oldfs = get_fs();
-	set_fs(KERNEL_DS);
-	ret = sock_sendmsg(conn->trans->socket, &msghdr, msg->dsize);
-	set_fs(oldfs);
-
+	ret = kernel_sendmsg(conn->trans->socket, &msghdr,
+			     msg->data, msg->dcount, msg->dsize);
 	if (ret < 0) {
 		msg->state = RXRPC_MSG_ERROR;
-	}
-	else {
+	} else {
 		msg->state = RXRPC_MSG_SENT;
 		ret = 0;
 
diff -urN RC8-rc1-bk3-sys32_timer_create/net/rxrpc/transport.c RC8-rc1-bk3-final-sans-XFS/net/rxrpc/transport.c
--- RC8-rc1-bk3-sys32_timer_create/net/rxrpc/transport.c	Wed Jul 14 13:47:14 2004
+++ RC8-rc1-bk3-final-sans-XFS/net/rxrpc/transport.c	Thu Jul 15 04:11:12 2004
@@ -612,7 +612,6 @@
 	struct sockaddr_in sin;
 	struct msghdr msghdr;
 	struct kvec iov[2];
-	mm_segment_t oldfs;
 	uint32_t _error;
 	int len, ret;
 
@@ -649,12 +648,6 @@
 
 	msghdr.msg_name		= &sin;
 	msghdr.msg_namelen	= sizeof(sin);
-	/*
-	 * the following is safe, since for compiler definitions of kvec and
-	 * iovec are identical, yielding the same in-core layout and alignment
-	 */
-	msghdr.msg_iov		= (struct iovec *)iov;
-	msghdr.msg_iovlen	= 2;
 	msghdr.msg_control	= NULL;
 	msghdr.msg_controllen	= 0;
 	msghdr.msg_flags	= MSG_DONTWAIT;
@@ -666,10 +659,7 @@
 	     htons(sin.sin_port));
 
 	/* send the message */
-	oldfs = get_fs();
-	set_fs(KERNEL_DS);
-	ret = sock_sendmsg(trans->socket, &msghdr, len);
-	set_fs(oldfs);
+	ret = kernel_sendmsg(trans->socket, &msghdr, iov, 2, len);
 
 	_leave(" = %d", ret);
 	return ret;
@@ -688,7 +678,6 @@
 	struct list_head connq, *_p;
 	struct errormsg emsg;
 	struct msghdr msg;
-	mm_segment_t oldfs;
 	uint16_t port;
 	int local, err;
 
@@ -700,17 +689,12 @@
 		/* try and receive an error message */
 		msg.msg_name	= &sin;
 		msg.msg_namelen	= sizeof(sin);
-		msg.msg_iov	= NULL;
-		msg.msg_iovlen	= 0;
 		msg.msg_control	= &emsg;
 		msg.msg_controllen = sizeof(emsg);
 		msg.msg_flags	= 0;
 
-		oldfs = get_fs();
-		set_fs(KERNEL_DS);
-		err = sock_recvmsg(trans->socket, &msg, 0,
+		err = kernel_recvmsg(trans->socket, &msg, NULL, 0, 0,
 				   MSG_ERRQUEUE | MSG_DONTWAIT | MSG_TRUNC);
-		set_fs(oldfs);
 
 		if (err == -EAGAIN) {
 			_leave("");
diff -urN RC8-rc1-bk3-sys32_timer_create/net/socket.c RC8-rc1-bk3-final-sans-XFS/net/socket.c
--- RC8-rc1-bk3-sys32_timer_create/net/socket.c	Sun Jul 11 20:42:19 2004
+++ RC8-rc1-bk3-final-sans-XFS/net/socket.c	Thu Jul 15 04:11:12 2004
@@ -559,6 +559,23 @@
 	return ret;
 }
 
+int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
+		   struct kvec *vec, size_t num, size_t size)
+{
+	mm_segment_t oldfs = get_fs();
+	int result;
+
+	set_fs(KERNEL_DS);
+	/*
+	 * the following is safe, since for compiler definitions of kvec and
+	 * iovec are identical, yielding the same in-core layout and alignment
+	 */
+	msg->msg_iov = (struct iovec *)vec,
+	msg->msg_iovlen = num;
+	result = sock_sendmsg(sock, msg, size);
+	set_fs(oldfs);
+	return result;
+}
 
 static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock, 
 				 struct msghdr *msg, size_t size, int flags)
@@ -594,6 +611,25 @@
 	return ret;
 }
 
