Patch by Anders Larsen, 09 Jan 2004:

ARM memory layout fixes: the abort-stack is now set up in the
correct RAM area, and the BSS is zeroed out as it should be.

Furthermore, the magic variables 'armboot_end' and 'armboot_end_data'
of the linker scripts are replaced by '__bss_start' and '_end',
resp., which is a further step to eliminate unnecessary differences
between the implementation of the CPU architectures.
diff --git a/cpu/arm720t/cpu.c b/cpu/arm720t/cpu.c
index b6fcef9..5637eb6 100644
--- a/cpu/arm720t/cpu.c
+++ b/cpu/arm720t/cpu.c
@@ -87,7 +87,7 @@
 #ifdef CONFIG_USE_IRQ
 	DECLARE_GLOBAL_DATA_PTR;
 
-	IRQ_STACK_START = _armboot_start - CFG_MALLOC_LEN - CFG_GBL_DATA_LEN - 4;
+	IRQ_STACK_START = _armboot_start - CFG_MALLOC_LEN - CFG_GBL_DATA_SIZE - 4;
 	FIQ_STACK_START = IRQ_STACK_START - CONFIG_STACKSIZE_IRQ;
 #endif
 	return 0;
diff --git a/cpu/arm720t/start.S b/cpu/arm720t/start.S
index 8ddb0c9..7fe36c6 100644
--- a/cpu/arm720t/start.S
+++ b/cpu/arm720t/start.S
@@ -63,7 +63,7 @@
  *
  * Startup Code (reset vector)
  *
- * do important init only if we don't start from memory!
+ * do important init only if we don't start from RAM!
  * relocate armboot to ram
  * setup stack
  * jump to second stage
@@ -79,16 +79,15 @@
 	.word _start
 
 /*
- * Note: _armboot_end_data and _armboot_end are defined
- * by the (board-dependent) linker script.
- * _armboot_end_data is the first usable FLASH address after armboot
+ * These are defined in the board-specific linker script.
  */
-.globl _armboot_end_data
-_armboot_end_data:
-	.word armboot_end_data
-.globl _armboot_end
-_armboot_end:
-	.word armboot_end
+.globl _bss_start
+_bss_start:
+	.word __bss_start
+
+.globl _bss_end
+_bss_end:
+	.word _end
 
 #ifdef CONFIG_USE_IRQ
 /* IRQ stack memory (calculated at run-time) */
@@ -131,7 +130,7 @@
 	beq     stack_setup
 
 	ldr	r2, _armboot_start
-	ldr	r3, _armboot_end
+	ldr	r3, _bss_start
 	sub	r2, r3, r2		/* r2 <- size of armboot            */
 	add	r2, r0, r2		/* r2 <- source end address         */
 
@@ -151,6 +150,17 @@
 #endif
 	sub	sp, r0, #12		/* leave 3 words for abort-stack    */
 
+clear_bss:
+	ldr	r0, _bss_start		/* find start of bss segment        */
+	add	r0, r0, #4		/* start at first byte of bss       */
+	ldr	r1, _bss_end		/* stop here                        */
+	mov 	r2, #0x00000000		/* clear                            */
+
+clbss_l:str	r2, [r0]		/* clear loop...                    */
+	add	r0, r0, #4
+	cmp	r0, r1
+	bne	clbss_l
+
 	ldr	pc, _start_armboot
 
 _start_armboot:	.word start_armboot
@@ -225,7 +235,7 @@
 
 	/*
 	 * before relocating, we have to setup RAM timing
-	 * because memory timing is board-dependend, you will
+	 * because memory timing is board-dependent, you will
 	 * find a memsetup.S in your board directory.
 	 */
 	mov	ip, lr
@@ -281,9 +291,9 @@
 	stmia	sp, {r0 - r12}			@ Calling r0-r12
 	add     r8, sp, #S_PC
 
-	ldr	r2, _armboot_end
-	add	r2, r2, #CONFIG_STACKSIZE
-	sub	r2, r2, #8
+	ldr	r2, _armboot_start
+	sub	r2, r2, #(CONFIG_STACKSIZE+CFG_MALLOC_LEN)
+	sub	r2, r2, #(CFG_GBL_DATA_SIZE+8)  @ set base 2 words into abort stack
 	ldmia	r2, {r2 - r4}                   @ get pc, cpsr, old_r0
 	add	r0, sp, #S_FRAME_SIZE		@ restore sp_SVC
 
