4 files changed, 17 insertions, 12 deletions

diff --git a/arch/sh/include/asm/addrspace.h b/arch/sh/include/asm/addrspace.h
index 2702d81bfc0d..36736c7e93db 100644
--- a/arch/sh/include/asm/addrspace.h
+++ b/arch/sh/include/asm/addrspace.h
@@ -49,5 +49,16 @@
 /* Check if an address can be reached in 29 bits */
 #define IS_29BIT(a)     (((unsigned long)(a)) < 0x20000000)
 
+#ifdef CONFIG_SH_STORE_QUEUES
+/*
+ * This is a special case for the SH-4 store queues, as pages for this
+ * space still need to be faulted in before it's possible to flush the
+ * store queue cache for writeout to the remapped region.
+ */
+#define P3_ADDR_MAX             (P4SEG_STORE_QUE + 0x04000000)
+#else
+#define P3_ADDR_MAX             P4SEG
+#endif
+
 #endif /* __KERNEL__ */
 #endif /* __ASM_SH_ADDRSPACE_H */
diff --git a/arch/sh/include/asm/io.h b/arch/sh/include/asm/io.h
index 65eaae34e753..61f6dae40534 100644
--- a/arch/sh/include/asm/io.h
+++ b/arch/sh/include/asm/io.h
@@ -260,6 +260,10 @@ __ioremap_mode(unsigned long offset, unsigned long size, unsigned long flags)
 
                 return (void __iomem *)P2SEGADDR(offset);
         }
+
+        /* P4 above the store queues are always mapped. */
+        if (unlikely(offset >= P3_ADDR_MAX))
+                return (void __iomem *)P4SEGADDR(offset);
 #endif
 
         return __ioremap(offset, size, flags);
diff --git a/arch/sh/mm/fault_32.c b/arch/sh/mm/fault_32.c
index 898d477e47c1..e58726892b5f 100644
--- a/arch/sh/mm/fault_32.c
+++ b/arch/sh/mm/fault_32.c
@@ -265,17 +265,6 @@ static inline int notify_page_fault(struct pt_regs *regs, int trap)
         return ret;
 }
 
-#ifdef CONFIG_SH_STORE_QUEUES
-/*
- * This is a special case for the SH-4 store queues, as pages for this
- * space still need to be faulted in before it's possible to flush the
- * store queue cache for writeout to the remapped region.
- */
-#define P3_ADDR_MAX             (P4SEG_STORE_QUE + 0x04000000)
-#else
-#define P3_ADDR_MAX             P4SEG
-#endif
-
 /*
  * Called with interrupts disabled.
  */
diff --git a/arch/sh/mm/ioremap_32.c b/arch/sh/mm/ioremap_32.c
index 882a32ebc6b7..32946fba123e 100644
--- a/arch/sh/mm/ioremap_32.c
+++ b/arch/sh/mm/ioremap_32.c
@@ -116,9 +116,10 @@ EXPORT_SYMBOL(__ioremap);
 void __iounmap(void __iomem *addr)
 {
         unsigned long vaddr = (unsigned long __force)addr;
+        unsigned long seg = PXSEG(vaddr);
         struct vm_struct *p;
 
-        if (PXSEG(vaddr) < P3SEG || is_pci_memaddr(vaddr))
+        if (seg < P3SEG || seg >= P3_ADDR_MAX || is_pci_memaddr(vaddr))
                 return;
 
 #ifdef CONFIG_32BIT