+int kernel_recvmsg(struct socket *sock, struct msghdr *msg, 
+		   struct kvec *vec, size_t num,
+		   size_t size, int flags)
+{
+	mm_segment_t oldfs = get_fs();
+	int result;
+
+	set_fs(KERNEL_DS);
+	/*
+	 * the following is safe, since for compiler definitions of kvec and
+	 * iovec are identical, yielding the same in-core layout and alignment
+	 */
+	msg->msg_iov = (struct iovec *)vec,
+	msg->msg_iovlen = num;
+	result = sock_recvmsg(sock, msg, size, flags);
+	set_fs(oldfs);
+	return result;
+}
+
 static void sock_aio_dtor(struct kiocb *iocb)
 {
 	kfree(iocb->private);
@@ -2069,3 +2105,5 @@
 EXPORT_SYMBOL(sock_unregister);
 EXPORT_SYMBOL(sock_wake_async);
 EXPORT_SYMBOL(sockfd_lookup);
+EXPORT_SYMBOL(kernel_sendmsg);
+EXPORT_SYMBOL(kernel_recvmsg);
diff -urN RC8-rc1-bk3-sys32_timer_create/net/sunrpc/auth_gss/auth_gss.c RC8-rc1-bk3-final-sans-XFS/net/sunrpc/auth_gss/auth_gss.c
--- RC8-rc1-bk3-sys32_timer_create/net/sunrpc/auth_gss/auth_gss.c	Wed Jun 16 10:26:32 2004
+++ RC8-rc1-bk3-final-sans-XFS/net/sunrpc/auth_gss/auth_gss.c	Thu Jul 15 04:11:12 2004
@@ -417,7 +417,7 @@
 
 static ssize_t
 gss_pipe_upcall(struct file *filp, struct rpc_pipe_msg *msg,
-		char *dst, size_t buflen)
+		char __user *dst, size_t buflen)
 {
 	char *data = (char *)msg->data + msg->copied;
 	ssize_t mlen = msg->len;
@@ -439,7 +439,7 @@
 #define MSG_BUF_MAXSIZE 1024
 
 static ssize_t
-gss_pipe_downcall(struct file *filp, const char *src, size_t mlen)
+gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
 {
 	struct xdr_netobj obj = {
 		.len	= mlen,
@@ -697,7 +697,7 @@
 	struct rpc_rqst *req = task->tk_rqstp;
 	u32             maj_stat = 0;
 	struct xdr_netobj mic;
-	struct iovec	iov;
+	struct kvec	iov;
 	struct xdr_buf	verf_buf;
 	u32		service;
 
@@ -774,7 +774,7 @@
 						gc_base);
 	struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
 	u32		seq, qop_state;
-	struct iovec	iov;
+	struct kvec	iov;
 	struct xdr_buf	verf_buf;
 	struct xdr_netobj mic;
 	u32		flav,len;
@@ -830,7 +830,7 @@
 	u32             *integ_len = NULL;
 	struct xdr_netobj mic;
 	u32		offset, *q;
-	struct iovec	*iov;
+	struct kvec	*iov;
 	u32             maj_stat = 0;
 	int		status = -EIO;
 
diff -urN RC8-rc1-bk3-sys32_timer_create/net/sunrpc/auth_gss/svcauth_gss.c RC8-rc1-bk3-final-sans-XFS/net/sunrpc/auth_gss/svcauth_gss.c
--- RC8-rc1-bk3-sys32_timer_create/net/sunrpc/auth_gss/svcauth_gss.c	Sun Jul 11 20:42:19 2004
+++ RC8-rc1-bk3-final-sans-XFS/net/sunrpc/auth_gss/svcauth_gss.c	Thu Jul 15 04:11:12 2004
@@ -503,7 +503,7 @@
 }
 
 static inline int
-svc_safe_getnetobj(struct iovec *argv, struct xdr_netobj *o)
+svc_safe_getnetobj(struct kvec *argv, struct xdr_netobj *o)
 {
 	int l;
 