@@ -314,9 +324,9 @@
 	.endm
 
 	.macro get_bad_stack
-	ldr	r13, _armboot_end		@ setup our mode stack
-	add	r13, r13, #CONFIG_STACKSIZE	@ resides at top of normal stack
-	sub	r13, r13, #8
+	ldr	r13, _armboot_start		@ setup our mode stack
+	sub	r13, r13, #(CONFIG_STACKSIZE+CFG_MALLOC_LEN)
+	sub	r13, r13, #(CFG_GBL_DATA_SIZE+8) @ reserved a couple spots in abort stack
 
 	str	lr, [r13]			@ save caller lr / spsr
 	mrs	lr, spsr
diff --git a/cpu/arm920t/cpu.c b/cpu/arm920t/cpu.c
index e638c1f..2a2b578 100644
--- a/cpu/arm920t/cpu.c
+++ b/cpu/arm920t/cpu.c
@@ -92,7 +92,7 @@
 #ifdef CONFIG_USE_IRQ
 	DECLARE_GLOBAL_DATA_PTR;
 
-	IRQ_STACK_START = _armboot_start - CFG_MALLOC_LEN - CFG_GBL_DATA_LEN - 4;
+	IRQ_STACK_START = _armboot_start - CFG_MALLOC_LEN - CFG_GBL_DATA_SIZE - 4;
 	FIQ_STACK_START = IRQ_STACK_START - CONFIG_STACKSIZE_IRQ;
 #endif
 	return 0;
diff --git a/cpu/arm920t/start.S b/cpu/arm920t/start.S
index d640942..49264da 100644
--- a/cpu/arm920t/start.S
+++ b/cpu/arm920t/start.S
@@ -80,16 +80,15 @@
 	.word _start
 
 /*
- * Note: _armboot_end_data and _armboot_end are defined
- * by the (board-dependent) linker script.
- * _armboot_end_data is the first usable FLASH address after armboot
+ * These are defined in the board-specific linker script.
  */
-.globl _armboot_end_data
-_armboot_end_data:
-	.word armboot_end_data
-.globl _armboot_end
-_armboot_end:
-	.word armboot_end
+.globl _bss_start
+_bss_start:
+	.word __bss_start
+
+.globl _bss_end
+_bss_end:
+	.word _end
 
 #ifdef CONFIG_USE_IRQ
 /* IRQ stack memory (calculated at run-time) */
@@ -170,7 +169,7 @@
 	beq     stack_setup
 
 	ldr	r2, _armboot_start
-	ldr	r3, _armboot_end
+	ldr	r3, _bss_start
 	sub	r2, r3, r2		/* r2 <- size of armboot            */
 	add	r2, r0, r2		/* r2 <- source end address         */
 
@@ -190,6 +189,17 @@
 #endif
 	sub	sp, r0, #12		/* leave 3 words for abort-stack    */
 
+clear_bss:
+	ldr	r0, _bss_start		/* find start of bss segment        */
+	add	r0, r0, #4		/* start at first byte of bss       */
+	ldr	r1, _bss_end		/* stop here                        */
+	mov 	r2, #0x00000000		/* clear                            */
+
+clbss_l:str	r2, [r0]		/* clear loop...                    */
+	add	r0, r0, #4
+	cmp	r0, r1
+	bne	clbss_l
+
 #if 0
 	/* try doing this stuff after the relocation */
 	ldr     r0, =pWTCON
@@ -303,9 +313,9 @@
 	.macro	bad_save_user_regs
 	sub	sp, sp, #S_FRAME_SIZE
 	stmia	sp, {r0 - r12}			@ Calling r0-r12
-	ldr	r2, _armboot_end
-	add	r2, r2, #CONFIG_STACKSIZE
-	sub	r2, r2, #8
+	ldr	r2, _armboot_start
+	sub	r2, r2, #(CONFIG_STACKSIZE+CFG_MALLOC_LEN)
+	sub	r2, r2, #(CFG_GBL_DATA_SIZE+8)  @ set base 2 words into abort stack
 	ldmia	r2, {r2 - r3}			@ get pc, cpsr
 	add	r0, sp, #S_FRAME_SIZE		@ restore sp_SVC
 
