--- /dev/null
+From a6b4b25bd15c0a490769422a7eee355e9e91a57b Mon Sep 17 00:00:00 2001
+From: Sudeep Holla <sudeep.holla@arm.com>
+Date: Fri, 10 Jul 2015 18:36:11 +0100
+Subject: ARM: BCM63xx: fix parameter to of_get_cpu_node in bcm63138_smp_boot_secondary
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+commit a6b4b25bd15c0a490769422a7eee355e9e91a57b upstream.
+
+of_get_cpu_node provides the device node associated with the given
+logical CPU and cpu_logical_map contains the physical id for each CPU
+in the logical ordering. Passing cpu_logical_map(cpu) to of_get_cpu_node
+is incorrect.
+
+This patch fixes the issue by passing the logical CPU number to
+of_get_cpu_node
+
+Fixes: ed5cd8163da8 ("ARM: BCM63xx: Add SMP support for BCM63138")
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: bcm-kernel-feedback-list@broadcom.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-bcm/bcm63xx_smp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-bcm/bcm63xx_smp.c
++++ b/arch/arm/mach-bcm/bcm63xx_smp.c
+@@ -127,7 +127,7 @@ static int bcm63138_smp_boot_secondary(u
+ }
+
+ /* Locate the secondary CPU node */
+- dn = of_get_cpu_node(cpu_logical_map(cpu), NULL);
++ dn = of_get_cpu_node(cpu, NULL);
+ if (!dn) {
+ pr_err("SMP: failed to locate secondary CPU%d node\n", cpu);
+ ret = -ENODEV;
--- /dev/null
+From 65e3293381e1cf1abcfe1aa22b914650a40e3af4 Mon Sep 17 00:00:00 2001
+From: Hyungwon Hwang <human.hwang@samsung.com>
+Date: Mon, 15 Jun 2015 13:03:17 +0900
+Subject: ARM: dts: fix clock-frequency of display timing0 for exynos3250-rinato
+
+From: Hyungwon Hwang <human.hwang@samsung.com>
+
+commit 65e3293381e1cf1abcfe1aa22b914650a40e3af4 upstream.
+
+After the commit abc0b1447d49 ("drm: Perform basic sanity checks on
+probed modes"), proper clock-frequency becomes mandatory for
+validating the mode of panel. The display does not work if there is
+no mode validated. Also, this clock-frequency must be set
+appropriately for getting required frame rate.
+
+Fixes: abc0b1447d49 ("drm: Perform basic sanity checks on probed modes")
+Signed-off-by: Hyungwon Hwang <human.hwang@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Sigend-off-by: Kukjin Kim <kgene@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/exynos3250-rinato.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/exynos3250-rinato.dts
++++ b/arch/arm/boot/dts/exynos3250-rinato.dts
+@@ -182,7 +182,7 @@
+
+ display-timings {
+ timing-0 {
+- clock-frequency = <0>;
++ clock-frequency = <4600000>;
+ hactive = <320>;
+ vactive = <320>;
+ hfront-porch = <1>;
--- /dev/null
+From 1a1b698b115467242303daf5fe1d3c9886c2fa17 Mon Sep 17 00:00:00 2001
+From: Heiko Stuebner <heiko@sntech.de>
+Date: Fri, 19 Jun 2015 16:31:14 +0200
+Subject: ARM: dts: rockchip: fix rk3288 watchdog irq
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+commit 1a1b698b115467242303daf5fe1d3c9886c2fa17 upstream.
+
+The watchdog irq is actually SPI 79, which translates to the original
+111 in the manual where the SPI irqs start at 32.
+The current dw_wdt driver does not use the irq at all, so this issue
+never surfaced. Nevertheless fix this for a time we want to use the irq.
+
+Fixes: 2ab557b72d46 ("ARM: dts: rockchip: add core rk3288 dtsi")
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/rk3288.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/rk3288.dtsi
++++ b/arch/arm/boot/dts/rk3288.dtsi
+@@ -626,7 +626,7 @@
+ compatible = "rockchip,rk3288-wdt", "snps,dw-wdt";
+ reg = <0xff800000 0x100>;
+ clocks = <&cru PCLK_WDT>;
+- interrupts = <GIC_SPI 111 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 79 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+ };
+
--- /dev/null
+From b9e23f321940d2db2c9def8ff723b8464fb86343 Mon Sep 17 00:00:00 2001
+From: Vignesh R <vigneshr@ti.com>
+Date: Wed, 3 Jun 2015 17:21:20 +0530
+Subject: ARM: OMAP2+: DRA7: clockdomain: change l4per2_7xx_clkdm to SW_WKUP
+
+From: Vignesh R <vigneshr@ti.com>
+
+commit b9e23f321940d2db2c9def8ff723b8464fb86343 upstream.