@@ -520,7 +520,7 @@
 }
 
 static inline int
-svc_safe_putnetobj(struct iovec *resv, struct xdr_netobj *o)
+svc_safe_putnetobj(struct kvec *resv, struct xdr_netobj *o)
 {
 	u32 *p;
 
@@ -548,8 +548,8 @@
 	struct xdr_buf		rpchdr;
 	struct xdr_netobj	checksum;
 	u32			flavor = 0;
-	struct iovec		*argv = &rqstp->rq_arg.head[0];
-	struct iovec		iov;
+	struct kvec		*argv = &rqstp->rq_arg.head[0];
+	struct kvec		iov;
 
 	/* data to compute the checksum over: */
 	iov.iov_base = rpcstart;
@@ -595,7 +595,7 @@
 	struct xdr_buf		verf_data;
 	struct xdr_netobj	mic;
 	u32			*p;
-	struct iovec		iov;
+	struct kvec		iov;
 
 	svc_putu32(rqstp->rq_res.head, htonl(RPC_AUTH_GSS));
 	xdr_seq = htonl(seq);
@@ -743,8 +743,8 @@
 static int
 svcauth_gss_accept(struct svc_rqst *rqstp, u32 *authp)
 {
-	struct iovec	*argv = &rqstp->rq_arg.head[0];
-	struct iovec	*resv = &rqstp->rq_res.head[0];
+	struct kvec	*argv = &rqstp->rq_arg.head[0];
+	struct kvec	*resv = &rqstp->rq_res.head[0];
 	u32		crlen;
 	struct xdr_netobj tmpobj;
 	struct gss_svc_data *svcdata = rqstp->rq_auth_data;
@@ -952,7 +952,7 @@
 	struct xdr_buf *resbuf = &rqstp->rq_res;
 	struct xdr_buf integ_buf;
 	struct xdr_netobj mic;
-	struct iovec *resv;
+	struct kvec *resv;
 	u32 *p;
 	int integ_offset, integ_len;
 	int stat = -EINVAL;
diff -urN RC8-rc1-bk3-sys32_timer_create/net/sunrpc/svc.c RC8-rc1-bk3-final-sans-XFS/net/sunrpc/svc.c
--- RC8-rc1-bk3-sys32_timer_create/net/sunrpc/svc.c	Wed Mar 17 15:30:07 2004
+++ RC8-rc1-bk3-final-sans-XFS/net/sunrpc/svc.c	Thu Jul 15 04:11:12 2004
@@ -257,8 +257,8 @@
 	struct svc_program	*progp;
 	struct svc_version	*versp = NULL;	/* compiler food */
 	struct svc_procedure	*procp = NULL;
-	struct iovec *		argv = &rqstp->rq_arg.head[0];
-	struct iovec *		resv = &rqstp->rq_res.head[0];
+	struct kvec *		argv = &rqstp->rq_arg.head[0];
+	struct kvec *		resv = &rqstp->rq_res.head[0];
 	kxdrproc_t		xdr;
 	u32			*statp;
 	u32			dir, prog, vers, proc,
diff -urN RC8-rc1-bk3-sys32_timer_create/net/sunrpc/svcauth_unix.c RC8-rc1-bk3-final-sans-XFS/net/sunrpc/svcauth_unix.c
--- RC8-rc1-bk3-sys32_timer_create/net/sunrpc/svcauth_unix.c	Wed Jun 16 10:26:32 2004
+++ RC8-rc1-bk3-final-sans-XFS/net/sunrpc/svcauth_unix.c	Thu Jul 15 04:11:12 2004
@@ -338,8 +338,8 @@
 static int
 svcauth_null_accept(struct svc_rqst *rqstp, u32 *authp)
 {
-	struct iovec	*argv = &rqstp->rq_arg.head[0];
-	struct iovec	*resv = &rqstp->rq_res.head[0];
+	struct kvec	*argv = &rqstp->rq_arg.head[0];
+	struct kvec	*resv = &rqstp->rq_res.head[0];
 	int		rv=0;
 	struct ip_map key, *ipm;
 