@@ -336,9 +346,9 @@
 	.endm
 
 	.macro get_bad_stack
-	ldr	r13, _armboot_end		@ setup our mode stack
-	add	r13, r13, #CONFIG_STACKSIZE	@ resides at top of normal stack
-	sub	r13, r13, #8
+	ldr	r13, _armboot_start		@ setup our mode stack
+	sub	r13, r13, #(CONFIG_STACKSIZE+CFG_MALLOC_LEN)
+	sub	r13, r13, #(CFG_GBL_DATA_SIZE+8) @ reserved a couple spots in abort stack
 
 	str	lr, [r13]			@ save caller lr / spsr
 	mrs	lr, spsr
diff --git a/cpu/arm925t/cpu.c b/cpu/arm925t/cpu.c
index 6bac53d..b760ec9 100644
--- a/cpu/arm925t/cpu.c
+++ b/cpu/arm925t/cpu.c
@@ -93,7 +93,7 @@
 #ifdef CONFIG_USE_IRQ
 	DECLARE_GLOBAL_DATA_PTR;
 
-	IRQ_STACK_START = _armboot_start - CFG_MALLOC_LEN - CFG_GBL_DATA_LEN - 4;
+	IRQ_STACK_START = _armboot_start - CFG_MALLOC_LEN - CFG_GBL_DATA_SIZE - 4;
 	FIQ_STACK_START = IRQ_STACK_START - CONFIG_STACKSIZE_IRQ;
 #endif
 	return 0;
diff --git a/cpu/arm925t/start.S b/cpu/arm925t/start.S
index 0a3042d..da84de1 100644
--- a/cpu/arm925t/start.S
+++ b/cpu/arm925t/start.S
@@ -89,16 +89,15 @@
 	.word _start
 
 /*
- * Note: _armboot_end_data and _armboot_end are defined
- * by the (board-dependent) linker script.
- * _armboot_end_data is the first usable FLASH address after armboot
+ * These are defined in the board-specific linker script.
  */
-.globl _armboot_end_data
-_armboot_end_data:
-	.word armboot_end_data
-.globl _armboot_end
-_armboot_end:
-	.word armboot_end
+.globl _bss_start
+_bss_start:
+	.word __bss_start
+
+.globl _bss_end
+_bss_end:
+	.word _end
 
 #ifdef CONFIG_USE_IRQ
 /* IRQ stack memory (calculated at run-time) */
@@ -176,7 +175,7 @@
 	beq     stack_setup
 
 	ldr	r2, _armboot_start
-	ldr	r3, _armboot_end
+	ldr	r3, _bss_start
 	sub	r2, r3, r2		/* r2 <- size of armboot            */
 	add	r2, r0, r2		/* r2 <- source end address         */
 
@@ -196,6 +195,17 @@
 #endif
 	sub	sp, r0, #12		/* leave 3 words for abort-stack    */
 
+clear_bss:
+	ldr	r0, _bss_start		/* find start of bss segment        */
+	add	r0, r0, #4		/* start at first byte of bss       */
+	ldr	r1, _bss_end		/* stop here                        */
+	mov 	r2, #0x00000000		/* clear                            */
+
+clbss_l:str	r2, [r0]		/* clear loop...                    */
+	add	r0, r0, #4
+	cmp	r0, r1
+	bne	clbss_l
+
 	ldr	pc, _start_armboot
 
 _start_armboot:	.word start_armboot
@@ -283,9 +293,9 @@
 	sub	sp, sp, #S_FRAME_SIZE           @ carve out a frame on current user stack
 	stmia	sp, {r0 - r12}			@ Save user registers (now in svc mode) r0-r12
 
-	ldr	r2, _armboot_end                @ find top of stack
-	add	r2, r2, #CONFIG_STACKSIZE       @ find base of normal stack
-	sub	r2, r2, #8                      @ set base 2 words into abort stack
+	ldr	r2, _armboot_start
+	sub	r2, r2, #(CONFIG_STACKSIZE+CFG_MALLOC_LEN)
+	sub	r2, r2, #(CFG_GBL_DATA_SIZE+8)  @ set base 2 words into abort stack
 	ldmia	r2, {r2 - r3}                   @ get values for "aborted" pc and cpsr (into parm regs)
 	add	r0, sp, #S_FRAME_SIZE		@ grab pointer to old stack
 
@@ -316,9 +326,9 @@
 	.endm
 
 	.macro get_bad_stack
-	ldr	r13, _armboot_end		@ get bottom of stack (into sp by by user stack pointer).
-	add	r13, r13, #CONFIG_STACKSIZE	@ head to reserved words at the top of the stack
-	sub	r13, r13, #8                    @ reserved a couple spots in abort stack
+	ldr	r13, _armboot_start		@ setup our mode stack
+	sub	r13, r13, #(CONFIG_STACKSIZE+CFG_MALLOC_LEN)
+	sub	r13, r13, #(CFG_GBL_DATA_SIZE+8) @ reserved a couple spots in abort stack
 
 	str	lr, [r13]			@ save caller lr in position 0 of saved stack
 	mrs	lr, spsr                        @ get the spsr
diff --git a/cpu/arm926ejs/cpu.c b/cpu/arm926ejs/cpu.c
index 748a21a..6c153e5 100644
--- a/cpu/arm926ejs/cpu.c
+++ b/cpu/arm926ejs/cpu.c
@@ -93,7 +93,7 @@
 #ifdef CONFIG_USE_IRQ
 	DECLARE_GLOBAL_DATA_PTR;
 
