Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6 into rmobile-latest

Conflicts:
	arch/arm/mach-shmobile/Kconfig

Signed-off-by: Paul Mundt <lethal@linux-sh.org>

17 files changed, 260 insertions, 264 deletions

diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index 8206842ddd9e..fcc1e628e050 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -382,6 +382,12 @@ config CPU_FEROCEON_OLD_ID
           for which the CPU ID is equal to the ARM926 ID.
           Relevant for Feroceon-1850 and early Feroceon-2850.
 
+# Marvell PJ4
+config CPU_PJ4
+        bool
+        select CPU_V7
+        select ARM_THUMBEE
+
 # ARMv6
 config CPU_V6
         bool "Support ARM V6 processor" if ARCH_INTEGRATOR || MACH_REALVIEW_EB || MACH_REALVIEW_PBX || ARCH_DOVE
@@ -599,6 +605,14 @@ config CPU_CP15_MPU
         help
           Processor has the CP15 register, which has MPU related registers.
 
+config CPU_USE_DOMAINS
+        bool
+        depends on MMU
+        default y if !CPU_32v6K
+        help
+          This option enables or disables the use of domain switching
+          via the set_fs() function.
+
 #
 # CPU supports 36-bit I/O
 #
@@ -628,6 +642,33 @@ config ARM_THUMBEE
           Say Y here if you have a CPU with the ThumbEE extension and code to
           make use of it. Say N for code that can run on CPUs without ThumbEE.
 
+config SWP_EMULATE
+        bool "Emulate SWP/SWPB instructions"
+        depends on CPU_V7
+        select HAVE_PROC_CPU if PROC_FS
+        default y if SMP
+        help
+          ARMv6 architecture deprecates use of the SWP/SWPB instructions.
+          ARMv7 multiprocessing extensions introduce the ability to disable
+          these instructions, triggering an undefined instruction exception
+          when executed. Say Y here to enable software emulation of these
+          instructions for userspace (not kernel) using LDREX/STREX.
+          Also creates /proc/cpu/swp_emulation for statistics.
+
+          In some older versions of glibc [<=2.8] SWP is used during futex
+          trylock() operations with the assumption that the code will not
+          be preempted. This invalid assumption may be more likely to fail
+          with SWP emulation enabled, leading to deadlock of the user
+          application.
+
+          NOTE: when accessing uncached shared regions, LDREX/STREX rely
+          on an external transaction monitoring block called a global
+          monitor to maintain update atomicity. If your system does not
+          implement a global monitor, this option can cause programs that
+          perform SWP operations to uncached memory to deadlock.
+
+          If unsure, say Y.
+
 config CPU_BIG_ENDIAN
         bool "Build big-endian kernel"
         depends on ARCH_SUPPORTS_BIG_ENDIAN
@@ -789,7 +830,7 @@ config CACHE_PL310
 
 config CACHE_TAUROS2
         bool "Enable the Tauros2 L2 cache controller"
-        depends on (ARCH_DOVE || ARCH_MMP)
+        depends on (ARCH_DOVE || ARCH_MMP || CPU_PJ4)
         default y
         select OUTER_CACHE
         help
diff --git a/arch/arm/mm/Makefile b/arch/arm/mm/Makefile
index d63b6c413758..00d74a04af3a 100644
--- a/arch/arm/mm/Makefile
+++ b/arch/arm/mm/Makefile
@@ -5,8 +5,8 @@
 obj-y                           := dma-mapping.o extable.o fault.o init.o \
                                    iomap.o
 
-obj-$(CONFIG_MMU)               += fault-armv.o flush.o ioremap.o mmap.o \
-                                   pgd.o mmu.o vmregion.o
+obj-$(CONFIG_MMU)               += fault-armv.o flush.o idmap.o ioremap.o \
+                                   mmap.o pgd.o mmu.o vmregion.o
 
 ifneq ($(CONFIG_MMU),y)
 obj-y                           += nommu.o
diff --git a/arch/arm/mm/cache-feroceon-l2.c b/arch/arm/mm/cache-feroceon-l2.c
index 6e77c042d8e9..e0b0e7a4ec68 100644
--- a/arch/arm/mm/cache-feroceon-l2.c
+++ b/arch/arm/mm/cache-feroceon-l2.c
@@ -13,13 +13,9 @@
  */
 
 #include <linux/init.h>
+#include <linux/highmem.h>
 #include <asm/cacheflush.h>
-#include <asm/kmap_types.h>
-#include <asm/fixmap.h>
-#include <asm/pgtable.h>
-#include <asm/tlbflush.h>
 #include <plat/cache-feroceon-l2.h>
-#include "mm.h"
 
 /*
  * Low-level cache maintenance operations.
@@ -39,27 +35,30 @@
  * between which we don't want to be preempted.
  */
 
-static inline unsigned long l2_start_va(unsigned long paddr)
+static inline unsigned long l2_get_va(unsigned long paddr)
 {
 #ifdef CONFIG_HIGHMEM
         /*
-         * Let's do our own fixmap stuff in a minimal way here.
          * Because range ops can't be done on physical addresses,
          * we simply install a virtual mapping for it only for the
          * TLB lookup to occur, hence no need to flush the untouched
-         * memory mapping.  This is protected with the disabling of
-         * interrupts by the caller.
+         * memory mapping afterwards (note: a cache flush may happen
+         * in some circumstances depending on the path taken in kunmap_atomic).
          */
-        unsigned long idx = KM_L2_CACHE + KM_TYPE_NR * smp_processor_id();
-        unsigned long vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
-        set_pte_ext(TOP_PTE(vaddr), pfn_pte(paddr >> PAGE_SHIFT, PAGE_KERNEL), 0);
-        local_flush_tlb_kernel_page(vaddr);
-        return vaddr + (paddr & ~PAGE_MASK);
+        void *vaddr = kmap_atomic_pfn(paddr >> PAGE_SHIFT);
+        return (unsigned long)vaddr + (paddr & ~PAGE_MASK);
 #else
         return __phys_to_virt(paddr);
 #endif
 }
 
