diff --git a/CHANGELOG b/CHANGELOG
index 217fa4eff3..5a26bfa99e 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -2,6 +2,12 @@
 Changes since U-Boot 1.1.1:
 ======================================================================
 
+* Clean up CMC PU2 flash driver
+
+* Update MAINTAINERS file
+
+* Fix bug in MPC823 LCD driver
+
 * Fix udelay() on AT91RM9200 for delays < 1 ms.
 
 * Enable long help on CMC PU2 board;
diff --git a/MAINTAINERS b/MAINTAINERS
index bd497b8b5a..a9e9a400bd 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -209,6 +209,13 @@ Frank Panno <fpanno@delphintech.com>
 
 	ep8260			MPC8260
 
+Peter Pearse <peter.pearse@arm.com>
+
+	Integrator/AP		CM 926EJ-S, CM7x0T, CM9x0T  
+	Integrator/CP		CM 926EJ-S  CM920T, CM940T, CM922T-XA10
+	Versatile/AB		ARM926EJ-S
+	Versatile/PB		ARM926EJ-S 
+
 Denis Peter <d.peter@mpl.ch>
 
 	MIP405			PPC4xx
diff --git a/Makefile b/Makefile
index f2965f7886..e19a561e11 100644
--- a/Makefile
+++ b/Makefile
@@ -1197,12 +1197,12 @@ xtract_omap1610xxx = $(subst _cs0boot,,$(subst _cs3boot,,$(subst _cs_autoboot,,$
 
 xtract_omap730p2 = $(subst _cs0boot,,$(subst _cs3boot,, $(subst _config,,$1)))
 
-integratorcp_config :	unconfig
-	@./mkconfig $(@:_config=) arm arm926ejs integratorcp
-
 integratorap_config :	unconfig
 	@./mkconfig $(@:_config=) arm arm926ejs integratorap
 
+integratorcp_config :	unconfig
+	@./mkconfig $(@:_config=) arm arm926ejs integratorcp
+
 lpd7a400_config \
 lpd7a404_config:	unconfig
 	@./mkconfig $(@:_config=) arm lh7a40x lpd7a40x
diff --git a/README b/README
index 294f8f704d..bb4c90abc4 100644
--- a/README
+++ b/README
@@ -1977,9 +1977,9 @@ Low Level (hardware related) configuration options:
 		source code. It is used to make hardware dependant
 		initializations.
 
-- CFG_IMMR:	Physical address of the Internal Memory Mapped
-		Register; DO NOT CHANGE! (11-4)
-		[MPC8xx systems only]
+- CFG_IMMR:	Physical address of the Internal Memory.
+                DO NOT CHANGE unless you know exactly what you're
+		doing! (11-4) [MPC8xx/82xx systems only]
 
 - CFG_INIT_RAM_ADDR:
 
diff --git a/board/cmc_pu2/flash.c b/board/cmc_pu2/flash.c
index 9baa473bdf..6105d56649 100644
--- a/board/cmc_pu2/flash.c
+++ b/board/cmc_pu2/flash.c
@@ -37,11 +37,11 @@ flash_info_t	flash_info[CFG_MAX_FLASH_BANKS]; /* info for FLASH chips */
 typedef unsigned short FLASH_PORT_WIDTH;
 typedef volatile unsigned short FLASH_PORT_WIDTHV;
 
-#define FPW	FLASH_PORT_WIDTH
-#define FPWV	FLASH_PORT_WIDTHV
+#define FPW  FLASH_PORT_WIDTH
+#define FPWV FLASH_PORT_WIDTHV
 
 #define FLASH_CYCLE1	0x0555
-#define FLASH_CYCLE2	0x02aa
+#define FLASH_CYCLE2	0x02AA
 
 /*-----------------------------------------------------------------------
  * Functions
@@ -96,9 +96,9 @@ static void flash_reset(flash_info_t *info)
 
 	/* Put FLASH back in read mode */
 	if ((info->flash_id & FLASH_VENDMASK) == FLASH_MAN_INTEL)
-		*base = (FPW)0x00FF00FF;	/* Intel Read Mode */
+		*base = (FPW)0x00FF;	/* Intel Read Mode */
 	else if ((info->flash_id & FLASH_VENDMASK) == FLASH_MAN_AMD)
-		*base = (FPW)0x00F000F0;	/* AMD Read Mode */
+		*base = (FPW)0x00F0;	/* AMD Read Mode */
 }
 