-	IRQ_STACK_START = _armboot_start - CFG_MALLOC_LEN - CFG_GBL_DATA_LEN - 4;
+	IRQ_STACK_START = _armboot_start - CFG_MALLOC_LEN - CFG_GBL_DATA_SIZE - 4;
 	FIQ_STACK_START = IRQ_STACK_START - CONFIG_STACKSIZE_IRQ;
 #endif
 	return 0;
diff --git a/cpu/arm926ejs/start.S b/cpu/arm926ejs/start.S
index 39d7409..0c28927 100644
--- a/cpu/arm926ejs/start.S
+++ b/cpu/arm926ejs/start.S
@@ -97,16 +97,15 @@
 	.word _start
 
 /*
- * Note: _armboot_end_data and _armboot_end are defined
- * by the (board-dependent) linker script.
- * _armboot_end_data is the first usable FLASH address after armboot
+ * These are defined in the board-specific linker script.
  */
-.globl _armboot_end_data
-_armboot_end_data:
-	.word armboot_end_data
-.globl _armboot_end
-_armboot_end:
-	.word armboot_end
+.globl _bss_start
+_bss_start:
+	.word __bss_start
+
+.globl _bss_end
+_bss_end:
+	.word _end
 
 #ifdef CONFIG_USE_IRQ
 /* IRQ stack memory (calculated at run-time) */
@@ -170,7 +169,7 @@
 	beq     stack_setup
 
 	ldr	r2, _armboot_start
-	ldr	r3, _armboot_end
+	ldr	r3, _bss_start
 	sub	r2, r3, r2		/* r2 <- size of armboot            */
 	add	r2, r0, r2		/* r2 <- source end address         */
 
@@ -190,6 +189,17 @@
 #endif
 	sub	sp, r0, #12		/* leave 3 words for abort-stack    */
 
+clear_bss:
+	ldr	r0, _bss_start		/* find start of bss segment        */
+	add	r0, r0, #4		/* start at first byte of bss       */
+	ldr	r1, _bss_end		/* stop here                        */
+	mov 	r2, #0x00000000		/* clear                            */
+
+clbss_l:str	r2, [r0]		/* clear loop...                    */
+	add	r0, r0, #4
+	cmp	r0, r1
+	bne	clbss_l
+
 	ldr	pc, _start_armboot
 
 _start_armboot:
@@ -278,9 +288,10 @@
 	@ carve out a frame on current user stack
 	sub	sp, sp, #S_FRAME_SIZE
 	stmia	sp, {r0 - r12}	@ Save user registers (now in svc mode) r0-r12
-	ldr	r2, _armboot_end	@ find top of stack
-	add	r2, r2, #CONFIG_STACKSIZE	@ find base of normal stack
-	sub	r2, r2, #8	@ set base 2 words into abort stack
+
+	ldr	r2, _armboot_start
+	sub	r2, r2, #(CONFIG_STACKSIZE+CFG_MALLOC_LEN)
+	sub	r2, r2, #(CFG_GBL_DATA_SIZE+8)  @ set base 2 words into abort stack
 	@ get values for "aborted" pc and cpsr (into parm regs)
 	ldmia	r2, {r2 - r3}
 	add	r0, sp, #S_FRAME_SIZE		@ grab pointer to old stack
@@ -312,11 +323,9 @@
 	.endm
 
 	.macro get_bad_stack
-	@ get bottom of stack (into sp by by user stack pointer).
-	ldr	r13, _armboot_end
-	@ head to reserved words at the top of the stack
-	add	r13, r13, #CONFIG_STACKSIZE
-	sub	r13, r13, #8	@ reserved a couple spots in abort stack
+	ldr	r13, _armboot_start		@ setup our mode stack
+	sub	r13, r13, #(CONFIG_STACKSIZE+CFG_MALLOC_LEN)
+	sub	r13, r13, #(CFG_GBL_DATA_SIZE+8) @ reserved a couple spots in abort stack
 
 	str	lr, [r13]	@ save caller lr in position 0 of saved stack
 	mrs	lr, spsr	@ get the spsr
diff --git a/cpu/at91rm9200/cpu.c b/cpu/at91rm9200/cpu.c
index b0cfcef..0250729 100644
--- a/cpu/at91rm9200/cpu.c
+++ b/cpu/at91rm9200/cpu.c
@@ -87,7 +87,7 @@
 #ifdef CONFIG_USE_IRQ
 	DECLARE_GLOBAL_DATA_PTR;
 