+static inline void l2_put_va(unsigned long vaddr)
+{
+#ifdef CONFIG_HIGHMEM
+        kunmap_atomic((void *)vaddr);
+#endif
+}
+
 static inline void l2_clean_pa(unsigned long addr)
 {
         __asm__("mcr p15, 1, %0, c15, c9, 3" : : "r" (addr));
@@ -76,13 +75,14 @@ static inline void l2_clean_pa_range(unsigned long start, unsigned long end)
          */
         BUG_ON((start ^ end) >> PAGE_SHIFT);
 
-        raw_local_irq_save(flags);
-        va_start = l2_start_va(start);
+        va_start = l2_get_va(start);
         va_end = va_start + (end - start);
+        raw_local_irq_save(flags);
         __asm__("mcr p15, 1, %0, c15, c9, 4\n\t"
                 "mcr p15, 1, %1, c15, c9, 5"
                 : : "r" (va_start), "r" (va_end));
         raw_local_irq_restore(flags);
+        l2_put_va(va_start);
 }
 
 static inline void l2_clean_inv_pa(unsigned long addr)
@@ -106,13 +106,14 @@ static inline void l2_inv_pa_range(unsigned long start, unsigned long end)
          */
         BUG_ON((start ^ end) >> PAGE_SHIFT);
 
-        raw_local_irq_save(flags);
-        va_start = l2_start_va(start);
+        va_start = l2_get_va(start);
         va_end = va_start + (end - start);
+        raw_local_irq_save(flags);
         __asm__("mcr p15, 1, %0, c15, c11, 4\n\t"
                 "mcr p15, 1, %1, c15, c11, 5"
                 : : "r" (va_start), "r" (va_end));
         raw_local_irq_restore(flags);
+        l2_put_va(va_start);
 }
 
 static inline void l2_inv_all(void)
diff --git a/arch/arm/mm/cache-xsc3l2.c b/arch/arm/mm/cache-xsc3l2.c
index c3154928bccd..5a32020471e3 100644
--- a/arch/arm/mm/cache-xsc3l2.c
+++ b/arch/arm/mm/cache-xsc3l2.c
@@ -17,14 +17,10 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  */
 #include <linux/init.h>
+#include <linux/highmem.h>
 #include <asm/system.h>
 #include <asm/cputype.h>
 #include <asm/cacheflush.h>
-#include <asm/kmap_types.h>
-#include <asm/fixmap.h>
-#include <asm/pgtable.h>
-#include <asm/tlbflush.h>
-#include "mm.h"
 
 #define CR_L2   (1 << 26)
 
@@ -71,16 +67,15 @@ static inline void xsc3_l2_inv_all(void)
         dsb();
 }
 
+static inline void l2_unmap_va(unsigned long va)
+{
 #ifdef CONFIG_HIGHMEM
-#define l2_map_save_flags(x)            raw_local_save_flags(x)
-#define l2_map_restore_flags(x)         raw_local_irq_restore(x)
-#else
-#define l2_map_save_flags(x)            ((x) = 0)
-#define l2_map_restore_flags(x)         ((void)(x))
+        if (va != -1)
+                kunmap_atomic((void *)va);
 #endif
+}
 
-static inline unsigned long l2_map_va(unsigned long pa, unsigned long prev_va,
-                                      unsigned long flags)
+static inline unsigned long l2_map_va(unsigned long pa, unsigned long prev_va)
 {
 #ifdef CONFIG_HIGHMEM
         unsigned long va = prev_va & PAGE_MASK;
@@ -89,17 +84,10 @@ static inline unsigned long l2_map_va(unsigned long pa, unsigned long prev_va,
                 /*
                  * Switching to a new page.  Because cache ops are
                  * using virtual addresses only, we must put a mapping
-                 * in place for it.  We also enable interrupts for a
-                 * short while and disable them again to protect this
-                 * mapping.
+                 * in place for it.
                  */
-                unsigned long idx;
-                raw_local_irq_restore(flags);
-                idx = KM_L2_CACHE + KM_TYPE_NR * smp_processor_id();
-                va = __fix_to_virt(FIX_KMAP_BEGIN + idx);
-                raw_local_irq_restore(flags | PSR_I_BIT);
-                set_pte_ext(TOP_PTE(va), pfn_pte(pa >> PAGE_SHIFT, PAGE_KERNEL), 0);
-                local_flush_tlb_kernel_page(va);
+                l2_unmap_va(prev_va);
+                va = (unsigned long)kmap_atomic_pfn(pa >> PAGE_SHIFT);
         }
         return va + (pa_offset >> (32 - PAGE_SHIFT));
 #else
@@ -109,7 +97,7 @@ static inline unsigned long l2_map_va(unsigned long pa, unsigned long prev_va,
 
 static void xsc3_l2_inv_range(unsigned long start, unsigned long end)
 {
-        unsigned long vaddr, flags;
+        unsigned long vaddr;
 
         if (start == 0 && end == -1ul) {
                 xsc3_l2_inv_all();
@@ -117,13 +105,12 @@ static void xsc3_l2_inv_range(unsigned long start, unsigned long end)
         }
 
         vaddr = -1;  /* to force the first mapping */
-        l2_map_save_flags(flags);
 
         /*
          * Clean and invalidate partial first cache line.
          */
         if (start & (CACHE_LINE_SIZE - 1)) {
-                vaddr = l2_map_va(start & ~(CACHE_LINE_SIZE - 1), vaddr, flags);
+                vaddr = l2_map_va(start & ~(CACHE_LINE_SIZE - 1), vaddr);
                 xsc3_l2_clean_mva(vaddr);
                 xsc3_l2_inv_mva(vaddr);
                 start = (start | (CACHE_LINE_SIZE - 1)) + 1;
@@ -133,7 +120,7 @@ static void xsc3_l2_inv_range(unsigned long start, unsigned long end)
          * Invalidate all full cache lines between 'start' and 'end'.
          */
         while (start < (end & ~(CACHE_LINE_SIZE - 1))) {
-                vaddr = l2_map_va(start, vaddr, flags);
+                vaddr = l2_map_va(start, vaddr);
                 xsc3_l2_inv_mva(vaddr);
                 start += CACHE_LINE_SIZE;
         }
@@ -142,31 +129,30 @@ static void xsc3_l2_inv_range(unsigned long start, unsigned long end)
          * Clean and invalidate partial last cache line.
          */
         if (start < end) {
-                vaddr = l2_map_va(start, vaddr, flags);
+                vaddr = l2_map_va(start, vaddr);
                 xsc3_l2_clean_mva(vaddr);
                 xsc3_l2_inv_mva(vaddr);
         }
 