+
+Legacy IPs like PWMSS, present under l4per2_7xx_clkdm, cannot support
+smart-idle when its clock domain is in HW_AUTO on DRA7 SoCs. Hence,
+program clock domain to SW_WKUP.
+
+Signed-off-by: Vignesh R <vigneshr@ti.com>
+Acked-by: Tero Kristo <t-kristo@ti.com>
+Reviewed-by: Paul Walmsley <paul@pwsan.com>
+Signed-off-by: Paul Walmsley <paul@pwsan.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-omap2/clockdomains7xx_data.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-omap2/clockdomains7xx_data.c
++++ b/arch/arm/mach-omap2/clockdomains7xx_data.c
+@@ -331,7 +331,7 @@ static struct clockdomain l4per2_7xx_clk
+ .dep_bit = DRA7XX_L4PER2_STATDEP_SHIFT,
+ .wkdep_srcs = l4per2_wkup_sleep_deps,
+ .sleepdep_srcs = l4per2_wkup_sleep_deps,
+- .flags = CLKDM_CAN_HWSUP_SWSUP,
++ .flags = CLKDM_CAN_SWSUP,
+ };
+
+ static struct clockdomain mpu0_7xx_clkdm = {
--- /dev/null
+From 5be9fc23cdb42e1d383ecc8eae8a8ff70a752708 Mon Sep 17 00:00:00 2001
+From: Benjamin Cama <benoar@dolka.fr>
+Date: Tue, 14 Jul 2015 16:25:58 +0200
+Subject: ARM: orion5x: fix legacy orion5x IRQ numbers
+
+From: Benjamin Cama <benoar@dolka.fr>
+
+commit 5be9fc23cdb42e1d383ecc8eae8a8ff70a752708 upstream.
+
+Since v3.18, attempts to deliver IRQ0 are rejected, breaking orion5x.
+Fix this by increasing all interrupts by one, as did 5d6bed2a9c8b for
+dove. Also, force MULTI_IRQ_HANDLER for all orion platforms (including
+dove) as the specific handler is needed to shift back IRQ numbers by
+one.
+
+[gregory.clement@free-electrons.com]: moved the select
+MULTI_IRQ_HANDLER from PLAT_ORION_LEGACY to ARCH_ORION5X as it broke
+the build for dove.
+
+Fixes: a71b092a9c68 ("ARM: Convert handle_IRQ to use __handle_domain_irq")
+Signed-off-by: Benjamin Cama <benoar@dolka.fr>
+Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Tested-by: Detlef Vollmann <dv@vollmann.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/Kconfig | 1
+ arch/arm/mach-orion5x/include/mach/irqs.h | 64 +++++++++++++++---------------
+ arch/arm/mach-orion5x/irq.c | 4 -
+ 3 files changed, 35 insertions(+), 34 deletions(-)
+
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -536,6 +536,7 @@ config ARCH_ORION5X
+ select MVEBU_MBUS
+ select PCI
+ select PLAT_ORION_LEGACY
++ select MULTI_IRQ_HANDLER
+ help
+ Support for the following Marvell Orion 5x series SoCs:
+ Orion-1 (5181), Orion-VoIP (5181L), Orion-NAS (5182),
+--- a/arch/arm/mach-orion5x/include/mach/irqs.h
++++ b/arch/arm/mach-orion5x/include/mach/irqs.h
+@@ -16,42 +16,42 @@
+ /*
+ * Orion Main Interrupt Controller
+ */
+-#define IRQ_ORION5X_BRIDGE 0
+-#define IRQ_ORION5X_DOORBELL_H2C 1
+-#define IRQ_ORION5X_DOORBELL_C2H 2
+-#define IRQ_ORION5X_UART0 3
+-#define IRQ_ORION5X_UART1 4
+-#define IRQ_ORION5X_I2C 5
+-#define IRQ_ORION5X_GPIO_0_7 6
+-#define IRQ_ORION5X_GPIO_8_15 7
+-#define IRQ_ORION5X_GPIO_16_23 8
+-#define IRQ_ORION5X_GPIO_24_31 9
+-#define IRQ_ORION5X_PCIE0_ERR 10
+-#define IRQ_ORION5X_PCIE0_INT 11