 /*-----------------------------------------------------------------------
@@ -183,9 +183,9 @@ ulong flash_get_size (FPWV *addr, flash_info_t *info)
 
 	/* Write auto select command: read Manufacturer ID */
 	/* Write auto select command sequence and test FLASH answer */
-	addr[FLASH_CYCLE1] = (FPW)0x00AA00AA;	/* for AMD, Intel ignores this */
-	addr[FLASH_CYCLE2] = (FPW)0x00550055;	/* for AMD, Intel ignores this */
-	addr[FLASH_CYCLE1] = (FPW)0x00900090;	/* selects Intel or AMD */
+	addr[FLASH_CYCLE1] = (FPW)0x00AA;	/* for AMD, Intel ignores this */
+	addr[FLASH_CYCLE2] = (FPW)0x0055;	/* for AMD, Intel ignores this */
+	addr[FLASH_CYCLE1] = (FPW)0x0090;	/* selects Intel or AMD */
 
 	/* The manufacturer codes are only 1 byte, so just use 1 byte.
 	 * This works for any bus width and any FLASH device width.
@@ -262,7 +262,7 @@ ulong flash_get_size (FPWV *addr, flash_info_t *info)
 int	flash_erase (flash_info_t *info, int s_first, int s_last)
 {
 	FPWV *addr = (FPWV *)(info->start[0]);
-	int flag, prot, sect, l_sect;
+	int flag, prot, sect, ssect, l_sect;
 	ulong start, now, last;
 
 	printf ("flash_erase: first: %d last: %d\n", s_first, s_last);
@@ -297,58 +297,70 @@ int	flash_erase (flash_info_t *info, int s_first, int s_last)
 		printf ("\n");
 	}
 
-	l_sect = -1;
-
 	/* Disable interrupts which might cause a timeout here */
 	flag = disable_interrupts();
 
-	addr[0x0555] = 0x00AA;
-	addr[0x02AA] = 0x0055;
-	addr[0x0555] = 0x0080;
-	addr[0x0555] = 0x00AA;
-	addr[0x02AA] = 0x0055;
+	/*
+	 * Start erase on unprotected sectors.
+	 * Since the flash can erase multiple sectors with one command
+	 * we take advantage of that by doing the erase in chunks of
+	 * 3 sectors.
+	 */
+	for (sect = s_first; sect <= s_last; ) {
+		l_sect = -1;
 
-	/* Start erase on unprotected sectors */
-	for (sect = s_first; sect<=s_last; sect++) {
-		if (info->protect[sect] == 0) {	/* not protected */
-			addr = (FPWV *)(info->start[sect]);
-			addr[0] = 0x0030;
-			l_sect = sect;
+		addr[FLASH_CYCLE1] = 0x00AA;
+		addr[FLASH_CYCLE2] = 0x0055;
+		addr[FLASH_CYCLE1] = 0x0080;
+		addr[FLASH_CYCLE1] = 0x00AA;
+		addr[FLASH_CYCLE2] = 0x0055;
+
+		/* do the erase in chunks of at most 3 sectors */
+		for (ssect = 0; ssect < 3; ssect++) {
+			if ((sect + ssect) > s_last)
+				break;
+			if (info->protect[sect + ssect] == 0) {	/* not protected */
+				addr = (FPWV *)(info->start[sect + ssect]);
+				addr[0] = 0x0030;
+				l_sect = sect + ssect;
+			}
 		}
+		/* wait at least 80us - let's wait 1 ms */
+		udelay (1000);
+
+		/*
+		 * We wait for the last triggered sector
+		 */
+		if (l_sect < 0)
+			goto DONE;
+
+		start = get_timer (0);
+		last  = start;
+		addr = (FPWV *)(info->start[l_sect]);
+		while ((addr[0] & 0x0080) != 0x0080) {
+			if ((now = get_timer(start)) > CFG_FLASH_ERASE_TOUT) {
+				printf ("Timeout\n");
+				return 1;
+			}
+			/* show that we're waiting */
+			if ((now - last) > 1000) {	/* every second */
+				putc ('.');
+				last = now;
+			}
+		}
+		addr = (FPWV *)info->start[0];
+		addr[0] = 0x00F0;	/* reset bank */
+		sect += ssect;
 	}
 
 	/* re-enable interrupts if necessary */
 	if (flag)
 		enable_interrupts();
 