-        l2_map_restore_flags(flags);
+        l2_unmap_va(vaddr);
 
         dsb();
 }
 
 static void xsc3_l2_clean_range(unsigned long start, unsigned long end)
 {
-        unsigned long vaddr, flags;
+        unsigned long vaddr;
 
         vaddr = -1;  /* to force the first mapping */
-        l2_map_save_flags(flags);
 
         start &= ~(CACHE_LINE_SIZE - 1);
         while (start < end) {
-                vaddr = l2_map_va(start, vaddr, flags);
+                vaddr = l2_map_va(start, vaddr);
                 xsc3_l2_clean_mva(vaddr);
                 start += CACHE_LINE_SIZE;
         }
 
-        l2_map_restore_flags(flags);
+        l2_unmap_va(vaddr);
 
         dsb();
 }
@@ -193,7 +179,7 @@ static inline void xsc3_l2_flush_all(void)
 
 static void xsc3_l2_flush_range(unsigned long start, unsigned long end)
 {
-        unsigned long vaddr, flags;
+        unsigned long vaddr;
 
         if (start == 0 && end == -1ul) {
                 xsc3_l2_flush_all();
@@ -201,17 +187,16 @@ static void xsc3_l2_flush_range(unsigned long start, unsigned long end)
         }
 
         vaddr = -1;  /* to force the first mapping */
-        l2_map_save_flags(flags);
 
         start &= ~(CACHE_LINE_SIZE - 1);
         while (start < end) {
-                vaddr = l2_map_va(start, vaddr, flags);
+                vaddr = l2_map_va(start, vaddr);
                 xsc3_l2_clean_mva(vaddr);
                 xsc3_l2_inv_mva(vaddr);
                 start += CACHE_LINE_SIZE;
         }
 
-        l2_map_restore_flags(flags);
+        l2_unmap_va(vaddr);
 
         dsb();
 }
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index ac6a36142fcd..6b48e0a3d7aa 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -17,6 +17,7 @@
 #include <linux/init.h>
 #include <linux/device.h>
 #include <linux/dma-mapping.h>
+#include <linux/highmem.h>
 
 #include <asm/memory.h>
 #include <asm/highmem.h>
@@ -311,7 +312,7 @@ __dma_alloc(struct device *dev, size_t size, dma_addr_t *handle, gfp_t gfp,
                 addr = page_address(page);
 
         if (addr)
-                *handle = page_to_dma(dev, page);
+                *handle = pfn_to_dma(dev, page_to_pfn(page));
 
         return addr;
 }
@@ -406,7 +407,7 @@ void dma_free_coherent(struct device *dev, size_t size, void *cpu_addr, dma_addr
         if (!arch_is_coherent())
                 __dma_free_remap(cpu_addr, size);
 
-        __dma_free_buffer(dma_to_page(dev, handle), size);
+        __dma_free_buffer(pfn_to_page(dma_to_pfn(dev, handle)), size);
 }
 EXPORT_SYMBOL(dma_free_coherent);
 
@@ -480,10 +481,10 @@ static void dma_cache_maint_page(struct page *page, unsigned long offset,
                                 op(vaddr, len, dir);
                                 kunmap_high(page);
                         } else if (cache_is_vipt()) {
-                                pte_t saved_pte;
-                                vaddr = kmap_high_l1_vipt(page, &saved_pte);
+                                /* unmapped pages might still be cached */
+                                vaddr = kmap_atomic(page);
                                 op(vaddr + offset, len, dir);
-                                kunmap_high_l1_vipt(page, saved_pte);
+                                kunmap_atomic(vaddr);
                         }
                 } else {
                         vaddr = page_address(page) + offset;
@@ -554,17 +555,20 @@ int dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
         struct scatterlist *s;
         int i, j;
 
+        BUG_ON(!valid_dma_direction(dir));
+
         for_each_sg(sg, s, nents, i) {
-                s->dma_address = dma_map_page(dev, sg_page(s), s->offset,
+                s->dma_address = __dma_map_page(dev, sg_page(s), s->offset,
                                                 s->length, dir);
                 if (dma_mapping_error(dev, s->dma_address))
                         goto bad_mapping;
         }
+        debug_dma_map_sg(dev, sg, nents, nents, dir);
         return nents;
 
  bad_mapping:
         for_each_sg(sg, s, i, j)
-                dma_unmap_page(dev, sg_dma_address(s), sg_dma_len(s), dir);
+                __dma_unmap_page(dev, sg_dma_address(s), sg_dma_len(s), dir);
         return 0;
 }
 EXPORT_SYMBOL(dma_map_sg);
@@ -585,8 +589,10 @@ void dma_unmap_sg(struct device *dev, struct scatterlist *sg, int nents,
         struct scatterlist *s;
         int i;
 
+        debug_dma_unmap_sg(dev, sg, nents, dir);
+
         for_each_sg(sg, s, nents, i)
-                dma_unmap_page(dev, sg_dma_address(s), sg_dma_len(s), dir);
+                __dma_unmap_page(dev, sg_dma_address(s), sg_dma_len(s), dir);
 }
 EXPORT_SYMBOL(dma_unmap_sg);
 
@@ -611,6 +617,8 @@ void dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
                 __dma_page_dev_to_cpu(sg_page(s), s->offset,
                                       s->length, dir);
         }
+
+        debug_dma_sync_sg_for_cpu(dev, sg, nents, dir);
 }
 EXPORT_SYMBOL(dma_sync_sg_for_cpu);
 
@@ -635,5 +643,16 @@ void dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
                 __dma_page_cpu_to_dev(sg_page(s), s->offset,
                                       s->length, dir);
         }
+
+        debug_dma_sync_sg_for_device(dev, sg, nents, dir);
 }
 EXPORT_SYMBOL(dma_sync_sg_for_device);
+
+#define PREALLOC_DMA_DEBUG_ENTRIES      4096
+
+static int __init dma_debug_do_init(void)
+{
+        dma_debug_init(PREALLOC_DMA_DEBUG_ENTRIES);
+        return 0;
+}
+fs_initcall(dma_debug_do_init);
diff --git a/arch/arm/mm/fault-armv.c b/arch/arm/mm/fault-armv.c
index 83e59f870426..01210dba0221 100644
--- a/arch/arm/mm/fault-armv.c
+++ b/arch/arm/mm/fault-armv.c
@@ -26,7 +26,7 @@
 