+-#define IRQ_ORION5X_USB1_CTRL 12
+-#define IRQ_ORION5X_DEV_BUS_ERR 14
+-#define IRQ_ORION5X_PCI_ERR 15
+-#define IRQ_ORION5X_USB_BR_ERR 16
+-#define IRQ_ORION5X_USB0_CTRL 17
+-#define IRQ_ORION5X_ETH_RX 18
+-#define IRQ_ORION5X_ETH_TX 19
+-#define IRQ_ORION5X_ETH_MISC 20
+-#define IRQ_ORION5X_ETH_SUM 21
+-#define IRQ_ORION5X_ETH_ERR 22
+-#define IRQ_ORION5X_IDMA_ERR 23
+-#define IRQ_ORION5X_IDMA_0 24
+-#define IRQ_ORION5X_IDMA_1 25
+-#define IRQ_ORION5X_IDMA_2 26
+-#define IRQ_ORION5X_IDMA_3 27
+-#define IRQ_ORION5X_CESA 28
+-#define IRQ_ORION5X_SATA 29
+-#define IRQ_ORION5X_XOR0 30
+-#define IRQ_ORION5X_XOR1 31
++#define IRQ_ORION5X_BRIDGE (1 + 0)
++#define IRQ_ORION5X_DOORBELL_H2C (1 + 1)
++#define IRQ_ORION5X_DOORBELL_C2H (1 + 2)
++#define IRQ_ORION5X_UART0 (1 + 3)
++#define IRQ_ORION5X_UART1 (1 + 4)
++#define IRQ_ORION5X_I2C (1 + 5)
++#define IRQ_ORION5X_GPIO_0_7 (1 + 6)
++#define IRQ_ORION5X_GPIO_8_15 (1 + 7)
++#define IRQ_ORION5X_GPIO_16_23 (1 + 8)
++#define IRQ_ORION5X_GPIO_24_31 (1 + 9)
++#define IRQ_ORION5X_PCIE0_ERR (1 + 10)
++#define IRQ_ORION5X_PCIE0_INT (1 + 11)
++#define IRQ_ORION5X_USB1_CTRL (1 + 12)
++#define IRQ_ORION5X_DEV_BUS_ERR (1 + 14)
++#define IRQ_ORION5X_PCI_ERR (1 + 15)
++#define IRQ_ORION5X_USB_BR_ERR (1 + 16)
++#define IRQ_ORION5X_USB0_CTRL (1 + 17)
++#define IRQ_ORION5X_ETH_RX (1 + 18)
++#define IRQ_ORION5X_ETH_TX (1 + 19)
++#define IRQ_ORION5X_ETH_MISC (1 + 20)
++#define IRQ_ORION5X_ETH_SUM (1 + 21)
++#define IRQ_ORION5X_ETH_ERR (1 + 22)
++#define IRQ_ORION5X_IDMA_ERR (1 + 23)
++#define IRQ_ORION5X_IDMA_0 (1 + 24)
++#define IRQ_ORION5X_IDMA_1 (1 + 25)
++#define IRQ_ORION5X_IDMA_2 (1 + 26)
++#define IRQ_ORION5X_IDMA_3 (1 + 27)
++#define IRQ_ORION5X_CESA (1 + 28)
++#define IRQ_ORION5X_SATA (1 + 29)
++#define IRQ_ORION5X_XOR0 (1 + 30)
++#define IRQ_ORION5X_XOR1 (1 + 31)
+
+ /*
+ * Orion General Purpose Pins
+ */
+-#define IRQ_ORION5X_GPIO_START 32
++#define IRQ_ORION5X_GPIO_START 33
+ #define NR_GPIO_IRQS 32
+
+ #define NR_IRQS (IRQ_ORION5X_GPIO_START + NR_GPIO_IRQS)
+--- a/arch/arm/mach-orion5x/irq.c
++++ b/arch/arm/mach-orion5x/irq.c
+@@ -42,7 +42,7 @@ __exception_irq_entry orion5x_legacy_han
+ stat = readl_relaxed(MAIN_IRQ_CAUSE);
+ stat &= readl_relaxed(MAIN_IRQ_MASK);
+ if (stat) {
+- unsigned int hwirq = __fls(stat);
++ unsigned int hwirq = 1 + __fls(stat);
+ handle_IRQ(hwirq, regs);
+ return;
+ }
+@@ -51,7 +51,7 @@ __exception_irq_entry orion5x_legacy_han
+
+ void __init orion5x_init_irq(void)
+ {
+- orion_irq_init(0, MAIN_IRQ_MASK);
++ orion_irq_init(1, MAIN_IRQ_MASK);
+
+ #ifdef CONFIG_MULTI_IRQ_HANDLER
+ set_handle_irq(orion5x_legacy_handle_irq);
--- /dev/null
+From fe4407c0dc58215a7abfb7532740d79ddabe7a7a Mon Sep 17 00:00:00 2001
+From: Caesar Wang <wxt@rock-chips.com>
+Date: Tue, 9 Jun 2015 17:49:57 +0800
+Subject: ARM: rockchip: fix the CPU soft reset
+
+From: Caesar Wang <wxt@rock-chips.com>
+
+commit fe4407c0dc58215a7abfb7532740d79ddabe7a7a upstream.