-	IRQ_STACK_START = _armboot_start - CFG_MALLOC_LEN - CFG_GBL_DATA_LEN - 4;
+	IRQ_STACK_START = _armboot_start - CFG_MALLOC_LEN - CFG_GBL_DATA_SIZE - 4;
 	FIQ_STACK_START = IRQ_STACK_START - CONFIG_STACKSIZE_IRQ;
 #endif
 	return 0;
diff --git a/cpu/at91rm9200/start.S b/cpu/at91rm9200/start.S
index a93d045..b9b889a 100644
--- a/cpu/at91rm9200/start.S
+++ b/cpu/at91rm9200/start.S
@@ -79,19 +79,15 @@
 	.word _start
 
 /*
- * Note: _armboot_end_data and _armboot_end are defined
- * by the (board-dependent) linker script.
- * _armboot_end_data is the first usable FLASH address after armboot
+ * These are defined in the board-specific linker script.
  */
-.globl _armboot_end_data
-_armboot_end_data:
-	.word armboot_end_data
-/*
- * Note: armboot_end is defined by the (board-dependent) linker script
- */
-.globl _armboot_end
-_armboot_end:
-	.word armboot_end
+.globl _bss_start
+_bss_start:
+	.word __bss_start
+
+.globl _bss_end
+_bss_end:
+	.word _end
 
 #ifdef CONFIG_USE_IRQ
 /* IRQ stack memory (calculated at run-time) */
@@ -149,6 +145,17 @@
 #endif
 	sub	sp, r0, #12		/* leave 3 words for abort-stack    */
 
+clear_bss:
+	ldr	r0, _bss_start		/* find start of bss segment        */
+	add	r0, r0, #4		/* start at first byte of bss       */
+	ldr	r1, _bss_end		/* stop here                        */
+	mov 	r2, #0x00000000		/* clear                            */
+
+clbss_l:str	r2, [r0]		/* clear loop...                    */
+	add	r0, r0, #4
+	cmp	r0, r1
+	bne	clbss_l
+
 	ldr pc,_start_armboot
 
 _start_armboot: .word start_armboot
@@ -212,9 +219,9 @@
 	stmia	sp, {r0 - r12}			@ Calling r0-r12
 	add     r8, sp, #S_PC
 
-	ldr	r2, _armboot_end
-	add	r2, r2, #CONFIG_STACKSIZE
-	sub	r2, r2, #8
+	ldr	r2, _armboot_start
+	sub	r2, r2, #(CONFIG_STACKSIZE+CFG_MALLOC_LEN)
+	sub	r2, r2, #(CFG_GBL_DATA_SIZE+8)  @ set base 2 words into abort stack
 	ldmia	r2, {r2 - r4}                   @ get pc, cpsr, old_r0
 	add	r0, sp, #S_FRAME_SIZE		@ restore sp_SVC
 
@@ -245,9 +252,9 @@
 	.endm
 
 	.macro get_bad_stack
-	ldr	r13, _armboot_end		@ setup our mode stack
-	add	r13, r13, #CONFIG_STACKSIZE	@ resides at top of normal stack
-	sub	r13, r13, #8
+	ldr	r13, _armboot_start		@ setup our mode stack
+	sub	r13, r13, #(CONFIG_STACKSIZE+CFG_MALLOC_LEN)
+	sub	r13, r13, #(CFG_GBL_DATA_SIZE+8) @ reserved a couple spots in abort stack
 
 	str	lr, [r13]			@ save caller lr / spsr
 	mrs	lr, spsr
diff --git a/cpu/ixp/cpu.c b/cpu/ixp/cpu.c
index d12e8bd..d4fd823 100644
--- a/cpu/ixp/cpu.c
+++ b/cpu/ixp/cpu.c
@@ -37,22 +37,16 @@
 int cpu_init (void)
 {
 	/*
-	 * setup up stack if necessary
+	 * setup up stacks if necessary
 	 */
-/*
-
-  FIXME: the stack is _below_ the uboot code!!
-
 #ifdef CONFIG_USE_IRQ
-	IRQ_STACK_START = _armboot_end +
-			CONFIG_STACKSIZE + CONFIG_STACKSIZE_IRQ - 4;
-	FIQ_STACK_START = IRQ_STACK_START + CONFIG_STACKSIZE_FIQ;
-	_armboot_real_end = FIQ_STACK_START + 4;
-#else
-	_armboot_real_end = _armboot_end + CONFIG_STACKSIZE;
+	DECLARE_GLOBAL_DATA_PTR;
+
+	IRQ_STACK_START = _armboot_start - CFG_MALLOC_LEN - CFG_GBL_DATA_SIZE - 4;
+	FIQ_STACK_START = IRQ_STACK_START - CONFIG_STACKSIZE_IRQ;
 #endif
-*/
-   pci_init();
+
+	pci_init();
 	return 0;
 }
 
