Merge tag 'v3.6-rc6' into for-3.7

Linux 3.6-rc6 has all our bug fixes.

Conflicts (trivial overlap):
	sound/soc/omap/am3517evm.c

47 files changed, 425 insertions, 119 deletions

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index c5f9ae5dbd1a..2f88d8d97701 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -6,7 +6,7 @@ config ARM
         select HAVE_DMA_API_DEBUG
         select HAVE_IDE if PCI || ISA || PCMCIA
         select HAVE_DMA_ATTRS
-        select HAVE_DMA_CONTIGUOUS if (CPU_V6 || CPU_V6K || CPU_V7)
+        select HAVE_DMA_CONTIGUOUS if MMU
         select HAVE_MEMBLOCK
         select RTC_LIB
         select SYS_SUPPORTS_APM_EMULATION
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index f15f82bf3a50..e968a52e4881 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -356,15 +356,15 @@ choice
                   is nothing connected to read from the DCC.
 
         config DEBUG_SEMIHOSTING
-                bool "Kernel low-level debug output via semihosting I"
+                bool "Kernel low-level debug output via semihosting I/O"
                 help
                   Semihosting enables code running on an ARM target to use
                   the I/O facilities on a host debugger/emulator through a
-                  simple SVC calls. The host debugger or emulator must have
+                  simple SVC call. The host debugger or emulator must have
                   semihosting enabled for the special svc call to be trapped
                   otherwise the kernel will crash.
 
-                  This is known to work with OpenOCD, as wellas
+                  This is known to work with OpenOCD, as well as
                   ARM's Fast Models, or any other controlling environment
                   that implements semihosting.
 
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 30eae87ead6d..a051dfbdd7db 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -284,10 +284,10 @@ zImage Image xipImage bootpImage uImage: vmlinux
 zinstall uinstall install: vmlinux
         $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $@
 
-%.dtb:
+%.dtb: scripts
         $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@
 
-dtbs:
+dtbs: scripts
         $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@
 
 # We use MRPROPER_FILES and CLEAN_FILES now
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index b8c64b80bafc..81769c1341fa 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -659,10 +659,14 @@ __armv7_mmu_cache_on:
 #ifdef CONFIG_CPU_ENDIAN_BE8
                 orr     r0, r0, #1 << 25        @ big-endian page tables
 #endif
+                mrcne   p15, 0, r6, c2, c0, 2   @ read ttb control reg
                 orrne   r0, r0, #1              @ MMU enabled
                 movne   r1, #0xfffffffd         @ domain 0 = client
+                bic     r6, r6, #1 << 31        @ 32-bit translation system
+                bic     r6, r6, #3 << 0         @ use only ttbr0
                 mcrne   p15, 0, r3, c2, c0, 0   @ load page table pointer
                 mcrne   p15, 0, r1, c3, c0, 0   @ load domain access control
+                mcrne   p15, 0, r6, c2, c0, 2   @ load ttb control
 #endif
                 mcr     p15, 0, r0, c7, c5, 4   @ ISB
                 mcr     p15, 0, r0, c1, c0, 0   @ load control register
diff --git a/arch/arm/boot/dts/at91sam9g25ek.dts b/arch/arm/boot/dts/at91sam9g25ek.dts
index 7829a4d0cb22..96514c134e54 100644
--- a/arch/arm/boot/dts/at91sam9g25ek.dts
+++ b/arch/arm/boot/dts/at91sam9g25ek.dts
@@ -15,7 +15,7 @@
         compatible = "atmel,at91sam9g25ek", "atmel,at91sam9x5ek", "atmel,at91sam9x5", "atmel,at91sam9";
 
         chosen {
-                bootargs = "128M console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=ubifs ubi.mtd=1 root=ubi0:rootfs";
+                bootargs = "console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=ubifs ubi.mtd=1 root=ubi0:rootfs";
         };
 
         ahb {
diff --git a/arch/arm/configs/armadillo800eva_defconfig b/arch/arm/configs/armadillo800eva_defconfig
index 7d8718468e0d..90610c7030f7 100644
--- a/arch/arm/configs/armadillo800eva_defconfig
+++ b/arch/arm/configs/armadillo800eva_defconfig
@@ -33,7 +33,7 @@ CONFIG_AEABI=y
 CONFIG_FORCE_MAX_ZONEORDER=13
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="console=tty0 console=ttySC1,115200 earlyprintk=sh-sci.1,115200 ignore_loglevel root=/dev/nfs ip=dhcp nfsroot=,rsize=4096,wsize=4096"
+CONFIG_CMDLINE="console=tty0 console=ttySC1,115200 earlyprintk=sh-sci.1,115200 ignore_loglevel root=/dev/nfs ip=dhcp nfsroot=,rsize=4096,wsize=4096 rw"
 CONFIG_CMDLINE_FORCE=y
 CONFIG_KEXEC=y
 CONFIG_VFP=y
diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index 03fb93621d0d..5c8b3bf4d825 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -320,4 +320,12 @@
         .size \name , . - \name
         .endm
 
+        .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
+#ifndef CONFIG_CPU_USE_DOMAINS
+        adds    \tmp, \addr, #\size - 1
+        sbcccs  \tmp, \tmp, \limit
+        bcs     \bad
+#endif
+        .endm
+
 #endif /* __ASM_ASSEMBLER_H__ */
diff --git a/arch/arm/include/asm/dma-mapping.h b/arch/arm/include/asm/dma-mapping.h
index 2ae842df4551..5c44dcb0987b 100644
--- a/arch/arm/include/asm/dma-mapping.h
+++ b/arch/arm/include/asm/dma-mapping.h
@@ -203,6 +203,13 @@ static inline void dma_free_writecombine(struct device *dev, size_t size,
 }
 
 /*
+ * This can be called during early boot to increase the size of the atomic
+ * coherent DMA pool above the default value of 256KiB. It must be called
+ * before postcore_initcall.
+ */
+extern void __init init_dma_coherent_pool_size(unsigned long size);
+
+/*
  * This can be called during boot to increase the size of the consistent
  * DMA region above it's default value of 2MB. It must be called before the
  * memory allocator is initialised, i.e. before any core_initcall.
diff --git a/arch/arm/include/asm/memory.h b/arch/arm/include/asm/memory.h
index e965f1b560f1..5f6ddcc56452 100644
--- a/arch/arm/include/asm/memory.h
+++ b/arch/arm/include/asm/memory.h
@@ -187,6 +187,7 @@ static inline unsigned long __phys_to_virt(unsigned long x)
 #define __phys_to_virt(x)       ((x) - PHYS_OFFSET + PAGE_OFFSET)
 #endif
 #endif
+#endif /* __ASSEMBLY__ */
 
 #ifndef PHYS_OFFSET
 #ifdef PLAT_PHYS_OFFSET
@@ -196,6 +197,8 @@ static inline unsigned long __phys_to_virt(unsigned long x)
 #endif
 #endif
 
+#ifndef __ASSEMBLY__
+
 /*
  * PFNs are used to describe any physical page; this means
  * PFN 0 == physical address 0.
diff --git a/arch/arm/include/asm/tlb.h b/arch/arm/include/asm/tlb.h
index 314d4664eae7..99a19512ee26 100644
--- a/arch/arm/include/asm/tlb.h
+++ b/arch/arm/include/asm/tlb.h
@@ -199,6 +199,9 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
 {
         pgtable_page_dtor(pte);
 
+#ifdef CONFIG_ARM_LPAE
+        tlb_add_flush(tlb, addr);
+#else
         /*
          * With the classic ARM MMU, a pte page has two corresponding pmd
          * entries, each covering 1MB.
@@ -206,6 +209,7 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
         addr &= PMD_MASK;
         tlb_add_flush(tlb, addr + SZ_1M - PAGE_SIZE);
         tlb_add_flush(tlb, addr + SZ_1M);
+#endif
 
         tlb_remove_page(tlb, pte);
 }
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index 479a6352e0b5..77bd79f2ffdb 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -101,28 +101,39 @@ extern int __get_user_1(void *);
 extern int __get_user_2(void *);
 extern int __get_user_4(void *);
 
-#define __get_user_x(__r2,__p,__e,__s,__i...)                           \
+#define __GUP_CLOBBER_1 "lr", "cc"
+#ifdef CONFIG_CPU_USE_DOMAINS
+#define __GUP_CLOBBER_2 "ip", "lr", "cc"
+#else
+#define __GUP_CLOBBER_2 "lr", "cc"
+#endif
+#define __GUP_CLOBBER_4 "lr", "cc"
+
+#define __get_user_x(__r2,__p,__e,__l,__s)                              \
            __asm__ __volatile__ (                                       \
                 __asmeq("%0", "r0") __asmeq("%1", "r2")                 \
+                __asmeq("%3", "r1")                                     \
                 "bl     __get_user_" #__s                               \
                 : "=&r" (__e), "=r" (__r2)                              \
-                : "0" (__p)                                             \
-                : __i, "cc")
+                : "0" (__p), "r" (__l)                                  \
+                : __GUP_CLOBBER_##__s)
 