+
+We need different orderings when turning a core on and turning a core
+off. In one case we need to assert reset before turning power off.
+In ther other case we need to turn power on and the deassert reset.
+
+In general, the correct flow is:
+
+CPU off:
+ reset_control_assert
+ regmap_update_bits(pmu, PMU_PWRDN_CON, BIT(pd), BIT(pd))
+ wait_for_power_domain_to_turn_off
+CPU on:
+ regmap_update_bits(pmu, PMU_PWRDN_CON, BIT(pd), 0)
+ wait_for_power_domain_to_turn_on
+ reset_control_deassert
+
+This is needed for stressing CPU up/down, as per:
+ cd /sys/devices/system/cpu/
+ for i in $(seq 10000); do
+ echo "================= $i ============"
+ for j in $(seq 100); do
+ while [[ "$(cat cpu1/online)$(cat cpu2/online)$(cat cpu3/online)" != "000"" ]]
+ echo 0 > cpu1/online
+ echo 0 > cpu2/online
+ echo 0 > cpu3/online
+ done
+ while [[ "$(cat cpu1/online)$(cat cpu2/online)$(cat cpu3/online)" != "111" ]]; do
+ echo 1 > cpu1/online
+ echo 1 > cpu2/online
+ echo 1 > cpu3/online
+ done
+ done
+ done
+
+The following is reproducable log:
+ [34466.186812] PM: noirq suspend of devices complete after 0.669 msecs
+ [34466.186824] Disabling non-boot CPUs ...
+ [34466.187509] CPU1: shutdown
+ [34466.188672] CPU2: shutdown
+ [34473.736627] Kernel panic - not syncing:Watchdog detected hard LOCKUP on cpu 0
+ .......
+or others similar log:
+ .......
+ [ 4072.454453] CPU1: shutdown
+ [ 4072.504436] CPU2: shutdown
+ [ 4072.554426] CPU3: shutdown
+ [ 4072.577827] CPU1: Booted secondary processor
+ [ 4072.582611] CPU2: Booted secondary processor
+ <hang>
+
+ Tested by cpu up/down scripts, the results told us need delay more time
+before write the sram. The wait time is affected by many aspects
+(e.g: cpu frequency, bootrom frequency, sram frequency, bus speed, ...).
+
+ Although the cpus other than cpu0 will write the sram, the speedy is
+no the same as cpu0, if the cpu0 early wake up, perhaps the other cpus
+can't startup. As we know, the cpu0 can wake up when the cpu1/2/3 write
+the 'sram+4/8' and send the sev.
+ Anyway.....
+ At the moment, 1ms delay will be happy work for cpu up/down scripts test.