@@ -84,7 +78,7 @@
 {
 	extern void reset_cpu (ulong addr);
 
-	printf ("reseting ...\n");
+	printf ("resetting ...\n");
 
 	udelay (50000);				/* wait 50 ms */
 	disable_interrupts ();
diff --git a/cpu/ixp/start.S b/cpu/ixp/start.S
index d5fc9bf..09ecc73 100644
--- a/cpu/ixp/start.S
+++ b/cpu/ixp/start.S
@@ -101,42 +101,15 @@
 	.word _start
 
 /*
- * Note: _armboot_end_data and _armboot_end are defined
- * by the (board-dependent) linker script.
- * _armboot_end_data is the first usable FLASH address after armboot
- */
-.globl _armboot_end_data
-_armboot_end_data:
-	.word armboot_end_data
-.globl _armboot_end
-_armboot_end:
-	.word armboot_end
-
-/*
- * This is defined in the board specific linker script
+ * These are defined in the board-specific linker script.
  */
 .globl _bss_start
 _bss_start:
-	.word bss_start
+	.word __bss_start
 
 .globl _bss_end
 _bss_end:
-	.word bss_end
-
-/*
- * _armboot_real_end is the first usable RAM address behind armboot
- * and the various stacks
- */
-.globl _armboot_real_end
-_armboot_real_end:
-	.word 0x0badc0de
-
-/*
- * We relocate uboot to this address (end of RAM - 128 KiB)
- */
-.globl _uboot_reloc
-_uboot_reloc:
-	.word TEXT_BASE
+	.word _end
 
 #ifdef CONFIG_USE_IRQ
 /* IRQ stack memory (calculated at run-time) */
@@ -294,7 +267,7 @@
 	beq     stack_setup
 
 	ldr	r2, _armboot_start
-	ldr	r3, _armboot_end
+	ldr	r3, _bss_start
 	sub	r2, r3, r2		/* r2 <- size of armboot            */
 	add	r2, r0, r2		/* r2 <- source end address         */
 
@@ -305,16 +278,16 @@
 	ble	copy_loop
 
 	/* Set up the stack						    */
-
 stack_setup:
-
-	ldr	r0, _uboot_reloc	/* upper 128 KiB: relocated uboot   */
-	sub	r0, r0, #CFG_MALLOC_LEN /* malloc area			    */
-					/* FIXME: bdinfo should be here	    */
+	ldr	r0, _TEXT_BASE		/* upper 128 KiB: relocated uboot   */
+	sub	r0, r0, #CFG_MALLOC_LEN	/* malloc area                      */
+	sub	r0, r0, #CFG_GBL_DATA_SIZE /* bdinfo                        */
+#ifdef CONFIG_USE_IRQ
+	sub	r0, r0, #(CONFIG_STACKSIZE_IRQ+CONFIG_STACKSIZE_FIQ)
+#endif
 	sub	sp, r0, #12		/* leave 3 words for abort-stack    */
 
 clear_bss:
-
 	ldr	r0, _bss_start		/* find start of bss segment        */
 	add	r0, r0, #4		/* start at first byte of bss       */
 	ldr	r1, _bss_end		/* stop here                        */
@@ -325,7 +298,6 @@
 	cmp	r0, r1
 	bne	clbss_l
 
-
 	ldr	pc, _start_armboot
 
 _start_armboot: .word start_armboot
@@ -370,9 +342,9 @@
 	stmia	sp, {r0 - r12}			/* Calling r0-r12	    */
 	add	r8, sp, #S_PC
 
-	ldr	r2, _armboot_end
-	add	r2, r2, #CONFIG_STACKSIZE
-	sub	r2, r2, #8
+	ldr	r2, _armboot_start
+	sub	r2, r2, #(CONFIG_STACKSIZE+CFG_MALLOC_LEN)
+	sub	r2, r2, #(CFG_GBL_DATA_SIZE+8)  @ set base 2 words into abort stack
 	ldmia	r2, {r2 - r4}			/* get pc, cpsr, old_r0	    */
 	add	r0, sp, #S_FRAME_SIZE		/* restore sp_SVC	    */
 