@@ -422,8 +422,8 @@
 int
 svcauth_unix_accept(struct svc_rqst *rqstp, u32 *authp)
 {
-	struct iovec	*argv = &rqstp->rq_arg.head[0];
-	struct iovec	*resv = &rqstp->rq_res.head[0];
+	struct kvec	*argv = &rqstp->rq_arg.head[0];
+	struct kvec	*resv = &rqstp->rq_res.head[0];
 	struct svc_cred	*cred = &rqstp->rq_cred;
 	u32		slen, i;
 	int		len   = argv->iov_len;
diff -urN RC8-rc1-bk3-sys32_timer_create/net/sunrpc/svcsock.c RC8-rc1-bk3-final-sans-XFS/net/sunrpc/svcsock.c
--- RC8-rc1-bk3-sys32_timer_create/net/sunrpc/svcsock.c	Sun Jul 11 20:42:20 2004
+++ RC8-rc1-bk3-final-sans-XFS/net/sunrpc/svcsock.c	Thu Jul 15 04:11:12 2004
@@ -450,9 +450,8 @@
  * Generic recvfrom routine.
  */
 static int
-svc_recvfrom(struct svc_rqst *rqstp, struct iovec *iov, int nr, int buflen)
+svc_recvfrom(struct svc_rqst *rqstp, struct kvec *iov, int nr, int buflen)
 {
-	mm_segment_t	oldfs;
 	struct msghdr	msg;
 	struct socket	*sock;
 	int		len, alen;
@@ -462,16 +461,12 @@
 
 	msg.msg_name    = &rqstp->rq_addr;
 	msg.msg_namelen = sizeof(rqstp->rq_addr);
-	msg.msg_iov     = iov;
-	msg.msg_iovlen  = nr;
 	msg.msg_control = NULL;
 	msg.msg_controllen = 0;
 
 	msg.msg_flags	= MSG_DONTWAIT;
 
-	oldfs = get_fs(); set_fs(KERNEL_DS);
-	len = sock_recvmsg(sock, &msg, buflen, MSG_DONTWAIT);
-	set_fs(oldfs);
+	len = kernel_recvmsg(sock, &msg, iov, nr, buflen, MSG_DONTWAIT);
 
 	/* sock_recvmsg doesn't fill in the name/namelen, so we must..
 	 * possibly we should cache this in the svc_sock structure
@@ -898,7 +893,7 @@
 	struct svc_sock	*svsk = rqstp->rq_sock;
 	struct svc_serv	*serv = svsk->sk_server;
 	int		len;
-	struct iovec vec[RPCSVC_MAXPAGES];
+	struct kvec vec[RPCSVC_MAXPAGES];
 	int pnum, vlen;
 
 	dprintk("svc: tcp_recv %p data %d conn %d close %d\n",
@@ -942,7 +937,7 @@
 	 */
 	if (svsk->sk_tcplen < 4) {
 		unsigned long	want = 4 - svsk->sk_tcplen;
-		struct iovec	iov;
+		struct kvec	iov;
 
 		iov.iov_base = ((char *) &svsk->sk_reclen) + svsk->sk_tcplen;
 		iov.iov_len  = want;
@@ -1056,8 +1051,8 @@
 	int sent;
 	u32 reclen;
 
-	/* Set up the first element of the reply iovec.
-	 * Any other iovecs that may be in use have been taken
+	/* Set up the first element of the reply kvec.
+	 * Any other kvecs that may be in use have been taken
 	 * care of by the server implementation itself.
 	 */
 	reclen = htonl(0x80000000|((xbufp->len ) - 4));
diff -urN RC8-rc1-bk3-sys32_timer_create/net/sunrpc/xdr.c RC8-rc1-bk3-final-sans-XFS/net/sunrpc/xdr.c
--- RC8-rc1-bk3-sys32_timer_create/net/sunrpc/xdr.c	Mon May 10 00:23:51 2004
+++ RC8-rc1-bk3-final-sans-XFS/net/sunrpc/xdr.c	Thu Jul 15 04:11:12 2004
@@ -141,7 +141,7 @@
 xdr_encode_pages(struct xdr_buf *xdr, struct page **pages, unsigned int base,
 		 unsigned int len)
 {
-	struct iovec *tail = xdr->tail;
+	struct kvec *tail = xdr->tail;
 	u32 *p;
 
 	xdr->pages = pages;
@@ -168,8 +168,8 @@
 xdr_inline_pages(struct xdr_buf *xdr, unsigned int offset,
 		 struct page **pages, unsigned int base, unsigned int len)
 {
-	struct iovec *head = xdr->head;
-	struct iovec *tail = xdr->tail;
+	struct kvec *head = xdr->head;
+	struct kvec *tail = xdr->tail;
 	char *buf = (char *)head->iov_base;
 	unsigned int buflen = head->iov_len;
 