+
+Signed-off-by: Caesar Wang <wxt@rock-chips.com>
+Reviewed-by: Doug Anderson <dianders@chromium.org>
+Reviewed-by: Kever Yang <kever.yang@rock-chips.com>
+Fixes: 3ee851e212d0 ("ARM: rockchip: add basic smp support for rk3288")
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-rockchip/platsmp.c | 40 +++++++++++++++++++++------------------
+ 1 file changed, 22 insertions(+), 18 deletions(-)
+
+--- a/arch/arm/mach-rockchip/platsmp.c
++++ b/arch/arm/mach-rockchip/platsmp.c
+@@ -72,29 +72,22 @@ static struct reset_control *rockchip_ge
+ static int pmu_set_power_domain(int pd, bool on)
+ {
+ u32 val = (on) ? 0 : BIT(pd);
++ struct reset_control *rstc = rockchip_get_core_reset(pd);
+ int ret;
+
++ if (IS_ERR(rstc) && read_cpuid_part() != ARM_CPU_PART_CORTEX_A9) {
++ pr_err("%s: could not get reset control for core %d\n",
++ __func__, pd);
++ return PTR_ERR(rstc);
++ }
++
+ /*
+ * We need to soft reset the cpu when we turn off the cpu power domain,
+ * or else the active processors might be stalled when the individual
+ * processor is powered down.
+ */
+- if (read_cpuid_part() != ARM_CPU_PART_CORTEX_A9) {
+- struct reset_control *rstc = rockchip_get_core_reset(pd);
+-
+- if (IS_ERR(rstc)) {
+- pr_err("%s: could not get reset control for core %d\n",
+- __func__, pd);
+- return PTR_ERR(rstc);
+- }
+-
+- if (on)
+- reset_control_deassert(rstc);
+- else
+- reset_control_assert(rstc);
+-
+- reset_control_put(rstc);
+- }
++ if (!IS_ERR(rstc) && !on)
++ reset_control_assert(rstc);
+
+ ret = regmap_update_bits(pmu, PMU_PWRDN_CON, BIT(pd), val);
+ if (ret < 0) {
+@@ -112,6 +105,12 @@ static int pmu_set_power_domain(int pd,
+ }
+ }
+
++ if (!IS_ERR(rstc)) {
++ if (on)
++ reset_control_deassert(rstc);
++ reset_control_put(rstc);
++ }
++
+ return 0;
+ }
+
+@@ -146,9 +145,14 @@ static int rockchip_boot_secondary(unsig
+ * the mailbox:
+ * sram_base_addr + 4: 0xdeadbeaf
+ * sram_base_addr + 8: start address for pc
++ * The cpu0 need to wait the other cpus other than cpu0 entering
++ * the wfe state.The wait time is affected by many aspects.
++ * (e.g: cpu frequency, bootrom frequency, sram frequency, ...)
+ * */
+- udelay(10);
+- writel(virt_to_phys(secondary_startup), sram_base_addr + 8);
++ mdelay(1); /* ensure the cpus other than cpu0 to startup */
++
++ writel(virt_to_phys(rockchip_secondary_startup),
++ sram_base_addr + 8);
+ writel(0xDEADBEAF, sram_base_addr + 4);
+ dsb_sev();
+ }
--- /dev/null
+From bab383de3b84e584b0f09227151020b2a43dc34c Mon Sep 17 00:00:00 2001
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Date: Mon, 20 Jul 2015 17:27:21 +0530
+Subject: auxdisplay: ks0108: fix refcount
+
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+
+commit bab383de3b84e584b0f09227151020b2a43dc34c upstream.
+
+parport_find_base() will implicitly do parport_get_port() which
+increases the refcount. Then parport_register_device() will again
+increment the refcount. But while unloading the module we are only
+doing parport_unregister_device() decrementing the refcount only once.
+We add an parport_put_port() to neutralize the effect of
+parport_get_port().
+
+Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/auxdisplay/ks0108.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/auxdisplay/ks0108.c
++++ b/drivers/auxdisplay/ks0108.c
+@@ -139,6 +139,7 @@ static int __init ks0108_init(void)
+
+ ks0108_pardevice = parport_register_device(ks0108_parport, KS0108_NAME,
+ NULL, NULL, NULL, PARPORT_DEV_EXCL, NULL);
++ parport_put_port(ks0108_parport);
+ if (ks0108_pardevice == NULL) {
+ printk(KERN_ERR KS0108_NAME ": ERROR: "
+ "parport didn't register new device\n");
--- /dev/null
+From 64526370d11ce8868ca495723d595b61e8697fbf Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Wed, 15 Jul 2015 10:29:00 +0900
+Subject: devres: fix devres_get()
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+commit 64526370d11ce8868ca495723d595b61e8697fbf upstream.
+
+Currently, devres_get() passes devres_free() the pointer to devres,
+but devres_free() should be given with the pointer to resource data.