@@ -407,9 +379,9 @@
 	.endm
 
 	.macro get_bad_stack
-	ldr	r13, _armboot_end		@ setup our mode stack
-	add	r13, r13, #CONFIG_STACKSIZE	@ resides at top of normal stack
-	sub	r13, r13, #8
+	ldr	r13, _armboot_start		@ setup our mode stack
+	sub	r13, r13, #(CONFIG_STACKSIZE+CFG_MALLOC_LEN)
+	sub	r13, r13, #(CFG_GBL_DATA_SIZE+8) @ reserved a couple spots in abort stack
 
 	str	lr, [r13]			@ save caller lr / spsr
 	mrs	lr, spsr
diff --git a/cpu/pxa/cpu.c b/cpu/pxa/cpu.c
index 32ec4f6..abb064a 100644
--- a/cpu/pxa/cpu.c
+++ b/cpu/pxa/cpu.c
@@ -42,7 +42,7 @@
 #ifdef CONFIG_USE_IRQ
 	DECLARE_GLOBAL_DATA_PTR;
 
-	IRQ_STACK_START = _armboot_start - CFG_MALLOC_LEN - CFG_GBL_DATA_LEN - 4;
+	IRQ_STACK_START = _armboot_start - CFG_MALLOC_LEN - CFG_GBL_DATA_SIZE - 4;
 	FIQ_STACK_START = IRQ_STACK_START - CONFIG_STACKSIZE_IRQ;
 #endif
 	return 0;
diff --git a/cpu/pxa/start.S b/cpu/pxa/start.S
index d41b414..de2a084 100644
--- a/cpu/pxa/start.S
+++ b/cpu/pxa/start.S
@@ -69,27 +69,15 @@
 	.word _start
 
 /*
- * Note: _armboot_end_data and _armboot_end are defined
- * by the (board-dependent) linker script.
- * _armboot_end_data is the first usable FLASH address after armboot
- */
-.globl _armboot_end_data
-_armboot_end_data:
-	.word armboot_end_data
-.globl _armboot_end
-_armboot_end:
-	.word armboot_end
-
-/*
- * This is defined in the board specific linker script
+ * These are defined in the board-specific linker script.
  */
 .globl _bss_start
 _bss_start:
-	.word bss_start
+	.word __bss_start
 
 .globl _bss_end
 _bss_end:
-	.word bss_end
+	.word _end
 
 #ifdef CONFIG_USE_IRQ
 /* IRQ stack memory (calculated at run-time) */
@@ -131,7 +119,7 @@
 	beq     stack_setup
 
 	ldr	r2, _armboot_start
-	ldr	r3, _armboot_end
+	ldr	r3, _bss_start
 	sub	r2, r3, r2		/* r2 <- size of armboot            */
 	add	r2, r0, r2		/* r2 <- source end address         */
 
@@ -152,7 +140,6 @@
 	sub	sp, r0, #12		/* leave 3 words for abort-stack    */
 
 clear_bss:
-
 	ldr	r0, _bss_start		/* find start of bss segment        */
 	add	r0, r0, #4		/* start at first byte of bss       */
 	ldr	r1, _bss_end		/* stop here                        */
@@ -163,7 +150,6 @@
 	cmp	r0, r1
 	bne	clbss_l
 
-
 	ldr	pc, _start_armboot
 
 _start_armboot: .word start_armboot
@@ -303,9 +289,9 @@
 	stmia	sp, {r0 - r12}			/* Calling r0-r12	    */
 	add	r8, sp, #S_PC
 
-	ldr	r2, _armboot_end
-	add	r2, r2, #CONFIG_STACKSIZE
-	sub	r2, r2, #8
+	ldr	r2, _armboot_start
+	sub	r2, r2, #(CONFIG_STACKSIZE+CFG_MALLOC_LEN)
+	sub	r2, r2, #(CFG_GBL_DATA_SIZE+8)  @ set base 2 words into abort stack
 	ldmia	r2, {r2 - r4}			/* get pc, cpsr, old_r0	    */
 	add	r0, sp, #S_FRAME_SIZE		/* restore sp_SVC	    */
 