@@ -186,19 +186,19 @@
 }
 
 /*
- * Realign the iovec if the server missed out some reply elements
+ * Realign the kvec if the server missed out some reply elements
  * (such as post-op attributes,...)
  * Note: This is a simple implementation that assumes that
  *            len <= iov->iov_len !!!
  *       The RPC header (assumed to be the 1st element in the iov array)
  *            is not shifted.
  */
-void xdr_shift_iovec(struct iovec *iov, int nr, size_t len)
+void xdr_shift_iovec(struct kvec *iov, int nr, size_t len)
 {
-	struct iovec *pvec;
+	struct kvec *pvec;
 
 	for (pvec = iov + nr - 1; nr > 1; nr--, pvec--) {
-		struct iovec *svec = pvec - 1;
+		struct kvec *svec = pvec - 1;
 
 		if (len > pvec->iov_len) {
 			printk(KERN_DEBUG "RPC: Urk! Large shift of short iovec.\n");
@@ -217,11 +217,11 @@
 }
 
 /*
- * Map a struct xdr_buf into an iovec array.
+ * Map a struct xdr_buf into an kvec array.
  */
-int xdr_kmap(struct iovec *iov_base, struct xdr_buf *xdr, size_t base)
+int xdr_kmap(struct kvec *iov_base, struct xdr_buf *xdr, size_t base)
 {
-	struct iovec	*iov = iov_base;
+	struct kvec	*iov = iov_base;
 	struct page	**ppage = xdr->pages;
 	unsigned int	len, pglen = xdr->page_len;
 
@@ -371,11 +371,10 @@
 	unsigned int len, pglen = xdr->page_len;
 	int err, ret = 0;
 	ssize_t (*sendpage)(struct socket *, struct page *, int, size_t, int);
-	mm_segment_t oldfs;
 
 	len = xdr->head[0].iov_len;
 	if (base < len || (addr != NULL && base == 0)) {
-		struct iovec iov = {
+		struct kvec iov = {
 			.iov_base = xdr->head[0].iov_base + base,
 			.iov_len  = len - base,
 		};
@@ -384,16 +383,13 @@
 			.msg_namelen = addrlen,
 			.msg_flags   = msgflags,
 		};
-
-		if (iov.iov_len != 0) {
-			msg.msg_iov     = &iov;
-			msg.msg_iovlen  = 1;
-		}
 		if (xdr->len > len)
 			msg.msg_flags |= MSG_MORE;
-		oldfs = get_fs(); set_fs(get_ds());
-		err = sock_sendmsg(sock, &msg, iov.iov_len);
-		set_fs(oldfs);
+
+		if (iov.iov_len != 0)
+			err = kernel_sendmsg(sock, &msg, &iov, 1, iov.iov_len);
+		else
+			err = kernel_sendmsg(sock, &msg, NULL, 0, 0);
 		if (ret == 0)
 			ret = err;
 		else if (err > 0)
@@ -446,18 +442,14 @@
 copy_tail:
 	len = xdr->tail[0].iov_len;
 	if (base < len) {
-		struct iovec iov = {
+		struct kvec iov = {
 			.iov_base = xdr->tail[0].iov_base + base,
 			.iov_len  = len - base,
 		};
 		struct msghdr msg = {
-			.msg_iov     = &iov,
-			.msg_iovlen  = 1,
 			.msg_flags   = msgflags,
 		};
-		oldfs = get_fs(); set_fs(get_ds());
-		err = sock_sendmsg(sock, &msg, iov.iov_len);
-		set_fs(oldfs);
+		err = kernel_sendmsg(sock, &msg, &iov, 1, iov.iov_len);
 		if (ret == 0)
 			ret = err;
 		else if (err > 0)
@@ -614,14 +606,14 @@
  * @buf: xdr_buf
  * @len: bytes to remove from buf->head[0]
  *
- * Shrinks XDR buffer's header iovec buf->head[0] by 
+ * Shrinks XDR buffer's header kvec buf->head[0] by 
  * 'len' bytes. The extra data is not lost, but is instead
  * moved into the inlined pages and/or the tail.
  */
 void
 xdr_shrink_bufhead(struct xdr_buf *buf, size_t len)
 {
-	struct iovec *head, *tail;
+	struct kvec *head, *tail;
 	size_t copy, offs;
 	unsigned int pglen = buf->page_len;
 