-	/* wait at least 80us - let's wait 1 ms */
-	udelay (1000);
-
-	/*
-	 * We wait for the last triggered sector
-	 */
-	if (l_sect < 0)
-		goto DONE;
-
-	start = get_timer (0);
-	last  = start;
-	addr = (FPWV *)(info->start[l_sect]);
-	while ((addr[0] & 0x00000080) != 0x00000080) {
-		if ((now = get_timer(start)) > CFG_FLASH_ERASE_TOUT) {
-			printf ("Timeout\n");
-			return 1;
-		}
-		/* show that we're waiting */
-		if ((now - last) > 1000) {	/* every second */
-			putc ('.');
-			last = now;
-		}
-		}
-
 DONE:
 	/* reset to read mode */
 	addr = (FPWV *)info->start[0];
-	addr[0] = 0x000000F0;	/* reset bank */
+	addr[0] = 0x00F0;	/* reset bank */
 
 	printf (" done\n");
 	return 0;
@@ -432,9 +444,9 @@ static int write_word_amd (flash_info_t *info, FPWV *dest, FPW data)
 	/* Disable interrupts which might cause a timeout here */
 	flag = disable_interrupts();
 
-	base[FLASH_CYCLE1] = (FPW)0x00AA00AA;	/* unlock */
-	base[FLASH_CYCLE2] = (FPW)0x00550055;	/* unlock */
-	base[FLASH_CYCLE1] = (FPW)0x00A000A0;	/* selects program mode */
+	base[FLASH_CYCLE1] = (FPW)0x00AA;	/* unlock */
+	base[FLASH_CYCLE2] = (FPW)0x0055;	/* unlock */
+	base[FLASH_CYCLE1] = (FPW)0x00A0;	/* selects program mode */
 
 	*dest = data;		/* start programming the data	*/
 
@@ -445,9 +457,9 @@ static int write_word_amd (flash_info_t *info, FPWV *dest, FPW data)
 	start = get_timer (0);
 
 	/* data polling for D7 */
-	while ((*dest & (FPW)0x00000080) != (data & (FPW)0x00000080)) {
+	while ((*dest & (FPW)0x0080) != (data & (FPW)0x0080)) {
 		if (get_timer(start) > CFG_FLASH_WRITE_TOUT) {
-			*dest = (FPW)0x000000F0;	/* reset bank */
+			*dest = (FPW)0x00F0;	/* reset bank */
 			return (1);
 		}
 	}
diff --git a/common/lcd.c b/common/lcd.c
index 85b44cad15..d3ecd925fc 100644
--- a/common/lcd.c
+++ b/common/lcd.c
@@ -620,6 +620,8 @@ int lcd_display_bitmap(ulong bmp_image, int x, int y)
 		cmap = (ushort *)fbi->palette;
 #elif defined(CONFIG_MPC823)
 		cmap = (ushort *)&(cp->lcd_cmap[255*sizeof(ushort)]);
+#else
+# error "Don't know location of color map"
 #endif
 
 		/* Set color map */
@@ -631,9 +633,14 @@ int lcd_display_bitmap(ulong bmp_image, int x, int y)
 				( (cte.blue) & 0x001f) ;
 
 #ifdef CFG_INVERT_COLORS
-			*cmap++ = 0xffff - colreg;
+			*cmap = 0xffff - colreg;
 #else
-			*cmap++ = colreg;
+			*cmap = colreg;
+#endif
+#if defined(CONFIG_PXA250)
+			cmap++;
+#elif defined(CONFIG_MPC823)
+			cmap--;
 #endif
 		}
 	}
diff --git a/doc/README.NetConsole b/doc/README.NetConsole
index aa13627659..3a572931c5 100644
--- a/doc/README.NetConsole
+++ b/doc/README.NetConsole
@@ -25,7 +25,7 @@ nc -u ${TARGET_IP} 6666
 stty icanon echo intr ^C
 +++++++++++++++++++++++++++++++++++++++++++
 
-It turned out that 'netcat' couldn't be used to listen to broadcast
+It turns out that 'netcat' cannot be used to listen to broadcast
 packets. We developed our own tool 'ncb' (see tools directory) that
 listens to broadcast packets on a given port and dumps them to the
 standard output. use it as follows:
@@ -87,3 +87,6 @@ To browse the Linux network console output, use the 'netcat' tool invoked
 as follows:
 
 	nc -u -l -p 6666
+
+Note that unlike the U-Boot implementation the Linux netconsole is
+unidirectional, i. e. you have console output only in Linux.