 #include "mm.h"
 
-static unsigned long shared_pte_mask = L_PTE_MT_BUFFERABLE;
+static pteval_t shared_pte_mask = L_PTE_MT_BUFFERABLE;
 
 #if __LINUX_ARM_ARCH__ < 6
 /*
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index 1e21e125fe3a..f10f9bac2206 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -108,7 +108,7 @@ void show_pte(struct mm_struct *mm, unsigned long addr)
 
                 pte = pte_offset_map(pmd, addr);
                 printk(", *pte=%08lx", pte_val(*pte));
-                printk(", *ppte=%08lx", pte_val(pte[-PTRS_PER_PTE]));
+                printk(", *ppte=%08lx", pte_val(pte[PTE_HWTABLE_PTRS]));
                 pte_unmap(pte);
         } while(0);
 
diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
index 391ffae75098..c29f2839f1d2 100644
--- a/arch/arm/mm/flush.c
+++ b/arch/arm/mm/flush.c
@@ -10,6 +10,7 @@
 #include <linux/module.h>
 #include <linux/mm.h>
 #include <linux/pagemap.h>
+#include <linux/highmem.h>
 
 #include <asm/cacheflush.h>
 #include <asm/cachetype.h>
@@ -180,10 +181,10 @@ void __flush_dcache_page(struct address_space *mapping, struct page *page)
                         __cpuc_flush_dcache_area(addr, PAGE_SIZE);
                         kunmap_high(page);
                 } else if (cache_is_vipt()) {
-                        pte_t saved_pte;
-                        addr = kmap_high_l1_vipt(page, &saved_pte);
+                        /* unmapped pages might still be cached */
+                        addr = kmap_atomic(page);
                         __cpuc_flush_dcache_area(addr, PAGE_SIZE);
-                        kunmap_high_l1_vipt(page, saved_pte);
+                        kunmap_atomic(addr);
                 }
         }
 
diff --git a/arch/arm/mm/highmem.c b/arch/arm/mm/highmem.c
index c435fd9e1da9..807c0573abbe 100644
--- a/arch/arm/mm/highmem.c
+++ b/arch/arm/mm/highmem.c
@@ -140,90 +140,3 @@ struct page *kmap_atomic_to_page(const void *ptr)
         pte = TOP_PTE(vaddr);
         return pte_page(*pte);
 }
-
-#ifdef CONFIG_CPU_CACHE_VIPT
-
-#include <linux/percpu.h>
-
-/*
- * The VIVT cache of a highmem page is always flushed before the page
- * is unmapped. Hence unmapped highmem pages need no cache maintenance
- * in that case.
- *
- * However unmapped pages may still be cached with a VIPT cache, and
- * it is not possible to perform cache maintenance on them using physical
- * addresses unfortunately.  So we have no choice but to set up a temporary
- * virtual mapping for that purpose.
- *
- * Yet this VIPT cache maintenance may be triggered from DMA support
- * functions which are possibly called from interrupt context. As we don't
- * want to keep interrupt disabled all the time when such maintenance is
- * taking place, we therefore allow for some reentrancy by preserving and
- * restoring the previous fixmap entry before the interrupted context is
- * resumed.  If the reentrancy depth is 0 then there is no need to restore
- * the previous fixmap, and leaving the current one in place allow it to
- * be reused the next time without a TLB flush (common with DMA).
- */
-
-static DEFINE_PER_CPU(int, kmap_high_l1_vipt_depth);
-
-void *kmap_high_l1_vipt(struct page *page, pte_t *saved_pte)
-{
-        unsigned int idx, cpu;
-        int *depth;
-        unsigned long vaddr, flags;
-        pte_t pte, *ptep;
-
-        if (!in_interrupt())
-                preempt_disable();
-
-        cpu = smp_processor_id();
-        depth = &per_cpu(kmap_high_l1_vipt_depth, cpu);
-
-        idx = KM_L1_CACHE + KM_TYPE_NR * cpu;
-        vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
-        ptep = TOP_PTE(vaddr);
-        pte = mk_pte(page, kmap_prot);
-
-        raw_local_irq_save(flags);
-        (*depth)++;
-        if (pte_val(*ptep) == pte_val(pte)) {
-                *saved_pte = pte;
-        } else {
-                *saved_pte = *ptep;
-                set_pte_ext(ptep, pte, 0);
-                local_flush_tlb_kernel_page(vaddr);
-        }
-        raw_local_irq_restore(flags);
-
-        return (void *)vaddr;
-}
-
-void kunmap_high_l1_vipt(struct page *page, pte_t saved_pte)
-{
-        unsigned int idx, cpu = smp_processor_id();
-        int *depth = &per_cpu(kmap_high_l1_vipt_depth, cpu);
-        unsigned long vaddr, flags;
-        pte_t pte, *ptep;
-
-        idx = KM_L1_CACHE + KM_TYPE_NR * cpu;
-        vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
-        ptep = TOP_PTE(vaddr);
-        pte = mk_pte(page, kmap_prot);
-
-        BUG_ON(pte_val(*ptep) != pte_val(pte));
-        BUG_ON(*depth <= 0);
-
-        raw_local_irq_save(flags);
-        (*depth)--;
-        if (*depth != 0 && pte_val(pte) != pte_val(saved_pte)) {
-                set_pte_ext(ptep, saved_pte, 0);
-                local_flush_tlb_kernel_page(vaddr);
-        }
-        raw_local_irq_restore(flags);
-
-        if (!in_interrupt())
-                preempt_enable();
-}
-
-#endif  /* CONFIG_CPU_CACHE_VIPT */
diff --git a/arch/arm/mm/idmap.c b/arch/arm/mm/idmap.c
new file mode 100644
index 000000000000..57299446f787
--- /dev/null
+++ b/arch/arm/mm/idmap.c
@@ -0,0 +1,67 @@
+#include <linux/kernel.h>
+
+#include <asm/cputype.h>
+#include <asm/pgalloc.h>
+#include <asm/pgtable.h>
+
+static void idmap_add_pmd(pgd_t *pgd, unsigned long addr, unsigned long end,
+        unsigned long prot)
+{
+        pmd_t *pmd = pmd_offset(pgd, addr);
+
+        addr = (addr & PMD_MASK) | prot;
+        pmd[0] = __pmd(addr);
+        addr += SECTION_SIZE;
+        pmd[1] = __pmd(addr);
+        flush_pmd_entry(pmd);
+}
+
+void identity_mapping_add(pgd_t *pgd, unsigned long addr, unsigned long end)
+{
+        unsigned long prot, next;
+
+        prot = PMD_TYPE_SECT | PMD_SECT_AP_WRITE;
+        if (cpu_architecture() <= CPU_ARCH_ARMv5TEJ && !cpu_is_xscale())
+                prot |= PMD_BIT4;
+
+        pgd += pgd_index(addr);
+        do {
+                next = pgd_addr_end(addr, end);
+                idmap_add_pmd(pgd, addr, next, prot);
+        } while (pgd++, addr = next, addr != end);
+}
+
+#ifdef CONFIG_SMP
+static void idmap_del_pmd(pgd_t *pgd, unsigned long addr, unsigned long end)
+{
+        pmd_t *pmd = pmd_offset(pgd, addr);
+        pmd_clear(pmd);
+}
+
+void identity_mapping_del(pgd_t *pgd, unsigned long addr, unsigned long end)
+{
+        unsigned long next;
+
+        pgd += pgd_index(addr);
+        do {
+                next = pgd_addr_end(addr, end);
+                idmap_del_pmd(pgd, addr, next);
+        } while (pgd++, addr = next, addr != end);
+}
+#endif
+
+/*
+ * In order to soft-boot, we need to insert a 1:1 mapping in place of
+ * the user-mode pages.  This will then ensure that we have predictable
+ * results when turning the mmu off
+ */
+void setup_mm_for_reboot(char mode)
+{
+        /*
+         * We need to access to user-mode page tables here. For kernel threads
+         * we don't have any user-mode mappings so we use the context that we
+         * "borrowed".
+         */
+        identity_mapping_add(current->active_mm->pgd, 0, TASK_SIZE);
+        local_flush_tlb_all();
+}
diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c
index 55c17a6fb22f..ab506272b2d3 100644
--- a/arch/arm/mm/ioremap.c
+++ b/arch/arm/mm/ioremap.c
@@ -204,12 +204,8 @@ void __iomem * __arm_ioremap_pfn_caller(unsigned long pfn,
         /*
          * Don't allow RAM to be mapped - this causes problems with ARMv6+
          */
-        if (pfn_valid(pfn)) {
-                printk(KERN_WARNING "BUG: Your driver calls ioremap() on system memory.  This leads\n"
-                       "to architecturally unpredictable behaviour on ARMv6+, and ioremap()\n"
-                       "will fail in the next kernel release.  Please fix your driver.\n");
-                WARN_ON(1);
-        }
+        if (WARN_ON(pfn_valid(pfn)))
+                return NULL;
 