-#define get_user(x,p)                                                   \
+#define __get_user_check(x,p)                                                   \
         ({                                                              \
+                unsigned long __limit = current_thread_info()->addr_limit - 1; \
                 register const typeof(*(p)) __user *__p asm("r0") = (p);\
                 register unsigned long __r2 asm("r2");                  \
+                register unsigned long __l asm("r1") = __limit;         \
                 register int __e asm("r0");                             \
                 switch (sizeof(*(__p))) {                               \
                 case 1:                                                 \
-                        __get_user_x(__r2, __p, __e, 1, "lr");          \
-                        break;                                          \
+                        __get_user_x(__r2, __p, __e, __l, 1);           \
+                        break;                                          \
                 case 2:                                                 \
-                        __get_user_x(__r2, __p, __e, 2, "r3", "lr");    \
+                        __get_user_x(__r2, __p, __e, __l, 2);           \
                         break;                                          \
                 case 4:                                                 \
-                        __get_user_x(__r2, __p, __e, 4, "lr");          \
+                        __get_user_x(__r2, __p, __e, __l, 4);           \
                         break;                                          \
                 default: __e = __get_user_bad(); break;                 \
                 }                                                       \
@@ -130,42 +141,57 @@ extern int __get_user_4(void *);
                 __e;                                                    \
         })
 
+#define get_user(x,p)                                                   \
+        ({                                                              \
+                might_fault();                                          \
+                __get_user_check(x,p);                                  \
+         })
+
 extern int __put_user_1(void *, unsigned int);
 extern int __put_user_2(void *, unsigned int);
 extern int __put_user_4(void *, unsigned int);
 extern int __put_user_8(void *, unsigned long long);
 
-#define __put_user_x(__r2,__p,__e,__s)                                  \
+#define __put_user_x(__r2,__p,__e,__l,__s)                              \
            __asm__ __volatile__ (                                       \
                 __asmeq("%0", "r0") __asmeq("%2", "r2")                 \
+                __asmeq("%3", "r1")                                     \
                 "bl     __put_user_" #__s                               \
                 : "=&r" (__e)                                           \
-                : "0" (__p), "r" (__r2)                                 \
+                : "0" (__p), "r" (__r2), "r" (__l)                      \
                 : "ip", "lr", "cc")
 
-#define put_user(x,p)                                                   \
+#define __put_user_check(x,p)                                                   \
         ({                                                              \
+                unsigned long __limit = current_thread_info()->addr_limit - 1; \
                 register const typeof(*(p)) __r2 asm("r2") = (x);       \
                 register const typeof(*(p)) __user *__p asm("r0") = (p);\
+                register unsigned long __l asm("r1") = __limit;         \
                 register int __e asm("r0");                             \
                 switch (sizeof(*(__p))) {                               \
                 case 1:                                                 \
-                        __put_user_x(__r2, __p, __e, 1);                \
+                        __put_user_x(__r2, __p, __e, __l, 1);           \
                         break;                                          \
                 case 2:                                                 \
-                        __put_user_x(__r2, __p, __e, 2);                \
+                        __put_user_x(__r2, __p, __e, __l, 2);           \
                         break;                                          \
                 case 4:                                                 \
-                        __put_user_x(__r2, __p, __e, 4);                \
+                        __put_user_x(__r2, __p, __e, __l, 4);           \
                         break;                                          \
                 case 8:                                                 \
-                        __put_user_x(__r2, __p, __e, 8);                \
+                        __put_user_x(__r2, __p, __e, __l, 8);           \
                         break;                                          \
                 default: __e = __put_user_bad(); break;                 \
                 }                                                       \
                 __e;                                                    \
         })
 
+#define put_user(x,p)                                                   \
+        ({                                                              \
+                might_fault();                                          \
+                __put_user_check(x,p);                                  \
+         })
+
 #else /* CONFIG_MMU */
 
 /*
@@ -219,6 +245,7 @@ do {									\
         unsigned long __gu_addr = (unsigned long)(ptr);                 \
         unsigned long __gu_val;                                         \
         __chk_user_ptr(ptr);                                            \
+        might_fault();                                                  \
         switch (sizeof(*(ptr))) {                                       \
         case 1: __get_user_asm_byte(__gu_val,__gu_addr,err);    break;  \
         case 2: __get_user_asm_half(__gu_val,__gu_addr,err);    break;  \
@@ -300,6 +327,7 @@ do {									\
         unsigned long __pu_addr = (unsigned long)(ptr);                 \
         __typeof__(*(ptr)) __pu_val = (x);                              \
         __chk_user_ptr(ptr);                                            \
+        might_fault();                                                  \
         switch (sizeof(*(ptr))) {                                       \
         case 1: __put_user_asm_byte(__pu_val,__pu_addr,err);    break;  \
         case 2: __put_user_asm_half(__pu_val,__pu_addr,err);    break;  \
diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
index ba386bd94107..281bf3301241 100644
--- a/arch/arm/kernel/hw_breakpoint.c
+++ b/arch/arm/kernel/hw_breakpoint.c
@@ -159,6 +159,12 @@ static int debug_arch_supported(void)
                 arch >= ARM_DEBUG_ARCH_V7_1;
 }
 
+/* Can we determine the watchpoint access type from the fsr? */
+static int debug_exception_updates_fsr(void)
+{
+        return 0;
+}
+
 /* Determine number of WRP registers available. */
 static int get_num_wrp_resources(void)
 {
@@ -604,13 +610,14 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp)
                 /* Aligned */
                 break;
         case 1:
-                /* Allow single byte watchpoint. */
-                if (info->ctrl.len == ARM_BREAKPOINT_LEN_1)
-                        break;
         case 2:
                 /* Allow halfword watchpoints and breakpoints. */
                 if (info->ctrl.len == ARM_BREAKPOINT_LEN_2)
                         break;
+        case 3:
+                /* Allow single byte watchpoint. */
+                if (info->ctrl.len == ARM_BREAKPOINT_LEN_1)
+                        break;
         default:
                 ret = -EINVAL;
                 goto out;
@@ -619,18 +626,35 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp)
         info->address &= ~alignment_mask;
         info->ctrl.len <<= offset;
 
-        /*
-         * Currently we rely on an overflow handler to take
-         * care of single-stepping the breakpoint when it fires.
-         * In the case of userspace breakpoints on a core with V7 debug,
-         * we can use the mismatch feature as a poor-man's hardware
-         * single-step, but this only works for per-task breakpoints.
-         */
-        if (!bp->overflow_handler && (arch_check_bp_in_kernelspace(bp) ||
-            !core_has_mismatch_brps() || !bp->hw.bp_target)) {
-                pr_warning("overflow handler required but none found\n");
-                ret = -EINVAL;
+        if (!bp->overflow_handler) {
+                /*
+                 * Mismatch breakpoints are required for single-stepping
+                 * breakpoints.
+                 */
+                if (!core_has_mismatch_brps())
+                        return -EINVAL;
+
+                /* We don't allow mismatch breakpoints in kernel space. */
+                if (arch_check_bp_in_kernelspace(bp))
+                        return -EPERM;
+
+                /*
+                 * Per-cpu breakpoints are not supported by our stepping
+                 * mechanism.
+                 */
+                if (!bp->hw.bp_target)
+                        return -EINVAL;
+
+                /*
+                 * We only support specific access types if the fsr
+                 * reports them.
+                 */
+                if (!debug_exception_updates_fsr() &&
+                    (info->ctrl.type == ARM_BREAKPOINT_LOAD ||
+                     info->ctrl.type == ARM_BREAKPOINT_STORE))
+                        return -EINVAL;
         }
+
 out:
         return ret;
 }
@@ -706,10 +730,12 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr,
                                 goto unlock;
 
                         /* Check that the access type matches. */
-                        access = (fsr & ARM_FSR_ACCESS_MASK) ? HW_BREAKPOINT_W :
-                                 HW_BREAKPOINT_R;
-                        if (!(access & hw_breakpoint_type(wp)))
-                                goto unlock;
+                        if (debug_exception_updates_fsr()) {
+                                access = (fsr & ARM_FSR_ACCESS_MASK) ?
+                                          HW_BREAKPOINT_W : HW_BREAKPOINT_R;
+                                if (!(access & hw_breakpoint_type(wp)))
+                                        goto unlock;
+                        }
 