+
+Fixes: 9ac7849e35f7 ("devres: device resource management")
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/devres.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/base/devres.c
++++ b/drivers/base/devres.c
+@@ -297,10 +297,10 @@ void * devres_get(struct device *dev, vo
+ if (!dr) {
+ add_dr(dev, &new_dr->node);
+ dr = new_dr;
+- new_dr = NULL;
++ new_res = NULL;
+ }
+ spin_unlock_irqrestore(&dev->devres_lock, flags);
+- devres_free(new_dr);
++ devres_free(new_res);
+
+ return dr->data;
+ }
--- /dev/null
+From 8cd50626823c00ca7472b2f61cb8c0eb9798ddc0 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Fri, 31 Jul 2015 16:36:28 +0800
+Subject: Doc: ABI: testing: configfs-usb-gadget-loopback
+
+From: Peter Chen <peter.chen@freescale.com>
+
+commit 8cd50626823c00ca7472b2f61cb8c0eb9798ddc0 upstream.
+
+Fix the name of attribute
+
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/ABI/testing/configfs-usb-gadget-loopback | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/ABI/testing/configfs-usb-gadget-loopback
++++ b/Documentation/ABI/testing/configfs-usb-gadget-loopback
+@@ -5,4 +5,4 @@ Description:
+ The attributes:
+
+ qlen - depth of loopback queue
+- bulk_buflen - buffer length
++ buflen - buffer length
--- /dev/null
+From 4bc58eb16bb2352854b9c664cc36c1c68d2bfbb7 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Fri, 31 Jul 2015 16:36:29 +0800
+Subject: Doc: ABI: testing: configfs-usb-gadget-sourcesink
+
+From: Peter Chen <peter.chen@freescale.com>
+
+commit 4bc58eb16bb2352854b9c664cc36c1c68d2bfbb7 upstream.
+
+Fix the name of attribute
+
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/ABI/testing/configfs-usb-gadget-sourcesink | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/ABI/testing/configfs-usb-gadget-sourcesink
++++ b/Documentation/ABI/testing/configfs-usb-gadget-sourcesink
+@@ -9,4 +9,4 @@ Description:
+ isoc_maxpacket - 0 - 1023 (fs), 0 - 1024 (hs/ss)
+ isoc_mult - 0..2 (hs/ss only)
+ isoc_maxburst - 0..15 (ss only)
+- qlen - buffer length
++ buflen - buffer length
--- /dev/null
+From 3a496b00b6f90c41bd21a410871dfc97d4f3c7ab Mon Sep 17 00:00:00 2001
+From: David Daney <david.daney@cavium.com>
+Date: Wed, 19 Aug 2015 13:17:47 -0700
+Subject: of/address: Don't loop forever in of_find_matching_node_by_address().
+
+From: David Daney <david.daney@cavium.com>
+
+commit 3a496b00b6f90c41bd21a410871dfc97d4f3c7ab upstream.
+
+If the internal call to of_address_to_resource() fails, we end up
+looping forever in of_find_matching_node_by_address(). This can be
+caused by a defective device tree, or calling with an incorrect
+matches argument.
+
+Fix by calling of_find_matching_node() unconditionally at the end of
+the loop.
+
+Signed-off-by: David Daney <david.daney@cavium.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/of/address.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -845,10 +845,10 @@ struct device_node *of_find_matching_nod
+ struct resource res;
+
+ while (dn) {
+- if (of_address_to_resource(dn, 0, &res))
+- continue;
+- if (res.start == base_address)
++ if (!of_address_to_resource(dn, 0, &res) &&
++ res.start == base_address)
+ return dn;
++
+ dn = of_find_matching_node(dn, matches);
+ }
+
--- /dev/null
+From c329061be51bef655f28c9296093984c977aff85 Mon Sep 17 00:00:00 2001
+From: Kishon Vijay Abraham I <kishon@ti.com>
+Date: Mon, 27 Jul 2015 16:54:10 +0530
+Subject: regulator: pbias: Fix broken pbias disable functionality
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+commit c329061be51bef655f28c9296093984c977aff85 upstream.
+
+regulator_disable of pbias always writes '0' to the enable_reg.
+However actual disable value of pbias regulator is not always '0'.
+Fix it by populating the disable_val in pbias_reg_info for the
+various platforms and assign it to the disable_val of
+pbias regulator descriptor. This will be used by
+regulator_disable_regmap while disabling pbias regulator.