         type = get_mem_type(mtype);
         if (!type)
diff --git a/arch/arm/mm/mm.h b/arch/arm/mm/mm.h
index 6630620380a4..36960df5fb76 100644
--- a/arch/arm/mm/mm.h
+++ b/arch/arm/mm/mm.h
@@ -16,7 +16,7 @@ static inline pmd_t *pmd_off_k(unsigned long virt)
 }
 
 struct mem_type {
-        unsigned int prot_pte;
+        pteval_t prot_pte;
         unsigned int prot_l1;
         unsigned int prot_sect;
         unsigned int domain;
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 72ad3e1f56cf..3c67e92f7d59 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -24,6 +24,7 @@
 #include <asm/smp_plat.h>
 #include <asm/tlb.h>
 #include <asm/highmem.h>
+#include <asm/traps.h>
 
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
@@ -62,7 +63,7 @@ struct cachepolicy {
         const char      policy[16];
         unsigned int    cr_mask;
         unsigned int    pmd;
-        unsigned int    pte;
+        pteval_t        pte;
 };
 
 static struct cachepolicy cache_policies[] __initdata = {
@@ -190,7 +191,7 @@ void adjust_cr(unsigned long mask, unsigned long set)
 }
 #endif
 
-#define PROT_PTE_DEVICE         L_PTE_PRESENT|L_PTE_YOUNG|L_PTE_DIRTY|L_PTE_WRITE
+#define PROT_PTE_DEVICE         L_PTE_PRESENT|L_PTE_YOUNG|L_PTE_DIRTY|L_PTE_XN
 #define PROT_SECT_DEVICE        PMD_TYPE_SECT|PMD_SECT_AP_WRITE
 
 static struct mem_type mem_types[] = {
@@ -235,19 +236,18 @@ static struct mem_type mem_types[] = {
         },
         [MT_LOW_VECTORS] = {
                 .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
-                                L_PTE_EXEC,
+                                L_PTE_RDONLY,
                 .prot_l1   = PMD_TYPE_TABLE,
                 .domain    = DOMAIN_USER,
         },
         [MT_HIGH_VECTORS] = {
                 .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
-                                L_PTE_USER | L_PTE_EXEC,
+                                L_PTE_USER | L_PTE_RDONLY,
                 .prot_l1   = PMD_TYPE_TABLE,
                 .domain    = DOMAIN_USER,
         },
         [MT_MEMORY] = {
-                .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
-                                L_PTE_WRITE | L_PTE_EXEC,
+                .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY,
                 .prot_l1   = PMD_TYPE_TABLE,
                 .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE,
                 .domain    = DOMAIN_KERNEL,
@@ -258,21 +258,20 @@ static struct mem_type mem_types[] = {
         },
         [MT_MEMORY_NONCACHED] = {
                 .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
-                                L_PTE_WRITE | L_PTE_EXEC | L_PTE_MT_BUFFERABLE,
+                                L_PTE_MT_BUFFERABLE,
                 .prot_l1   = PMD_TYPE_TABLE,
                 .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE,
                 .domain    = DOMAIN_KERNEL,
         },
         [MT_MEMORY_DTCM] = {
                 .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
-                                L_PTE_WRITE,
+                                L_PTE_XN,
                 .prot_l1   = PMD_TYPE_TABLE,
                 .prot_sect = PMD_TYPE_SECT | PMD_SECT_XN,
                 .domain    = DOMAIN_KERNEL,
         },
         [MT_MEMORY_ITCM] = {
-                .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
-                                L_PTE_WRITE | L_PTE_EXEC,
+                .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY,
                 .prot_l1   = PMD_TYPE_TABLE,
                 .domain    = DOMAIN_KERNEL,
         },
@@ -479,7 +478,7 @@ static void __init build_mem_type_table(void)
 