                         /* We have a winner. */
                         info->trigger = addr;
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index f7945218b8c6..b0179b89a04c 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -420,20 +420,23 @@ asmlinkage void __exception do_undefinstr(struct pt_regs *regs)
 #endif
                         instr = *(u32 *) pc;
         } else if (thumb_mode(regs)) {
-                get_user(instr, (u16 __user *)pc);
+                if (get_user(instr, (u16 __user *)pc))
+                        goto die_sig;
                 if (is_wide_instruction(instr)) {
                         unsigned int instr2;
-                        get_user(instr2, (u16 __user *)pc+1);
+                        if (get_user(instr2, (u16 __user *)pc+1))
+                                goto die_sig;
                         instr <<= 16;
                         instr |= instr2;
                 }
-        } else {
-                get_user(instr, (u32 __user *)pc);
+        } else if (get_user(instr, (u32 __user *)pc)) {
+                goto die_sig;
         }
 
         if (call_undef_hook(regs, instr) == 0)
                 return;
 
+die_sig:
 #ifdef CONFIG_DEBUG_USER
         if (user_debug & UDBG_UNDEFINED) {
                 printk(KERN_INFO "%s (%d): undefined instruction: pc=%p\n",
diff --git a/arch/arm/lib/delay.c b/arch/arm/lib/delay.c
index d6dacc69254e..395d5fbb8fa2 100644
--- a/arch/arm/lib/delay.c
+++ b/arch/arm/lib/delay.c
@@ -59,6 +59,7 @@ void __init init_current_timer_delay(unsigned long freq)
 {
         pr_info("Switching to timer-based delay loop\n");
         lpj_fine                        = freq / HZ;
+        loops_per_jiffy                 = lpj_fine;
         arm_delay_ops.delay             = __timer_delay;
         arm_delay_ops.const_udelay      = __timer_const_udelay;
         arm_delay_ops.udelay            = __timer_udelay;
diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S
index 11093a7c3e32..9b06bb41fca6 100644
--- a/arch/arm/lib/getuser.S
+++ b/arch/arm/lib/getuser.S
@@ -16,8 +16,9 @@
  * __get_user_X
  *
  * Inputs:      r0 contains the address
+ *              r1 contains the address limit, which must be preserved
  * Outputs:     r0 is the error code
- *              r2, r3 contains the zero-extended value
+ *              r2 contains the zero-extended value
  *              lr corrupted
  *
  * No other registers must be altered.  (see <asm/uaccess.h>
@@ -27,33 +28,39 @@
  * Note also that it is intended that __get_user_bad is not global.
  */
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 #include <asm/errno.h>
 #include <asm/domain.h>
 
 ENTRY(__get_user_1)
+        check_uaccess r0, 1, r1, r2, __get_user_bad
 1: TUSER(ldrb)  r2, [r0]
         mov     r0, #0
         mov     pc, lr
 ENDPROC(__get_user_1)
 
 ENTRY(__get_user_2)
-#ifdef CONFIG_THUMB2_KERNEL
-2: TUSER(ldrb)  r2, [r0]
-3: TUSER(ldrb)  r3, [r0, #1]
+        check_uaccess r0, 2, r1, r2, __get_user_bad
+#ifdef CONFIG_CPU_USE_DOMAINS
+rb      .req    ip
+2:      ldrbt   r2, [r0], #1
+3:      ldrbt   rb, [r0], #0
 #else
-2: TUSER(ldrb)  r2, [r0], #1
-3: TUSER(ldrb)  r3, [r0]
+rb      .req    r0
+2:      ldrb    r2, [r0]
+3:      ldrb    rb, [r0, #1]
 #endif
 #ifndef __ARMEB__
-        orr     r2, r2, r3, lsl #8
+        orr     r2, r2, rb, lsl #8
 #else
-        orr     r2, r3, r2, lsl #8
+        orr     r2, rb, r2, lsl #8
 #endif
         mov     r0, #0
         mov     pc, lr
 ENDPROC(__get_user_2)
 
 ENTRY(__get_user_4)
+        check_uaccess r0, 4, r1, r2, __get_user_bad
 4: TUSER(ldr)   r2, [r0]
         mov     r0, #0
         mov     pc, lr
diff --git a/arch/arm/lib/putuser.S b/arch/arm/lib/putuser.S
index 7db25990c589..3d73dcb959b0 100644
--- a/arch/arm/lib/putuser.S
+++ b/arch/arm/lib/putuser.S
@@ -16,6 +16,7 @@
  * __put_user_X
  *
  * Inputs:      r0 contains the address
+ *              r1 contains the address limit, which must be preserved
  *              r2, r3 contains the value
  * Outputs:     r0 is the error code
  *              lr corrupted
@@ -27,16 +28,19 @@
  * Note also that it is intended that __put_user_bad is not global.
  */
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 #include <asm/errno.h>
 #include <asm/domain.h>
 
 ENTRY(__put_user_1)
+        check_uaccess r0, 1, r1, ip, __put_user_bad
 1: TUSER(strb)  r2, [r0]
         mov     r0, #0
         mov     pc, lr
 ENDPROC(__put_user_1)
 
 ENTRY(__put_user_2)
+        check_uaccess r0, 2, r1, ip, __put_user_bad
         mov     ip, r2, lsr #8
 #ifdef CONFIG_THUMB2_KERNEL
 #ifndef __ARMEB__
@@ -60,12 +64,14 @@ ENTRY(__put_user_2)
 ENDPROC(__put_user_2)
 
 ENTRY(__put_user_4)
+        check_uaccess r0, 4, r1, ip, __put_user_bad
 4: TUSER(str)   r2, [r0]
         mov     r0, #0
         mov     pc, lr
 ENDPROC(__put_user_4)
 
 ENTRY(__put_user_8)
+        check_uaccess r0, 8, r1, ip, __put_user_bad
 #ifdef CONFIG_THUMB2_KERNEL
 5: TUSER(str)   r2, [r0]
 6: TUSER(str)   r3, [r0, #4]
diff --git a/arch/arm/mach-at91/at91rm9200_time.c b/arch/arm/mach-at91/at91rm9200_time.c
index 104ca40d8d18..aaa443b48c91 100644
--- a/arch/arm/mach-at91/at91rm9200_time.c
+++ b/arch/arm/mach-at91/at91rm9200_time.c
@@ -197,7 +197,7 @@ void __init at91rm9200_timer_init(void)
         at91_st_read(AT91_ST_SR);
 
         /* Make IRQs happen for the system timer */
-        setup_irq(AT91_ID_SYS, &at91rm9200_timer_irq);
+        setup_irq(NR_IRQS_LEGACY + AT91_ID_SYS, &at91rm9200_timer_irq);
 
         /* The 32KiHz "Slow Clock" (tick every 30517.58 nanoseconds) is used
          * directly for the clocksource and all clockevents, after adjusting
diff --git a/arch/arm/mach-at91/at91sam9260_devices.c b/arch/arm/mach-at91/at91sam9260_devices.c
index 7b9c2ba396ed..bce572a530ef 100644
--- a/arch/arm/mach-at91/at91sam9260_devices.c
+++ b/arch/arm/mach-at91/at91sam9260_devices.c
@@ -726,6 +726,8 @@ static struct resource rtt_resources[] = {
                 .flags  = IORESOURCE_MEM,
         }, {
                 .flags  = IORESOURCE_MEM,
+        }, {
+                .flags  = IORESOURCE_IRQ,
         },
 };
 
@@ -744,10 +746,12 @@ static void __init at91_add_device_rtt_rtc(void)
          * The second resource is needed:
          * GPBR will serve as the storage for RTC time offset
          */
-        at91sam9260_rtt_device.num_resources = 2;
+        at91sam9260_rtt_device.num_resources = 3;
         rtt_resources[1].start = AT91SAM9260_BASE_GPBR +
                                  4 * CONFIG_RTC_DRV_AT91SAM9_GPBR;
         rtt_resources[1].end = rtt_resources[1].start + 3;
+        rtt_resources[2].start = NR_IRQS_LEGACY + AT91_ID_SYS;
+        rtt_resources[2].end = NR_IRQS_LEGACY + AT91_ID_SYS;
 }
 #else
 static void __init at91_add_device_rtt_rtc(void)
diff --git a/arch/arm/mach-at91/at91sam9261_devices.c b/arch/arm/mach-at91/at91sam9261_devices.c
index 8df5c1bdff92..bc2590d712d0 100644
--- a/arch/arm/mach-at91/at91sam9261_devices.c
+++ b/arch/arm/mach-at91/at91sam9261_devices.c
@@ -609,6 +609,8 @@ static struct resource rtt_resources[] = {
                 .flags  = IORESOURCE_MEM,
         }, {
                 .flags  = IORESOURCE_MEM,
+        }, {
+                .flags  = IORESOURCE_IRQ,
         }
 };
 