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/pbias-regulator.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/regulator/pbias-regulator.c
++++ b/drivers/regulator/pbias-regulator.c
+@@ -30,6 +30,7 @@
+ struct pbias_reg_info {
+ u32 enable;
+ u32 enable_mask;
++ u32 disable_val;
+ u32 vmode;
+ unsigned int enable_time;
+ char *name;
+@@ -62,6 +63,7 @@ static const struct pbias_reg_info pbias
+ .enable = BIT(1),
+ .enable_mask = BIT(1),
+ .vmode = BIT(0),
++ .disable_val = 0,
+ .enable_time = 100,
+ .name = "pbias_mmc_omap2430"
+ };
+@@ -77,6 +79,7 @@ static const struct pbias_reg_info pbias
+ static const struct pbias_reg_info pbias_mmc_omap4 = {
+ .enable = BIT(26) | BIT(22),
+ .enable_mask = BIT(26) | BIT(25) | BIT(22),
++ .disable_val = BIT(25),
+ .vmode = BIT(21),
+ .enable_time = 100,
+ .name = "pbias_mmc_omap4"
+@@ -85,6 +88,7 @@ static const struct pbias_reg_info pbias
+ static const struct pbias_reg_info pbias_mmc_omap5 = {
+ .enable = BIT(27) | BIT(26),
+ .enable_mask = BIT(27) | BIT(25) | BIT(26),
++ .disable_val = BIT(25),
+ .vmode = BIT(21),
+ .enable_time = 100,
+ .name = "pbias_mmc_omap5"
+@@ -159,6 +163,7 @@ static int pbias_regulator_probe(struct
+ drvdata[data_idx].desc.enable_reg = res->start;
+ drvdata[data_idx].desc.enable_mask = info->enable_mask;
+ drvdata[data_idx].desc.enable_val = info->enable;
++ drvdata[data_idx].desc.disable_val = info->disable_val;
+
+ cfg.init_data = pbias_matches[idx].init_data;
+ cfg.driver_data = &drvdata[data_idx];
kvm-mmu-fix-validation-of-mmio-page-fault.patch
kvm-ppc-book3s-hv-exit-on-h_doorbell-if-host_ipi-is-set.patch
kvm-ppc-book3s-hv-fix-race-in-reading-change-bit-when-removing-hpte.patch
+xtensa-fix-threadptr-reload-on-return-to-userspace.patch
+xtensa-fix-kernel-register-spilling.patch
+devres-fix-devres_get.patch
+doc-abi-testing-configfs-usb-gadget-loopback.patch
+doc-abi-testing-configfs-usb-gadget-sourcesink.patch
+spi-spi-xilinx-fix-spurious-irq-ack-on-irq-mode.patch
+spi-spi-xilinx-fix-mixed-poll-irq-mode.patch
+auxdisplay-ks0108-fix-refcount.patch
+regulator-pbias-fix-broken-pbias-disable-functionality.patch
+x86-mce-reenable-cmci-banks-when-swiching-back-to-interrupt-mode.patch
+soc-tegra-pmc-avoid-usage-of-uninitialized-variable.patch
+of-address-don-t-loop-forever-in-of_find_matching_node_by_address.patch
+arm-bcm63xx-fix-parameter-to-of_get_cpu_node-in-bcm63138_smp_boot_secondary.patch
+arm-orion5x-fix-legacy-orion5x-irq-numbers.patch
+arm-dts-fix-clock-frequency-of-display-timing0-for-exynos3250-rinato.patch
+arm-omap2-dra7-clockdomain-change-l4per2_7xx_clkdm-to-sw_wkup.patch
+arm-rockchip-fix-the-cpu-soft-reset.patch
+arm-dts-rockchip-fix-rk3288-watchdog-irq.patch
--- /dev/null
+From 95169cd23bfa88003f8be06234dbd65f5737add0 Mon Sep 17 00:00:00 2001
+From: Thierry Reding <treding@nvidia.com>
+Date: Thu, 9 Jul 2015 09:59:55 +0200
+Subject: soc/tegra: pmc: Avoid usage of uninitialized variable
+
+From: Thierry Reding <treding@nvidia.com>
+
+commit 95169cd23bfa88003f8be06234dbd65f5737add0 upstream.
+
+Make sure to only drop the reference to the OF node after it's been
+successfully obtained.