         pgprot_user   = __pgprot(L_PTE_PRESENT | L_PTE_YOUNG | user_pgprot);
         pgprot_kernel = __pgprot(L_PTE_PRESENT | L_PTE_YOUNG |
-                                 L_PTE_DIRTY | L_PTE_WRITE | kern_pgprot);
+                                 L_PTE_DIRTY | kern_pgprot);
 
         mem_types[MT_LOW_VECTORS].prot_l1 |= ecc_mask;
         mem_types[MT_HIGH_VECTORS].prot_l1 |= ecc_mask;
@@ -535,7 +534,7 @@ static pte_t * __init early_pte_alloc(pmd_t *pmd, unsigned long addr, unsigned l
 {
         if (pmd_none(*pmd)) {
                 pte_t *pte = early_alloc(2 * PTRS_PER_PTE * sizeof(pte_t));
-                __pmd_populate(pmd, __pa(pte) | prot);
+                __pmd_populate(pmd, __pa(pte), prot);
         }
         BUG_ON(pmd_bad(*pmd));
         return pte_offset_kernel(pmd, addr);
@@ -553,7 +552,7 @@ static void __init alloc_init_pte(pmd_t *pmd, unsigned long addr,
 }
 
 static void __init alloc_init_section(pgd_t *pgd, unsigned long addr,
-                                      unsigned long end, unsigned long phys,
+                                      unsigned long end, phys_addr_t phys,
                                       const struct mem_type *type)
 {
         pmd_t *pmd = pmd_offset(pgd, addr);
@@ -588,7 +587,8 @@ static void __init alloc_init_section(pgd_t *pgd, unsigned long addr,
 static void __init create_36bit_mapping(struct map_desc *md,
                                         const struct mem_type *type)
 {
-        unsigned long phys, addr, length, end;
+        unsigned long addr, length, end;
+        phys_addr_t phys;
         pgd_t *pgd;
 
         addr = md->virtual;
@@ -914,12 +914,11 @@ static void __init devicemaps_init(struct machine_desc *mdesc)
 {
         struct map_desc map;
         unsigned long addr;
-        void *vectors;
 
         /*
          * Allocate the vector page early.
          */
-        vectors = early_alloc(PAGE_SIZE);
+        vectors_page = early_alloc(PAGE_SIZE);
 
         for (addr = VMALLOC_END; addr; addr += PGDIR_SIZE)
                 pmd_clear(pmd_off_k(addr));
@@ -959,7 +958,7 @@ static void __init devicemaps_init(struct machine_desc *mdesc)
          * location (0xffff0000).  If we aren't using high-vectors, also
          * create a mapping at the low-vectors virtual address.
          */
-        map.pfn = __phys_to_pfn(virt_to_phys(vectors));
+        map.pfn = __phys_to_pfn(virt_to_phys(vectors_page));
         map.virtual = 0xffff0000;
         map.length = PAGE_SIZE;
         map.type = MT_HIGH_VECTORS;
@@ -1044,38 +1043,3 @@ void __init paging_init(struct machine_desc *mdesc)
         empty_zero_page = virt_to_page(zero_page);
         __flush_dcache_page(NULL, empty_zero_page);
 }
-
-/*
- * In order to soft-boot, we need to insert a 1:1 mapping in place of
- * the user-mode pages.  This will then ensure that we have predictable
- * results when turning the mmu off
- */
-void setup_mm_for_reboot(char mode)
-{
-        unsigned long base_pmdval;
-        pgd_t *pgd;
-        int i;
-
-        /*
-         * We need to access to user-mode page tables here. For kernel threads
-         * we don't have any user-mode mappings so we use the context that we
-         * "borrowed".
-         */
-        pgd = current->active_mm->pgd;
-
-        base_pmdval = PMD_SECT_AP_WRITE | PMD_SECT_AP_READ | PMD_TYPE_SECT;
-        if (cpu_architecture() <= CPU_ARCH_ARMv5TEJ && !cpu_is_xscale())
-                base_pmdval |= PMD_BIT4;
-
-        for (i = 0; i < FIRST_USER_PGD_NR + USER_PTRS_PER_PGD; i++, pgd++) {
-                unsigned long pmdval = (i << PGDIR_SHIFT) | base_pmdval;
-                pmd_t *pmd;
-
-                pmd = pmd_off(pgd, i << PGDIR_SHIFT);
-                pmd[0] = __pmd(pmdval);
-                pmd[1] = __pmd(pmdval + (1 << (PGDIR_SHIFT - 1)));
-                flush_pmd_entry(pmd);
-        }
-
-        local_flush_tlb_all();
-}
diff --git a/arch/arm/mm/pgd.c b/arch/arm/mm/pgd.c
index 69bbfc6645a6..93292a18cf77 100644
--- a/arch/arm/mm/pgd.c
+++ b/arch/arm/mm/pgd.c
@@ -17,12 +17,10 @@
 
 #include "mm.h"
 
-#define FIRST_KERNEL_PGD_NR     (FIRST_USER_PGD_NR + USER_PTRS_PER_PGD)
-
 /*
  * need to get a 16k page for level 1
  */
-pgd_t *get_pgd_slow(struct mm_struct *mm)
+pgd_t *pgd_alloc(struct mm_struct *mm)
 {
         pgd_t *new_pgd, *init_pgd;
         pmd_t *new_pmd, *init_pmd;
@@ -32,14 +30,14 @@ pgd_t *get_pgd_slow(struct mm_struct *mm)
         if (!new_pgd)
                 goto no_pgd;
 