@@ -694,7 +686,7 @@
 void
 xdr_shrink_pagelen(struct xdr_buf *buf, size_t len)
 {
-	struct iovec *tail;
+	struct kvec *tail;
 	size_t copy;
 	char *p;
 	unsigned int pglen = buf->page_len;
@@ -738,15 +730,15 @@
  * @p: current pointer inside XDR buffer
  *
  * Note: at the moment the RPC client only passes the length of our
- *	 scratch buffer in the xdr_buf's header iovec. Previously this
+ *	 scratch buffer in the xdr_buf's header kvec. Previously this
  *	 meant we needed to call xdr_adjust_iovec() after encoding the
  *	 data. With the new scheme, the xdr_stream manages the details
- *	 of the buffer length, and takes care of adjusting the iovec
+ *	 of the buffer length, and takes care of adjusting the kvec
  *	 length for us.
  */
 void xdr_init_encode(struct xdr_stream *xdr, struct xdr_buf *buf, uint32_t *p)
 {
-	struct iovec *iov = buf->head;
+	struct kvec *iov = buf->head;
 
 	xdr->buf = buf;
 	xdr->iov = iov;
@@ -763,7 +755,7 @@
  *
  * Checks that we have enough buffer space to encode 'nbytes' more
  * bytes of data. If so, update the total xdr_buf length, and
- * adjust the length of the current iovec.
+ * adjust the length of the current kvec.
  */
 uint32_t * xdr_reserve_space(struct xdr_stream *xdr, size_t nbytes)
 {
@@ -795,7 +787,7 @@
 		 unsigned int len)
 {
 	struct xdr_buf *buf = xdr->buf;
-	struct iovec *iov = buf->tail;
+	struct kvec *iov = buf->tail;
 	buf->pages = pages;
 	buf->page_base = base;
 	buf->page_len = len;
@@ -826,7 +818,7 @@
  */
 void xdr_init_decode(struct xdr_stream *xdr, struct xdr_buf *buf, uint32_t *p)
 {
-	struct iovec *iov = buf->head;
+	struct kvec *iov = buf->head;
 	unsigned int len = iov->iov_len;
 
 	if (len > buf->len)
@@ -873,7 +865,7 @@
 void xdr_read_pages(struct xdr_stream *xdr, unsigned int len)
 {
 	struct xdr_buf *buf = xdr->buf;
-	struct iovec *iov;
+	struct kvec *iov;
 	ssize_t shift;
 	unsigned int end;
 	int padding;
@@ -905,10 +897,10 @@
 }
 EXPORT_SYMBOL(xdr_read_pages);
 
-static struct iovec empty_iov = {.iov_base = NULL, .iov_len = 0};
+static struct kvec empty_iov = {.iov_base = NULL, .iov_len = 0};
 
 void
-xdr_buf_from_iov(struct iovec *iov, struct xdr_buf *buf)
+xdr_buf_from_iov(struct kvec *iov, struct xdr_buf *buf)
 {
 	buf->head[0] = *iov;
 	buf->tail[0] = empty_iov;
@@ -921,7 +913,7 @@
  * length of subiov to zero.  Decrements len by length of subiov, sets base
  * to zero (or decrements it by length of iov if subiov is empty). */
 static void
-iov_subsegment(struct iovec *iov, struct iovec *subiov, int *base, int *len)
+iov_subsegment(struct kvec *iov, struct kvec *subiov, int *base, int *len)
 {
 	if (*base > iov->iov_len) {
 		subiov->iov_base = NULL;