@@ -340,9 +326,9 @@
 	.endm
 
 	.macro get_bad_stack
-	ldr	r13, _armboot_end		@ setup our mode stack
-	add	r13, r13, #CONFIG_STACKSIZE	@ resides at top of normal stack
-	sub	r13, r13, #8
+	ldr	r13, _armboot_start		@ setup our mode stack
+	sub	r13, r13, #(CONFIG_STACKSIZE+CFG_MALLOC_LEN)
+	sub	r13, r13, #(CFG_GBL_DATA_SIZE+8) @ reserved a couple spots in abort stack
 
 	str	lr, [r13]			@ save caller lr / spsr
 	mrs	lr, spsr
diff --git a/cpu/sa1100/cpu.c b/cpu/sa1100/cpu.c
index b613fe7..34adf91 100644
--- a/cpu/sa1100/cpu.c
+++ b/cpu/sa1100/cpu.c
@@ -41,7 +41,7 @@
 #ifdef CONFIG_USE_IRQ
 	DECLARE_GLOBAL_DATA_PTR;
 
-	IRQ_STACK_START = _armboot_start - CFG_MALLOC_LEN - CFG_GBL_DATA_LEN - 4;
+	IRQ_STACK_START = _armboot_start - CFG_MALLOC_LEN - CFG_GBL_DATA_SIZE - 4;
 	FIQ_STACK_START = IRQ_STACK_START - CONFIG_STACKSIZE_IRQ;
 #endif
 	return 0;
diff --git a/cpu/sa1100/start.S b/cpu/sa1100/start.S
index 0c8946e..fe1316c 100644
--- a/cpu/sa1100/start.S
+++ b/cpu/sa1100/start.S
@@ -81,16 +81,15 @@
 	.word _start
 
 /*
- * Note: _armboot_end_data and _armboot_end are defined
- * by the (board-dependent) linker script.
- * _armboot_end_data is the first usable FLASH address after armboot
+ * These are defined in the board-specific linker script.
  */
-.globl _armboot_end_data
-_armboot_end_data:
-	.word armboot_end_data
-.globl _armboot_end
-_armboot_end:
-	.word armboot_end
+.globl _bss_start
+_bss_start:
+	.word __bss_start
+
+.globl _bss_end
+_bss_end:
+	.word _end
 
 #ifdef CONFIG_USE_IRQ
 /* IRQ stack memory (calculated at run-time) */
@@ -133,7 +132,7 @@
 	beq     stack_setup
 
 	ldr	r2, _armboot_start
-	ldr	r3, _armboot_end
+	ldr	r3, _bss_start
 	sub	r2, r3, r2		/* r2 <- size of armboot            */
 	add	r2, r0, r2		/* r2 <- source end address         */
 
@@ -153,6 +152,17 @@
 #endif
 	sub	sp, r0, #12		/* leave 3 words for abort-stack    */
 
+clear_bss:
+	ldr	r0, _bss_start		/* find start of bss segment        */
+	add	r0, r0, #4		/* start at first byte of bss       */
+	ldr	r1, _bss_end		/* stop here                        */
+	mov 	r2, #0x00000000		/* clear                            */
+
+clbss_l:str	r2, [r0]		/* clear loop...                    */
+	add	r0, r0, #4
+	cmp	r0, r1
+	bne	clbss_l
+
 	ldr	pc, _start_armboot
 
 _start_armboot:	.word start_armboot
@@ -276,9 +286,9 @@
 	stmia	sp, {r0 - r12}			@ Calling r0-r12
 	add     r8, sp, #S_PC
 
-	ldr	r2, _armboot_end
-	add	r2, r2, #CONFIG_STACKSIZE
-	sub	r2, r2, #8
+	ldr	r2, _armboot_start
+	sub	r2, r2, #(CONFIG_STACKSIZE+CFG_MALLOC_LEN)
+	sub	r2, r2, #(CFG_GBL_DATA_SIZE+8)  @ set base 2 words into abort stack
 	ldmia	r2, {r2 - r4}                   @ get pc, cpsr, old_r0
 	add	r0, sp, #S_FRAME_SIZE		@ restore sp_SVC
 
@@ -309,9 +319,9 @@
 	.endm
 
 	.macro get_bad_stack
-	ldr	r13, _armboot_end		@ setup our mode stack
-	add	r13, r13, #CONFIG_STACKSIZE	@ resides at top of normal stack
-	sub	r13, r13, #8
+	ldr	r13, _armboot_start		@ setup our mode stack
+	sub	r13, r13, #(CONFIG_STACKSIZE+CFG_MALLOC_LEN)
+	sub	r13, r13, #(CFG_GBL_DATA_SIZE+8) @ reserved a couple spots in abort stack
 
 	str	lr, [r13]			@ save caller lr / spsr
 	mrs	lr, spsr