@@ -626,10 +628,12 @@ static void __init at91_add_device_rtt_rtc(void)
          * The second resource is needed:
          * GPBR will serve as the storage for RTC time offset
          */
-        at91sam9261_rtt_device.num_resources = 2;
+        at91sam9261_rtt_device.num_resources = 3;
         rtt_resources[1].start = AT91SAM9261_BASE_GPBR +
                                  4 * CONFIG_RTC_DRV_AT91SAM9_GPBR;
         rtt_resources[1].end = rtt_resources[1].start + 3;
+        rtt_resources[2].start = NR_IRQS_LEGACY + AT91_ID_SYS;
+        rtt_resources[2].end = NR_IRQS_LEGACY + AT91_ID_SYS;
 }
 #else
 static void __init at91_add_device_rtt_rtc(void)
diff --git a/arch/arm/mach-at91/at91sam9263_devices.c b/arch/arm/mach-at91/at91sam9263_devices.c
index eb6bbf86fb9f..9b6ca734f1a9 100644
--- a/arch/arm/mach-at91/at91sam9263_devices.c
+++ b/arch/arm/mach-at91/at91sam9263_devices.c
@@ -990,6 +990,8 @@ static struct resource rtt0_resources[] = {
                 .flags  = IORESOURCE_MEM,
         }, {
                 .flags  = IORESOURCE_MEM,
+        }, {
+                .flags  = IORESOURCE_IRQ,
         }
 };
 
@@ -1006,6 +1008,8 @@ static struct resource rtt1_resources[] = {
                 .flags  = IORESOURCE_MEM,
         }, {
                 .flags  = IORESOURCE_MEM,
+        }, {
+                .flags  = IORESOURCE_IRQ,
         }
 };
 
@@ -1027,14 +1031,14 @@ static void __init at91_add_device_rtt_rtc(void)
                  * The second resource is needed only for the chosen RTT:
                  * GPBR will serve as the storage for RTC time offset
                  */
-                at91sam9263_rtt0_device.num_resources = 2;
+                at91sam9263_rtt0_device.num_resources = 3;
                 at91sam9263_rtt1_device.num_resources = 1;
                 pdev = &at91sam9263_rtt0_device;
                 r = rtt0_resources;
                 break;
         case 1:
                 at91sam9263_rtt0_device.num_resources = 1;
-                at91sam9263_rtt1_device.num_resources = 2;
+                at91sam9263_rtt1_device.num_resources = 3;
                 pdev = &at91sam9263_rtt1_device;
                 r = rtt1_resources;
                 break;
@@ -1047,6 +1051,8 @@ static void __init at91_add_device_rtt_rtc(void)
         pdev->name = "rtc-at91sam9";
         r[1].start = AT91SAM9263_BASE_GPBR + 4 * CONFIG_RTC_DRV_AT91SAM9_GPBR;
         r[1].end = r[1].start + 3;
+        r[2].start = NR_IRQS_LEGACY + AT91_ID_SYS;
+        r[2].end = NR_IRQS_LEGACY + AT91_ID_SYS;
 }
 #else
 static void __init at91_add_device_rtt_rtc(void)
diff --git a/arch/arm/mach-at91/at91sam9g45_devices.c b/arch/arm/mach-at91/at91sam9g45_devices.c
index 06073996a382..1b47319ca00b 100644
--- a/arch/arm/mach-at91/at91sam9g45_devices.c
+++ b/arch/arm/mach-at91/at91sam9g45_devices.c
@@ -1293,6 +1293,8 @@ static struct resource rtt_resources[] = {
                 .flags  = IORESOURCE_MEM,
         }, {
                 .flags  = IORESOURCE_MEM,
+        }, {
+                .flags  = IORESOURCE_IRQ,
         }
 };
 
@@ -1310,10 +1312,12 @@ static void __init at91_add_device_rtt_rtc(void)
          * The second resource is needed:
          * GPBR will serve as the storage for RTC time offset
          */
-        at91sam9g45_rtt_device.num_resources = 2;
+        at91sam9g45_rtt_device.num_resources = 3;
         rtt_resources[1].start = AT91SAM9G45_BASE_GPBR +
                                  4 * CONFIG_RTC_DRV_AT91SAM9_GPBR;
         rtt_resources[1].end = rtt_resources[1].start + 3;
+        rtt_resources[2].start = NR_IRQS_LEGACY + AT91_ID_SYS;
+        rtt_resources[2].end = NR_IRQS_LEGACY + AT91_ID_SYS;
 }
 #else
 static void __init at91_add_device_rtt_rtc(void)
diff --git a/arch/arm/mach-at91/at91sam9rl_devices.c b/arch/arm/mach-at91/at91sam9rl_devices.c
index f09fff932172..b3d365dadef5 100644
--- a/arch/arm/mach-at91/at91sam9rl_devices.c
+++ b/arch/arm/mach-at91/at91sam9rl_devices.c
@@ -688,6 +688,8 @@ static struct resource rtt_resources[] = {
                 .flags  = IORESOURCE_MEM,
         }, {
                 .flags  = IORESOURCE_MEM,
+        }, {
+                .flags  = IORESOURCE_IRQ,
         }
 };
 
@@ -705,10 +707,12 @@ static void __init at91_add_device_rtt_rtc(void)
          * The second resource is needed:
          * GPBR will serve as the storage for RTC time offset
          */
-        at91sam9rl_rtt_device.num_resources = 2;
+        at91sam9rl_rtt_device.num_resources = 3;
         rtt_resources[1].start = AT91SAM9RL_BASE_GPBR +
                                  4 * CONFIG_RTC_DRV_AT91SAM9_GPBR;
         rtt_resources[1].end = rtt_resources[1].start + 3;
+        rtt_resources[2].start = NR_IRQS_LEGACY + AT91_ID_SYS;
+        rtt_resources[2].end = NR_IRQS_LEGACY + AT91_ID_SYS;
 }
 #else
 static void __init at91_add_device_rtt_rtc(void)
diff --git a/arch/arm/mach-at91/clock.c b/arch/arm/mach-at91/clock.c
index de2ec6b8fea7..188c82971ebd 100644
--- a/arch/arm/mach-at91/clock.c
+++ b/arch/arm/mach-at91/clock.c
@@ -63,6 +63,12 @@ EXPORT_SYMBOL_GPL(at91_pmc_base);
 
 #define cpu_has_300M_plla()     (cpu_is_at91sam9g10())
 
+#define cpu_has_240M_plla()     (cpu_is_at91sam9261() \
+                                || cpu_is_at91sam9263() \
+                                || cpu_is_at91sam9rl())
+
+#define cpu_has_210M_plla()     (cpu_is_at91sam9260())
+
 #define cpu_has_pllb()          (!(cpu_is_at91sam9rl() \
                                 || cpu_is_at91sam9g45() \
                                 || cpu_is_at91sam9x5() \
@@ -706,6 +712,12 @@ static int __init at91_pmc_init(unsigned long main_clock)
         } else if (cpu_has_800M_plla()) {
                 if (plla.rate_hz > 800000000)
                         pll_overclock = true;
+        } else if (cpu_has_240M_plla()) {
+                if (plla.rate_hz > 240000000)
+                        pll_overclock = true;
+        } else if (cpu_has_210M_plla()) {
+                if (plla.rate_hz > 210000000)
+                        pll_overclock = true;
         } else {
                 if (plla.rate_hz > 209000000)
                         pll_overclock = true;
diff --git a/arch/arm/mach-gemini/irq.c b/arch/arm/mach-gemini/irq.c
index ca70e5fcc7ac..020852d3bdd8 100644
--- a/arch/arm/mach-gemini/irq.c
+++ b/arch/arm/mach-gemini/irq.c
@@ -17,6 +17,7 @@
 #include <linux/sched.h>
 #include <asm/irq.h>
 #include <asm/mach/irq.h>
+#include <asm/system_misc.h>
 #include <mach/hardware.h>
 