-        memset(new_pgd, 0, FIRST_KERNEL_PGD_NR * sizeof(pgd_t));
+        memset(new_pgd, 0, USER_PTRS_PER_PGD * sizeof(pgd_t));
 
         /*
          * Copy over the kernel and IO PGD entries
          */
         init_pgd = pgd_offset_k(0);
-        memcpy(new_pgd + FIRST_KERNEL_PGD_NR, init_pgd + FIRST_KERNEL_PGD_NR,
-                       (PTRS_PER_PGD - FIRST_KERNEL_PGD_NR) * sizeof(pgd_t));
+        memcpy(new_pgd + USER_PTRS_PER_PGD, init_pgd + USER_PTRS_PER_PGD,
+                       (PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t));
 
         clean_dcache_area(new_pgd, PTRS_PER_PGD * sizeof(pgd_t));
 
@@ -73,28 +71,29 @@ no_pgd:
         return NULL;
 }
 
-void free_pgd_slow(struct mm_struct *mm, pgd_t *pgd)
+void pgd_free(struct mm_struct *mm, pgd_t *pgd_base)
 {
+        pgd_t *pgd;
         pmd_t *pmd;
         pgtable_t pte;
 
-        if (!pgd)
+        if (!pgd_base)
                 return;
 
-        /* pgd is always present and good */
-        pmd = pmd_off(pgd, 0);
-        if (pmd_none(*pmd))
-                goto free;
-        if (pmd_bad(*pmd)) {
-                pmd_ERROR(*pmd);
-                pmd_clear(pmd);
-                goto free;
-        }
+        pgd = pgd_base + pgd_index(0);
+        if (pgd_none_or_clear_bad(pgd))
+                goto no_pgd;
+
+        pmd = pmd_offset(pgd, 0);
+        if (pmd_none_or_clear_bad(pmd))
+                goto no_pmd;
 
         pte = pmd_pgtable(*pmd);
         pmd_clear(pmd);
         pte_free(mm, pte);
+no_pmd:
+        pgd_clear(pgd);
         pmd_free(mm, pmd);
-free:
-        free_pages((unsigned long) pgd, 2);
+no_pgd:
+        free_pages((unsigned long) pgd_base, 2);
 }
diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S
index b795afd0a2c6..e32fa499194c 100644
--- a/arch/arm/mm/proc-macros.S
+++ b/arch/arm/mm/proc-macros.S
@@ -91,7 +91,7 @@
 #if L_PTE_SHARED != PTE_EXT_SHARED
 #error PTE shared bit mismatch
 #endif
-#if (L_PTE_EXEC+L_PTE_USER+L_PTE_WRITE+L_PTE_DIRTY+L_PTE_YOUNG+\
+#if (L_PTE_XN+L_PTE_USER+L_PTE_RDONLY+L_PTE_DIRTY+L_PTE_YOUNG+\
      L_PTE_FILE+L_PTE_PRESENT) > L_PTE_SHARED
 #error Invalid Linux PTE bit settings
 #endif
@@ -109,6 +109,10 @@
  *  110x   0   1   0    r/w     r/o
  *  11x0   0   1   0    r/w     r/o
  *  1111   0   1   1    r/w     r/w
+ *
+ * If !CONFIG_CPU_USE_DOMAINS, the following permissions are changed:
+ *  110x   1   1   1    r/o     r/o
+ *  11x0   1   1   1    r/o     r/o
  */
         .macro  armv6_mt_table pfx
 \pfx\()_mt_table:
@@ -131,7 +135,7 @@
         .endm
 
         .macro  armv6_set_pte_ext pfx
-        str     r1, [r0], #-2048                @ linux version
+        str     r1, [r0], #2048                 @ linux version
 
         bic     r3, r1, #0x000003fc
         bic     r3, r3, #PTE_TYPE_MASK
@@ -142,17 +146,20 @@
         and     r2, r1, #L_PTE_MT_MASK
         ldr     r2, [ip, r2]
 
-        tst     r1, #L_PTE_WRITE
-        tstne   r1, #L_PTE_DIRTY
-        orreq   r3, r3, #PTE_EXT_APX
+        eor     r1, r1, #L_PTE_DIRTY
+        tst     r1, #L_PTE_DIRTY|L_PTE_RDONLY
+        orrne   r3, r3, #PTE_EXT_APX
 
         tst     r1, #L_PTE_USER
         orrne   r3, r3, #PTE_EXT_AP1
+#ifdef CONFIG_CPU_USE_DOMAINS
+        @ allow kernel read/write access to read-only user pages
         tstne   r3, #PTE_EXT_APX
         bicne   r3, r3, #PTE_EXT_APX | PTE_EXT_AP0
+#endif
 
-        tst     r1, #L_PTE_EXEC
-        orreq   r3, r3, #PTE_EXT_XN
+        tst     r1, #L_PTE_XN
+        orrne   r3, r3, #PTE_EXT_XN
 
         orr     r3, r3, r2
 
@@ -180,9 +187,9 @@
  *  1111  0xff  r/w     r/w
  */
         .macro  armv3_set_pte_ext wc_disable=1
-        str     r1, [r0], #-2048                @ linux version
+        str     r1, [r0], #2048                 @ linux version
 
-        eor     r3, r1, #L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_WRITE | L_PTE_DIRTY
+        eor     r3, r1, #L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY
 
         bic     r2, r1, #PTE_SMALL_AP_MASK      @ keep C, B bits
         bic     r2, r2, #PTE_TYPE_MASK
@@ -191,7 +198,7 @@
         tst     r3, #L_PTE_USER                 @ user?
         orrne   r2, r2, #PTE_SMALL_AP_URO_SRW
 
-        tst     r3, #L_PTE_WRITE | L_PTE_DIRTY  @ write and dirty?
+        tst     r3, #L_PTE_RDONLY | L_PTE_DIRTY @ write and dirty?
         orreq   r2, r2, #PTE_SMALL_AP_UNO_SRW
 
         tst     r3, #L_PTE_PRESENT | L_PTE_YOUNG        @ present and young?
@@ -203,7 +210,7 @@
         bicne   r2, r2, #PTE_BUFFERABLE
 #endif
         .endif
-        str     r2, [r0]                        @ hardware version
+        str     r2, [r0]                @ hardware version
         .endm
 
