Don't rely on my quick check too much, but everything (in the rmap area: I've lost track of 4-by-4 for now) looked just right: very impressed to find KM_FILLER remembered in kmap_types.h! Didn't build or boot. I did the rmap 20 i_mmap_shared into i_mmap patch last week, but ran out of energy before completing tests, won't get back to it until tomorrow: hopefully send you and Andrew and LKML then. There was a report of BUG in my exit_rmap, I posted what might be the fix, we're waiting to hear. Patch below, it won't do any harm anyway, you might like to include it, or you may prefer to wait to hear that it's really the fix. diff -upN reference/mm/rmap.c current/mm/rmap.c --- reference/mm/rmap.c 2004-05-09 13:43:59.000000000 -0700 +++ current/mm/rmap.c 2004-05-09 13:43:59.000000000 -0700 @@ -103,6 +103,7 @@ void exit_rmap(struct mm_struct *mm) { struct anonmm *anonmm = mm->anonmm; struct anonmm *anonhd = anonmm->head; + int anonhd_count; mm->anonmm = NULL; spin_lock(&anonhd->lock); @@ -114,8 +115,9 @@ void exit_rmap(struct mm_struct *mm) if (atomic_dec_and_test(&anonhd->count)) BUG(); } + anonhd_count = atomic_read(&anonhd->count); spin_unlock(&anonhd->lock); - if (atomic_read(&anonhd->count) == 1) { + if (anonhd_count == 1) { BUG_ON(anonhd->mm); BUG_ON(!list_empty(&anonhd->list)); kmem_cache_free(anonmm_cachep, anonhd);