 #define IRQ_SOURCE(base_addr)   (base_addr + 0x00)
diff --git a/arch/arm/mach-imx/clk-imx25.c b/arch/arm/mach-imx/clk-imx25.c
index fdd8cc87c9fe..4431a62fff5b 100644
--- a/arch/arm/mach-imx/clk-imx25.c
+++ b/arch/arm/mach-imx/clk-imx25.c
@@ -222,10 +222,8 @@ int __init mx25_clocks_init(void)
         clk_register_clkdev(clk[lcdc_ipg], "ipg", "imx-fb.0");
         clk_register_clkdev(clk[lcdc_ahb], "ahb", "imx-fb.0");
         clk_register_clkdev(clk[wdt_ipg], NULL, "imx2-wdt.0");
-        clk_register_clkdev(clk[ssi1_ipg_per], "per", "imx-ssi.0");
-        clk_register_clkdev(clk[ssi1_ipg], "ipg", "imx-ssi.0");
-        clk_register_clkdev(clk[ssi2_ipg_per], "per", "imx-ssi.1");
-        clk_register_clkdev(clk[ssi2_ipg], "ipg", "imx-ssi.1");
+        clk_register_clkdev(clk[ssi1_ipg], NULL, "imx-ssi.0");
+        clk_register_clkdev(clk[ssi2_ipg], NULL, "imx-ssi.1");
         clk_register_clkdev(clk[esdhc1_ipg_per], "per", "sdhci-esdhc-imx25.0");
         clk_register_clkdev(clk[esdhc1_ipg], "ipg", "sdhci-esdhc-imx25.0");
         clk_register_clkdev(clk[esdhc1_ahb], "ahb", "sdhci-esdhc-imx25.0");
diff --git a/arch/arm/mach-imx/clk-imx35.c b/arch/arm/mach-imx/clk-imx35.c
index c6422fb10bae..65fb8bcd86cb 100644
--- a/arch/arm/mach-imx/clk-imx35.c
+++ b/arch/arm/mach-imx/clk-imx35.c
@@ -230,10 +230,8 @@ int __init mx35_clocks_init()
         clk_register_clkdev(clk[ipu_gate], NULL, "mx3_sdc_fb");
         clk_register_clkdev(clk[owire_gate], NULL, "mxc_w1");
         clk_register_clkdev(clk[sdma_gate], NULL, "imx35-sdma");
-        clk_register_clkdev(clk[ipg], "ipg", "imx-ssi.0");
-        clk_register_clkdev(clk[ssi1_div_post], "per", "imx-ssi.0");
-        clk_register_clkdev(clk[ipg], "ipg", "imx-ssi.1");
-        clk_register_clkdev(clk[ssi2_div_post], "per", "imx-ssi.1");
+        clk_register_clkdev(clk[ssi1_gate], NULL, "imx-ssi.0");
+        clk_register_clkdev(clk[ssi2_gate], NULL, "imx-ssi.1");
         /* i.mx35 has the i.mx21 type uart */
         clk_register_clkdev(clk[uart1_gate], "per", "imx21-uart.0");
         clk_register_clkdev(clk[ipg], "ipg", "imx21-uart.0");
diff --git a/arch/arm/mach-kirkwood/common.c b/arch/arm/mach-kirkwood/common.c
index 3226077735b1..1201191d7f1b 100644
--- a/arch/arm/mach-kirkwood/common.c
+++ b/arch/arm/mach-kirkwood/common.c
@@ -517,6 +517,13 @@ void __init kirkwood_wdt_init(void)
 void __init kirkwood_init_early(void)
 {
         orion_time_set_base(TIMER_VIRT_BASE);
+
+        /*
+         * Some Kirkwood devices allocate their coherent buffers from atomic
+         * context. Increase size of atomic coherent pool to make sure such
+         * the allocations won't fail.
+         */
+        init_dma_coherent_pool_size(SZ_1M);
 }
 
 int kirkwood_tclk;
diff --git a/arch/arm/mach-kirkwood/db88f6281-bp-setup.c b/arch/arm/mach-kirkwood/db88f6281-bp-setup.c
index d93359379598..be90b7d0e10b 100644
--- a/arch/arm/mach-kirkwood/db88f6281-bp-setup.c
+++ b/arch/arm/mach-kirkwood/db88f6281-bp-setup.c
@@ -10,6 +10,7 @@
 
 #include <linux/kernel.h>
 #include <linux/init.h>
+#include <linux/sizes.h>
 #include <linux/platform_device.h>
 #include <linux/mtd/partitions.h>
 #include <linux/ata_platform.h>
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index fcd4e85c4ddc..346fd26f3aa6 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -232,10 +232,11 @@ config MACH_OMAP3_PANDORA
         select OMAP_PACKAGE_CBB
         select REGULATOR_FIXED_VOLTAGE if REGULATOR
 
-config MACH_OMAP3_TOUCHBOOK
+config MACH_TOUCHBOOK
         bool "OMAP3 Touch Book"
         depends on ARCH_OMAP3
         default y
+        select OMAP_PACKAGE_CBB
 
 config MACH_OMAP_3430SDP
         bool "OMAP 3430 SDP board"
diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index f6a24b3f9c4f..34c2c7f59f0a 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -255,7 +255,7 @@ obj-$(CONFIG_MACH_OMAP_3630SDP)		+= board-zoom-display.o
 obj-$(CONFIG_MACH_CM_T35)               += board-cm-t35.o
 obj-$(CONFIG_MACH_CM_T3517)             += board-cm-t3517.o
 obj-$(CONFIG_MACH_IGEP0020)             += board-igep0020.o
-obj-$(CONFIG_MACH_OMAP3_TOUCHBOOK)      += board-omap3touchbook.o
+obj-$(CONFIG_MACH_TOUCHBOOK)            += board-omap3touchbook.o
 obj-$(CONFIG_MACH_OMAP_4430SDP)         += board-4430sdp.o
 obj-$(CONFIG_MACH_OMAP4_PANDA)          += board-omap4panda.o
 
diff --git a/arch/arm/mach-omap2/clock33xx_data.c b/arch/arm/mach-omap2/clock33xx_data.c
index 25bbcc7ca4dc..ae27de8899a6 100644
--- a/arch/arm/mach-omap2/clock33xx_data.c
+++ b/arch/arm/mach-omap2/clock33xx_data.c
@@ -1036,13 +1036,13 @@ static struct omap_clk am33xx_clks[] = {
         CLK(NULL,       "mmu_fck",              &mmu_fck,       CK_AM33XX),
         CLK(NULL,       "smartreflex0_fck",     &smartreflex0_fck,      CK_AM33XX),
         CLK(NULL,       "smartreflex1_fck",     &smartreflex1_fck,      CK_AM33XX),
-        CLK(NULL,       "gpt1_fck",             &timer1_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt2_fck",             &timer2_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt3_fck",             &timer3_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt4_fck",             &timer4_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt5_fck",             &timer5_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt6_fck",             &timer6_fck,    CK_AM33XX),
-        CLK(NULL,       "gpt7_fck",             &timer7_fck,    CK_AM33XX),
+        CLK(NULL,       "timer1_fck",           &timer1_fck,    CK_AM33XX),
+        CLK(NULL,       "timer2_fck",           &timer2_fck,    CK_AM33XX),
+        CLK(NULL,       "timer3_fck",           &timer3_fck,    CK_AM33XX),
+        CLK(NULL,       "timer4_fck",           &timer4_fck,    CK_AM33XX),
+        CLK(NULL,       "timer5_fck",           &timer5_fck,    CK_AM33XX),
+        CLK(NULL,       "timer6_fck",           &timer6_fck,    CK_AM33XX),
+        CLK(NULL,       "timer7_fck",           &timer7_fck,    CK_AM33XX),
         CLK(NULL,       "usbotg_fck",           &usbotg_fck,    CK_AM33XX),
         CLK(NULL,       "ieee5000_fck",         &ieee5000_fck,  CK_AM33XX),
         CLK(NULL,       "wdt1_fck",             &wdt1_fck,      CK_AM33XX),
diff --git a/arch/arm/mach-omap2/clockdomain2xxx_3xxx.c b/arch/arm/mach-omap2/clockdomain2xxx_3xxx.c
index a0d68dbecfa3..f99e65cfb862 100644
--- a/arch/arm/mach-omap2/clockdomain2xxx_3xxx.c
+++ b/arch/arm/mach-omap2/clockdomain2xxx_3xxx.c
@@ -241,6 +241,52 @@ static void omap3_clkdm_deny_idle(struct clockdomain *clkdm)
                 _clkdm_del_autodeps(clkdm);
 }
 
+static int omap3xxx_clkdm_clk_enable(struct clockdomain *clkdm)
+{
+        bool hwsup = false;
+
+        if (!clkdm->clktrctrl_mask)
+                return 0;
+
+        hwsup = omap2_cm_is_clkdm_in_hwsup(clkdm->pwrdm.ptr->prcm_offs,
+                                clkdm->clktrctrl_mask);
+
+        if (hwsup) {
+                /* Disable HW transitions when we are changing deps */
+                _disable_hwsup(clkdm);
+                _clkdm_add_autodeps(clkdm);
+                _enable_hwsup(clkdm);
+        } else {
+                if (clkdm->flags & CLKDM_CAN_FORCE_WAKEUP)
+                        omap3_clkdm_wakeup(clkdm);
+        }
+
+        return 0;
+}
+
+static int omap3xxx_clkdm_clk_disable(struct clockdomain *clkdm)
+{
+        bool hwsup = false;
+
+        if (!clkdm->clktrctrl_mask)
+                return 0;
+
+        hwsup = omap2_cm_is_clkdm_in_hwsup(clkdm->pwrdm.ptr->prcm_offs,
+                                clkdm->clktrctrl_mask);
+
+        if (hwsup) {
+                /* Disable HW transitions when we are changing deps */
+                _disable_hwsup(clkdm);
+                _clkdm_del_autodeps(clkdm);
+                _enable_hwsup(clkdm);
+        } else {
+                if (clkdm->flags & CLKDM_CAN_FORCE_SLEEP)
+                        omap3_clkdm_sleep(clkdm);
+        }
+
+        return 0;
+}
+
 struct clkdm_ops omap2_clkdm_operations = {
         .clkdm_add_wkdep        = omap2_clkdm_add_wkdep,
         .clkdm_del_wkdep        = omap2_clkdm_del_wkdep,
@@ -267,6 +313,6 @@ struct clkdm_ops omap3_clkdm_operations = {
         .clkdm_wakeup           = omap3_clkdm_wakeup,
         .clkdm_allow_idle       = omap3_clkdm_allow_idle,
         .clkdm_deny_idle        = omap3_clkdm_deny_idle,
-        .clkdm_clk_enable       = omap2_clkdm_clk_enable,
-        .clkdm_clk_disable      = omap2_clkdm_clk_disable,
+        .clkdm_clk_enable       = omap3xxx_clkdm_clk_enable,
+        .clkdm_clk_disable      = omap3xxx_clkdm_clk_disable,
 };
diff --git a/arch/arm/mach-omap2/cm-regbits-34xx.h b/arch/arm/mach-omap2/cm-regbits-34xx.h
index 766338fe4d34..975f6bda0e0b 100644
--- a/arch/arm/mach-omap2/cm-regbits-34xx.h
+++ b/arch/arm/mach-omap2/cm-regbits-34xx.h
@@ -67,6 +67,7 @@
 #define OMAP3430_EN_IVA2_DPLL_MASK                      (0x7 << 0)
 