 
@@ -223,9 +230,9 @@
  *  1111  11    r/w     r/w
  */
         .macro  xscale_set_pte_ext_prologue
-        str     r1, [r0], #-2048                @ linux version
+        str     r1, [r0]                        @ linux version
 
-        eor     r3, r1, #L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_WRITE | L_PTE_DIRTY
+        eor     r3, r1, #L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY
 
         bic     r2, r1, #PTE_SMALL_AP_MASK      @ keep C, B bits
         orr     r2, r2, #PTE_TYPE_EXT           @ extended page
@@ -233,7 +240,7 @@
         tst     r3, #L_PTE_USER                 @ user?
         orrne   r2, r2, #PTE_EXT_AP_URO_SRW     @ yes -> user r/o, system r/w
 
-        tst     r3, #L_PTE_WRITE | L_PTE_DIRTY  @ write and dirty?
+        tst     r3, #L_PTE_RDONLY | L_PTE_DIRTY @ write and dirty?
         orreq   r2, r2, #PTE_EXT_AP_UNO_SRW     @ yes -> user n/a, system r/w
                                                 @ combined with user -> user r/w
         .endm
@@ -242,7 +249,7 @@
         tst     r3, #L_PTE_PRESENT | L_PTE_YOUNG        @ present and young?
         movne   r2, #0                          @ no -> fault
 
-        str     r2, [r0]                        @ hardware version
+        str     r2, [r0, #2048]!                @ hardware version
         mov     ip, #0
         mcr     p15, 0, r0, c7, c10, 1          @ clean L1 D line
         mcr     p15, 0, ip, c7, c10, 4          @ data write barrier
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 9b9ff5d949fd..b49fab21517c 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -124,15 +124,13 @@ ENDPROC(cpu_v7_switch_mm)
  *      Set a level 2 translation table entry.
  *
  *      - ptep  - pointer to level 2 translation table entry
- *                (hardware version is stored at -1024 bytes)
+ *                (hardware version is stored at +2048 bytes)
  *      - pte   - PTE value to store
  *      - ext   - value for extended PTE bits
  */
 ENTRY(cpu_v7_set_pte_ext)
 #ifdef CONFIG_MMU
- ARM(   str     r1, [r0], #-2048        )       @ linux version
- THUMB( str     r1, [r0]                )       @ linux version
- THUMB( sub     r0, r0, #2048           )
+        str     r1, [r0]                        @ linux version
 
         bic     r3, r1, #0x000003f0
         bic     r3, r3, #PTE_TYPE_MASK
@@ -142,23 +140,26 @@ ENTRY(cpu_v7_set_pte_ext)
         tst     r1, #1 << 4
         orrne   r3, r3, #PTE_EXT_TEX(1)
 
-        tst     r1, #L_PTE_WRITE
-        tstne   r1, #L_PTE_DIRTY
-        orreq   r3, r3, #PTE_EXT_APX
+        eor     r1, r1, #L_PTE_DIRTY
+        tst     r1, #L_PTE_RDONLY | L_PTE_DIRTY
+        orrne   r3, r3, #PTE_EXT_APX
 
         tst     r1, #L_PTE_USER
         orrne   r3, r3, #PTE_EXT_AP1
+#ifdef CONFIG_CPU_USE_DOMAINS
+        @ allow kernel read/write access to read-only user pages
         tstne   r3, #PTE_EXT_APX
         bicne   r3, r3, #PTE_EXT_APX | PTE_EXT_AP0
+#endif
 
-        tst     r1, #L_PTE_EXEC
-        orreq   r3, r3, #PTE_EXT_XN
+        tst     r1, #L_PTE_XN
+        orrne   r3, r3, #PTE_EXT_XN
 
         tst     r1, #L_PTE_YOUNG
         tstne   r1, #L_PTE_PRESENT
         moveq   r3, #0
 
-        str     r3, [r0]
+        str     r3, [r0, #2048]!
         mcr     p15, 0, r0, c7, c10, 1          @ flush_pte
 #endif
         mov     pc, lr
@@ -273,8 +274,6 @@ __v7_setup:
         ALT_SMP(orr     r4, r4, #TTB_FLAGS_SMP)
         ALT_UP(orr      r4, r4, #TTB_FLAGS_UP)
         mcr     p15, 0, r4, c2, c0, 1           @ load TTB1
-        mov     r10, #0x1f                      @ domains 0, 1 = manager
-        mcr     p15, 0, r10, c3, c0, 0          @ load domain access register
         /*
          * Memory region attributes with SCTLR.TRE=1
          *
@@ -313,6 +312,10 @@ __v7_setup:
 #ifdef CONFIG_CPU_ENDIAN_BE8
         orr     r6, r6, #1 << 25                @ big-endian page tables
 #endif
+#ifdef CONFIG_SWP_EMULATE
+        orr     r5, r5, #(1 << 10)              @ set SW bit in "clear"
+        bic     r6, r6, #(1 << 10)              @ clear it in "mmuset"
+#endif
         mrc     p15, 0, r0, c1, c0, 0           @ read control register
         bic     r0, r0, r5                      @ clear bits them
         orr     r0, r0, r6                      @ set them
diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
index 523408c0bb38..5a37c5e45c41 100644
--- a/arch/arm/mm/proc-xscale.S
+++ b/arch/arm/mm/proc-xscale.S
@@ -500,8 +500,8 @@ ENTRY(cpu_xscale_set_pte_ext)
         @
         @ Erratum 40: must set memory to write-through for user read-only pages
         @
-        and     ip, r1, #(L_PTE_MT_MASK | L_PTE_USER | L_PTE_WRITE) & ~(4 << 2)
-        teq     ip, #L_PTE_MT_WRITEBACK | L_PTE_USER
+        and     ip, r1, #(L_PTE_MT_MASK | L_PTE_USER | L_PTE_RDONLY) & ~(4 << 2)
+        teq     ip, #L_PTE_MT_WRITEBACK | L_PTE_USER | L_PTE_RDONLY
 
         moveq   r1, #L_PTE_MT_WRITETHROUGH
         and     r1, r1, #L_PTE_MT_MASK