 /* CM_IDLEST_IVA2 */
+#define OMAP3430_ST_IVA2_SHIFT                          0
 #define OMAP3430_ST_IVA2_MASK                           (1 << 0)
 
 /* CM_IDLEST_PLL_IVA2 */
diff --git a/arch/arm/mach-omap2/omap-wakeupgen.c b/arch/arm/mach-omap2/omap-wakeupgen.c
index 05fdebfaa195..330d4c6e746b 100644
--- a/arch/arm/mach-omap2/omap-wakeupgen.c
+++ b/arch/arm/mach-omap2/omap-wakeupgen.c
@@ -46,7 +46,7 @@
 static void __iomem *wakeupgen_base;
 static void __iomem *sar_base;
 static DEFINE_SPINLOCK(wakeupgen_lock);
-static unsigned int irq_target_cpu[NR_IRQS];
+static unsigned int irq_target_cpu[MAX_IRQS];
 static unsigned int irq_banks = MAX_NR_REG_BANKS;
 static unsigned int max_irqs = MAX_IRQS;
 static unsigned int omap_secure_apis;
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 6ca8e519968d..37afbd173c2c 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -1889,6 +1889,7 @@ static int _enable(struct omap_hwmod *oh)
                         _enable_sysc(oh);
                 }
         } else {
+                _omap4_disable_module(oh);
                 _disable_clocks(oh);
                 pr_debug("omap_hwmod: %s: _wait_target_ready: %d\n",
                          oh->name, r);
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index c9e38200216b..ce7e6068768f 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -100,9 +100,9 @@ static struct omap_hwmod omap3xxx_mpu_hwmod = {
 
 /* IVA2 (IVA2) */
 static struct omap_hwmod_rst_info omap3xxx_iva_resets[] = {
-        { .name = "logic", .rst_shift = 0 },
-        { .name = "seq0", .rst_shift = 1 },
-        { .name = "seq1", .rst_shift = 2 },
+        { .name = "logic", .rst_shift = 0, .st_shift = 8 },
+        { .name = "seq0", .rst_shift = 1, .st_shift = 9 },
+        { .name = "seq1", .rst_shift = 2, .st_shift = 10 },
 };
 
 static struct omap_hwmod omap3xxx_iva_hwmod = {
@@ -112,6 +112,15 @@ static struct omap_hwmod omap3xxx_iva_hwmod = {
         .rst_lines      = omap3xxx_iva_resets,
         .rst_lines_cnt  = ARRAY_SIZE(omap3xxx_iva_resets),
         .main_clk       = "iva2_ck",
+        .prcm = {
+                .omap2 = {
+                        .module_offs = OMAP3430_IVA2_MOD,
+                        .prcm_reg_id = 1,
+                        .module_bit = OMAP3430_CM_FCLKEN_IVA2_EN_IVA2_SHIFT,
+                        .idlest_reg_id = 1,
+                        .idlest_idle_bit = OMAP3430_ST_IVA2_SHIFT,
+                }
+        },
 };
 
 /* timer class */
diff --git a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
index f65251e58b35..2984ffaaee1f 100644
--- a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
@@ -4210,7 +4210,7 @@ static struct omap_hwmod_ocp_if omap44xx_dsp__iva = {
 };
 
 /* dsp -> sl2if */
-static struct omap_hwmod_ocp_if omap44xx_dsp__sl2if = {
+static struct omap_hwmod_ocp_if __maybe_unused omap44xx_dsp__sl2if = {
         .master         = &omap44xx_dsp_hwmod,
         .slave          = &omap44xx_sl2if_hwmod,
         .clk            = "dpll_iva_m5x2_ck",
@@ -4828,7 +4828,7 @@ static struct omap_hwmod_ocp_if omap44xx_l3_main_2__iss = {
 };
 
 /* iva -> sl2if */
-static struct omap_hwmod_ocp_if omap44xx_iva__sl2if = {
+static struct omap_hwmod_ocp_if __maybe_unused omap44xx_iva__sl2if = {
         .master         = &omap44xx_iva_hwmod,
         .slave          = &omap44xx_sl2if_hwmod,
         .clk            = "dpll_iva_m5x2_ck",
@@ -5364,7 +5364,7 @@ static struct omap_hwmod_ocp_if omap44xx_l4_wkup__scrm = {
 };
 
 /* l3_main_2 -> sl2if */
-static struct omap_hwmod_ocp_if omap44xx_l3_main_2__sl2if = {
+static struct omap_hwmod_ocp_if __maybe_unused omap44xx_l3_main_2__sl2if = {
         .master         = &omap44xx_l3_main_2_hwmod,
         .slave          = &omap44xx_sl2if_hwmod,
         .clk            = "l3_div_ck",
@@ -6034,7 +6034,7 @@ static struct omap_hwmod_ocp_if *omap44xx_hwmod_ocp_ifs[] __initdata = {
         &omap44xx_l4_abe__dmic,
         &omap44xx_l4_abe__dmic_dma,
         &omap44xx_dsp__iva,
-        &omap44xx_dsp__sl2if,
+        /* &omap44xx_dsp__sl2if, */
         &omap44xx_l4_cfg__dsp,
         &omap44xx_l3_main_2__dss,
         &omap44xx_l4_per__dss,
@@ -6070,7 +6070,7 @@ static struct omap_hwmod_ocp_if *omap44xx_hwmod_ocp_ifs[] __initdata = {
         &omap44xx_l4_per__i2c4,
         &omap44xx_l3_main_2__ipu,
         &omap44xx_l3_main_2__iss,
-        &omap44xx_iva__sl2if,
+        /* &omap44xx_iva__sl2if, */
         &omap44xx_l3_main_2__iva,
         &omap44xx_l4_wkup__kbd,
         &omap44xx_l4_cfg__mailbox,
@@ -6101,7 +6101,7 @@ static struct omap_hwmod_ocp_if *omap44xx_hwmod_ocp_ifs[] __initdata = {
         &omap44xx_l4_cfg__cm_core,
         &omap44xx_l4_wkup__prm,
         &omap44xx_l4_wkup__scrm,
-        &omap44xx_l3_main_2__sl2if,
+        /* &omap44xx_l3_main_2__sl2if, */
         &omap44xx_l4_abe__slimbus1,
         &omap44xx_l4_abe__slimbus1_dma,
         &omap44xx_l4_per__slimbus2,
diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
index 2ff6d41ec6c6..2ba4f57dda86 100644
--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -260,6 +260,7 @@ static u32 notrace dmtimer_read_sched_clock(void)
         return 0;
 }
 
+#ifdef CONFIG_OMAP_32K_TIMER
 /* Setup free-running counter for clocksource */
 static int __init omap2_sync32k_clocksource_init(void)
 {
@@ -299,6 +300,12 @@ static int __init omap2_sync32k_clocksource_init(void)
 
         return ret;
 }
+#else
+static inline int omap2_sync32k_clocksource_init(void)
+{
+        return -ENODEV;
+}
+#endif
 
 static void __init omap2_gptimer_clocksource_init(int gptimer_id,
                                                 const char *fck_source)
diff --git a/arch/arm/mach-shmobile/board-armadillo800eva.c b/arch/arm/mach-shmobile/board-armadillo800eva.c
index cf10f92856dc..453a6e50db8b 100644
--- a/arch/arm/mach-shmobile/board-armadillo800eva.c
+++ b/arch/arm/mach-shmobile/board-armadillo800eva.c
@@ -520,13 +520,14 @@ static struct platform_device hdmi_lcdc_device = {
 };
 
 /* GPIO KEY */
-#define GPIO_KEY(c, g, d) { .code = c, .gpio = g, .desc = d, .active_low = 1 }
+#define GPIO_KEY(c, g, d, ...) \
+        { .code = c, .gpio = g, .desc = d, .active_low = 1, __VA_ARGS__ }
 
 static struct gpio_keys_button gpio_buttons[] = {
-        GPIO_KEY(KEY_POWER,     GPIO_PORT99,    "SW1"),
-        GPIO_KEY(KEY_BACK,      GPIO_PORT100,   "SW2"),
-        GPIO_KEY(KEY_MENU,      GPIO_PORT97,    "SW3"),
-        GPIO_KEY(KEY_HOME,      GPIO_PORT98,    "SW4"),
+        GPIO_KEY(KEY_POWER,     GPIO_PORT99,    "SW3", .wakeup = 1),
+        GPIO_KEY(KEY_BACK,      GPIO_PORT100,   "SW4"),
+        GPIO_KEY(KEY_MENU,      GPIO_PORT97,    "SW5"),
+        GPIO_KEY(KEY_HOME,      GPIO_PORT98,    "SW6"),
 };
 
 static struct gpio_keys_platform_data gpio_key_info = {
@@ -901,8 +902,8 @@ static struct platform_device *eva_devices[] __initdata = {
         &camera_device,
         &ceu0_device,
         &fsi_device,
-        &fsi_hdmi_device,
         &fsi_wm8978_device,
+        &fsi_hdmi_device,
 };
 
 static void __init eva_clock_init(void)
diff --git a/arch/arm/mach-shmobile/board-mackerel.c b/arch/arm/mach-shmobile/board-mackerel.c
index 7ea2b31e3199..c129542f6aed 100644
--- a/arch/arm/mach-shmobile/board-mackerel.c
+++ b/arch/arm/mach-shmobile/board-mackerel.c
@@ -695,6 +695,7 @@ static struct platform_device usbhs0_device = {
  *  - J30 "open"
  *  - modify usbhs1_get_id() USBHS_HOST -> USBHS_GADGET
  *  - add .get_vbus = usbhs_get_vbus in usbhs1_private
+ *  - check usbhs0_device(pio)/usbhs1_device(irq) order in mackerel_devices.
  */
 #define IRQ8 evt2irq(0x0300)
 #define USB_PHY_MODE            (1 << 4)
@@ -1325,8 +1326,8 @@ static struct platform_device *mackerel_devices[] __initdata = {
         &nor_flash_device,
         &smc911x_device,
         &lcdc_device,
-        &usbhs1_device,
         &usbhs0_device,
+        &usbhs1_device,
         &leds_device,
         &fsi_device,
         &fsi_ak4643_device,
diff --git a/arch/arm/mach-shmobile/board-marzen.c b/arch/arm/mach-shmobile/board-marzen.c
index 3a528cf4366c..fcf5a47f4772 100644
--- a/arch/arm/mach-shmobile/board-marzen.c
+++ b/arch/arm/mach-shmobile/board-marzen.c
@@ -67,7 +67,7 @@ static struct smsc911x_platform_config smsc911x_platdata = {
 
 static struct platform_device eth_device = {
         .name           = "smsc911x",
-        .id             = 0,
+        .id             = -1,
         .dev  = {
                 .platform_data = &smsc911x_platdata,
         },
diff --git a/arch/arm/mach-shmobile/intc-sh73a0.c b/arch/arm/mach-shmobile/intc-sh73a0.c
index ee447404c857..588555a67d9c 100644
--- a/arch/arm/mach-shmobile/intc-sh73a0.c
+++ b/arch/arm/mach-shmobile/intc-sh73a0.c
@@ -259,9 +259,9 @@ static int sh73a0_set_wake(struct irq_data *data, unsigned int on)
         return 0; /* always allow wakeup */
 }
 
-#define RELOC_BASE 0x1000
+#define RELOC_BASE 0x1200
 
-/* INTCA IRQ pins at INTCS + 0x1000 to make space for GIC+INTC handling */
+/* INTCA IRQ pins at INTCS + RELOC_BASE to make space for GIC+INTC handling */
 #define INTCS_VECT_RELOC(n, vect) INTCS_VECT((n), (vect) + RELOC_BASE)
 
 INTC_IRQ_PINS_32(intca_irq_pins, 0xe6900000,
diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
index 119bc52ab93e..4e07eec1270d 100644
--- a/arch/arm/mm/context.c
+++ b/arch/arm/mm/context.c
@@ -63,10 +63,11 @@ static int contextidr_notifier(struct notifier_block *unused, unsigned long cmd,
         pid = task_pid_nr(thread->task) << ASID_BITS;
         asm volatile(
         "       mrc     p15, 0, %0, c13, c0, 1\n"
-        "       bfi     %1, %0, #0, %2\n"
-        "       mcr     p15, 0, %1, c13, c0, 1\n"
+        "       and     %0, %0, %2\n"
+        "       orr     %0, %0, %1\n"
+        "       mcr     p15, 0, %0, c13, c0, 1\n"
         : "=r" (contextidr), "+r" (pid)
-        : "I" (ASID_BITS));
+        : "I" (~ASID_MASK));
         isb();
 
         return NOTIFY_OK;
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 4e7d1182e8a3..e59c4ab71bcb 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -267,17 +267,19 @@ static void __dma_free_remap(void *cpu_addr, size_t size)
         vunmap(cpu_addr);
 }
 
+#define DEFAULT_DMA_COHERENT_POOL_SIZE  SZ_256K
+
 struct dma_pool {
         size_t size;
         spinlock_t lock;
         unsigned long *bitmap;
         unsigned long nr_pages;
         void *vaddr;
-        struct page *page;
+        struct page **pages;
 };
 
 static struct dma_pool atomic_pool = {
-        .size = SZ_256K,
+        .size = DEFAULT_DMA_COHERENT_POOL_SIZE,
 };
 
 static int __init early_coherent_pool(char *p)
@@ -287,6 +289,21 @@ static int __init early_coherent_pool(char *p)
 }
 early_param("coherent_pool", early_coherent_pool);
 
+void __init init_dma_coherent_pool_size(unsigned long size)
+{
+        /*
+         * Catch any attempt to set the pool size too late.
+         */
+        BUG_ON(atomic_pool.vaddr);
+
+        /*
+         * Set architecture specific coherent pool size only if
+         * it has not been changed by kernel command line parameter.
+         */
+        if (atomic_pool.size == DEFAULT_DMA_COHERENT_POOL_SIZE)
+                atomic_pool.size = size;
+}
+
 /*
  * Initialise the coherent pool for atomic allocations.
  */
@@ -297,6 +314,7 @@ static int __init atomic_pool_init(void)
         unsigned long nr_pages = pool->size >> PAGE_SHIFT;
         unsigned long *bitmap;
         struct page *page;
+        struct page **pages;
         void *ptr;
         int bitmap_size = BITS_TO_LONGS(nr_pages) * sizeof(long);
 
@@ -304,21 +322,31 @@ static int __init atomic_pool_init(void)
         if (!bitmap)
                 goto no_bitmap;
 
+        pages = kzalloc(nr_pages * sizeof(struct page *), GFP_KERNEL);
+        if (!pages)
+                goto no_pages;
+
         if (IS_ENABLED(CONFIG_CMA))
                 ptr = __alloc_from_contiguous(NULL, pool->size, prot, &page);
         else
                 ptr = __alloc_remap_buffer(NULL, pool->size, GFP_KERNEL, prot,
                                            &page, NULL);
         if (ptr) {
+                int i;
+
+                for (i = 0; i < nr_pages; i++)
+                        pages[i] = page + i;
+
                 spin_lock_init(&pool->lock);
                 pool->vaddr = ptr;
-                pool->page = page;
+                pool->pages = pages;
                 pool->bitmap = bitmap;
                 pool->nr_pages = nr_pages;
                 pr_info("DMA: preallocated %u KiB pool for atomic coherent allocations\n",
                        (unsigned)pool->size / 1024);
                 return 0;
         }
+no_pages:
         kfree(bitmap);
 no_bitmap:
         pr_err("DMA: failed to allocate %u KiB pool for atomic coherent allocation\n",
@@ -443,27 +471,45 @@ static void *__alloc_from_pool(size_t size, struct page **ret_page)
         if (pageno < pool->nr_pages) {
                 bitmap_set(pool->bitmap, pageno, count);
                 ptr = pool->vaddr + PAGE_SIZE * pageno;
-                *ret_page = pool->page + pageno;
+                *ret_page = pool->pages[pageno];
+        } else {
+                pr_err_once("ERROR: %u KiB atomic DMA coherent pool is too small!\n"
+                            "Please increase it with coherent_pool= kernel parameter!\n",
+                            (unsigned)pool->size / 1024);
         }
         spin_unlock_irqrestore(&pool->lock, flags);
 
         return ptr;
 }
 
+static bool __in_atomic_pool(void *start, size_t size)
+{
+        struct dma_pool *pool = &atomic_pool;
+        void *end = start + size;
+        void *pool_start = pool->vaddr;
+        void *pool_end = pool->vaddr + pool->size;
+
+        if (start < pool_start || start >= pool_end)
+                return false;
+
+        if (end <= pool_end)
+                return true;
+
+        WARN(1, "Wrong coherent size(%p-%p) from atomic pool(%p-%p)\n",
+             start, end - 1, pool_start, pool_end - 1);
+
+        return false;
+}
+
 static int __free_from_pool(void *start, size_t size)
 {
         struct dma_pool *pool = &atomic_pool;
         unsigned long pageno, count;
         unsigned long flags;
 
-        if (start < pool->vaddr || start > pool->vaddr + pool->size)
+        if (!__in_atomic_pool(start, size))
                 return 0;
 
-        if (start + size > pool->vaddr + pool->size) {
-                WARN(1, "freeing wrong coherent size from pool\n");
-                return 0;
-        }
-
         pageno = (start - pool->vaddr) >> PAGE_SHIFT;
         count = size >> PAGE_SHIFT;
 
@@ -1090,10 +1136,22 @@ static int __iommu_remove_mapping(struct device *dev, dma_addr_t iova, size_t si
         return 0;
 }
 
+static struct page **__atomic_get_pages(void *addr)
+{
+        struct dma_pool *pool = &atomic_pool;
+        struct page **pages = pool->pages;
+        int offs = (addr - pool->vaddr) >> PAGE_SHIFT;
+
+        return pages + offs;
+}
+
 static struct page **__iommu_get_pages(void *cpu_addr, struct dma_attrs *attrs)
 {
         struct vm_struct *area;
 
+        if (__in_atomic_pool(cpu_addr, PAGE_SIZE))
+                return __atomic_get_pages(cpu_addr);
+
         if (dma_get_attr(DMA_ATTR_NO_KERNEL_MAPPING, attrs))
                 return cpu_addr;
 
@@ -1103,6 +1161,34 @@ static struct page **__iommu_get_pages(void *cpu_addr, struct dma_attrs *attrs)
         return NULL;
 }
 
+static void *__iommu_alloc_atomic(struct device *dev, size_t size,
+                                  dma_addr_t *handle)
+{
+        struct page *page;
+        void *addr;
+
+        addr = __alloc_from_pool(size, &page);
+        if (!addr)
+                return NULL;
+
+        *handle = __iommu_create_mapping(dev, &page, size);
+        if (*handle == DMA_ERROR_CODE)
+                goto err_mapping;
+
+        return addr;
+
+err_mapping:
+        __free_from_pool(addr, size);
+        return NULL;
+}
+
+static void __iommu_free_atomic(struct device *dev, struct page **pages,
+                                dma_addr_t handle, size_t size)
+{
+        __iommu_remove_mapping(dev, handle, size);
+        __free_from_pool(page_address(pages[0]), size);
+}
+
 static void *arm_iommu_alloc_attrs(struct device *dev, size_t size,
             dma_addr_t *handle, gfp_t gfp, struct dma_attrs *attrs)
 {
@@ -1113,6 +1199,9 @@ static void *arm_iommu_alloc_attrs(struct device *dev, size_t size,
         *handle = DMA_ERROR_CODE;
         size = PAGE_ALIGN(size);
 
+        if (gfp & GFP_ATOMIC)
+                return __iommu_alloc_atomic(dev, size, handle);
+
         pages = __iommu_alloc_buffer(dev, size, gfp);
         if (!pages)
                 return NULL;
@@ -1179,6 +1268,11 @@ void arm_iommu_free_attrs(struct device *dev, size_t size, void *cpu_addr,
                 return;
         }
 
+        if (__in_atomic_pool(cpu_addr, size)) {
+                __iommu_free_atomic(dev, pages, handle, size);
+                return;
+        }
+
         if (!dma_get_attr(DMA_ATTR_NO_KERNEL_MAPPING, attrs)) {
                 unmap_kernel_range((unsigned long)cpu_addr, size);
                 vunmap(cpu_addr);
diff --git a/arch/arm/mm/mm.h b/arch/arm/mm/mm.h
index 6776160618ef..a8ee92da3544 100644
--- a/arch/arm/mm/mm.h
+++ b/arch/arm/mm/mm.h
@@ -55,6 +55,9 @@ extern void __flush_dcache_page(struct address_space *mapping, struct page *page
 /* permanent static mappings from iotable_init() */
 #define VM_ARM_STATIC_MAPPING   0x40000000
 
+/* empty mapping */
+#define VM_ARM_EMPTY_MAPPING    0x20000000
+
 /* mapping type (attributes) for permanent static mappings */
 #define VM_ARM_MTYPE(mt)                ((mt) << 20)
 #define VM_ARM_MTYPE_MASK       (0x1f << 20)
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 4c2d0451e84a..c2fa21d0103e 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -807,7 +807,7 @@ static void __init pmd_empty_section_gap(unsigned long addr)
         vm = early_alloc_aligned(sizeof(*vm), __alignof__(*vm));
         vm->addr = (void *)addr;
         vm->size = SECTION_SIZE;
-        vm->flags = VM_IOREMAP | VM_ARM_STATIC_MAPPING;
+        vm->flags = VM_IOREMAP | VM_ARM_EMPTY_MAPPING;
         vm->caller = pmd_empty_section_gap;
         vm_area_add_early(vm);
 }
@@ -820,7 +820,7 @@ static void __init fill_pmd_gaps(void)
 
         /* we're still single threaded hence no lock needed here */
         for (vm = vmlist; vm; vm = vm->next) {
-                if (!(vm->flags & VM_ARM_STATIC_MAPPING))
+                if (!(vm->flags & (VM_ARM_STATIC_MAPPING | VM_ARM_EMPTY_MAPPING)))
                         continue;
                 addr = (unsigned long)vm->addr;
                 if (addr < next)
@@ -961,8 +961,8 @@ void __init sanity_check_meminfo(void)
                  * Check whether this memory bank would partially overlap
                  * the vmalloc area.
                  */
-                if (__va(bank->start + bank->size) > vmalloc_min ||
-                    __va(bank->start + bank->size) < __va(bank->start)) {
+                if (__va(bank->start + bank->size - 1) >= vmalloc_min ||
+                    __va(bank->start + bank->size - 1) <= __va(bank->start)) {
                         unsigned long newsize = vmalloc_min - __va(bank->start);
                         printk(KERN_NOTICE "Truncating RAM at %.8llx-%.8llx "
                                "to -%.8llx (vmalloc region overlap).\n",
diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
index 766181cb5c95..024f3b08db29 100644
--- a/arch/arm/plat-omap/sram.c
+++ b/arch/arm/plat-omap/sram.c
@@ -68,6 +68,7 @@
 
 static unsigned long omap_sram_start;
 static void __iomem *omap_sram_base;
+static unsigned long omap_sram_skip;
 static unsigned long omap_sram_size;
 static void __iomem *omap_sram_ceil;
 
@@ -106,6 +107,7 @@ static int is_sram_locked(void)
  */
 static void __init omap_detect_sram(void)
 {
+        omap_sram_skip = SRAM_BOOTLOADER_SZ;
         if (cpu_class_is_omap2()) {
                 if (is_sram_locked()) {
                         if (cpu_is_omap34xx()) {
@@ -113,6 +115,7 @@ static void __init omap_detect_sram(void)
                                 if ((omap_type() == OMAP2_DEVICE_TYPE_EMU) ||
                                     (omap_type() == OMAP2_DEVICE_TYPE_SEC)) {
                                         omap_sram_size = 0x7000; /* 28K */
+                                        omap_sram_skip += SZ_16K;
                                 } else {
                                         omap_sram_size = 0x8000; /* 32K */
                                 }
@@ -175,8 +178,10 @@ static void __init omap_map_sram(void)
                 return;
 
 #ifdef CONFIG_OMAP4_ERRATA_I688
+        if (cpu_is_omap44xx()) {
                 omap_sram_start += PAGE_SIZE;
                 omap_sram_size -= SZ_16K;
+        }
 #endif
         if (cpu_is_omap34xx()) {
                 /*
@@ -203,8 +208,8 @@ static void __init omap_map_sram(void)
          * Looks like we need to preserve some bootloader code at the
          * beginning of SRAM for jumping to flash for reboot to work...
          */
-        memset_io(omap_sram_base + SRAM_BOOTLOADER_SZ, 0,
-                  omap_sram_size - SRAM_BOOTLOADER_SZ);
+        memset_io(omap_sram_base + omap_sram_skip, 0,
+                  omap_sram_size - omap_sram_skip);
 }
 
 /*
@@ -218,7 +223,7 @@ void *omap_sram_push_address(unsigned long size)
 {
         unsigned long available, new_ceil = (unsigned long)omap_sram_ceil;
 
-        available = omap_sram_ceil - (omap_sram_base + SRAM_BOOTLOADER_SZ);
+        available = omap_sram_ceil - (omap_sram_base + omap_sram_skip);
 
         if (size > available) {
                 pr_err("Not enough space in SRAM\n");