+
+Fixes: 3568df3d31d6 ("soc: tegra: Add thermal reset (thermtrip) support to PMC")
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/soc/tegra/pmc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/soc/tegra/pmc.c
++++ b/drivers/soc/tegra/pmc.c
+@@ -736,12 +736,12 @@ void tegra_pmc_init_tsense_reset(struct
+ u32 value, checksum;
+
+ if (!pmc->soc->has_tsense_reset)
+- goto out;
++ return;
+
+ np = of_find_node_by_name(pmc->dev->of_node, "i2c-thermtrip");
+ if (!np) {
+ dev_warn(dev, "i2c-thermtrip node not found, %s.\n", disabled);
+- goto out;
++ return;
+ }
+
+ if (of_property_read_u32(np, "nvidia,i2c-controller-id", &ctrl_id)) {
--- /dev/null
+From 16ea9b8ac45bf11d48af6013283e141e8ed86348 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+Date: Wed, 12 Aug 2015 18:04:04 +0200
+Subject: spi/spi-xilinx: Fix mixed poll/irq mode
+
+From: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+
+commit 16ea9b8ac45bf11d48af6013283e141e8ed86348 upstream.
+
+Once the module process a transfer in irq mode, the next poll transfer
+will not work because the transmitter is left in inhibited state.
+
+Fixes: 22417352f6b7f623 (Use polling mode on small transfers)
+Reported-by: Edward Kigwana <ekigwana@scires.com>
+Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-xilinx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-xilinx.c
++++ b/drivers/spi/spi-xilinx.c
+@@ -306,8 +306,10 @@ static int xilinx_spi_txrx_bufs(struct s
+ remaining_words -= n_words;
+ }
+
+- if (use_irq)
++ if (use_irq) {
+ xspi->write_fn(0, xspi->regs + XIPIF_V123B_DGIER_OFFSET);
++ xspi->write_fn(cr, xspi->regs + XSPI_CR_OFFSET);
++ }
+
+ return t->len;
+ }
--- /dev/null
+From 74346841e6f5df5f7b83d5904435d273c507dba6 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+Date: Thu, 13 Aug 2015 16:09:28 +0200
+Subject: spi/spi-xilinx: Fix spurious IRQ ACK on irq mode
+
+From: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+
+commit 74346841e6f5df5f7b83d5904435d273c507dba6 upstream.
+
+The ACK of an inexistent IRQ can trigger an spurious IRQ that breaks the
+txrx logic. This has been observed on axi_quad_spi:3.2 core.
+
+This patch only ACKs IRQs that have not been Acknowledge jet.
+
+Reported-by: Edward Kigwana <ekigwana@scires.com>
+Tested-by: Edward Kigwana <ekigwana@scires.com>
+Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-xilinx.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/spi/spi-xilinx.c
++++ b/drivers/spi/spi-xilinx.c
+@@ -249,19 +249,23 @@ static int xilinx_spi_txrx_bufs(struct s
+ xspi->tx_ptr = t->tx_buf;
+ xspi->rx_ptr = t->rx_buf;
+ remaining_words = t->len / xspi->bytes_per_word;
+- reinit_completion(&xspi->done);
+
+ if (xspi->irq >= 0 && remaining_words > xspi->buffer_size) {
++ u32 isr;
+ use_irq = true;
+- xspi->write_fn(XSPI_INTR_TX_EMPTY,
+- xspi->regs + XIPIF_V123B_IISR_OFFSET);
+- /* Enable the global IPIF interrupt */
+- xspi->write_fn(XIPIF_V123B_GINTR_ENABLE,
+- xspi->regs + XIPIF_V123B_DGIER_OFFSET);
+ /* Inhibit irq to avoid spurious irqs on tx_empty*/
+ cr = xspi->read_fn(xspi->regs + XSPI_CR_OFFSET);
+ xspi->write_fn(cr | XSPI_CR_TRANS_INHIBIT,
+ xspi->regs + XSPI_CR_OFFSET);
++ /* ACK old irqs (if any) */
++ isr = xspi->read_fn(xspi->regs + XIPIF_V123B_IISR_OFFSET);
++ if (isr)
++ xspi->write_fn(isr,
++ xspi->regs + XIPIF_V123B_IISR_OFFSET);
++ /* Enable the global IPIF interrupt */
++ xspi->write_fn(XIPIF_V123B_GINTR_ENABLE,
++ xspi->regs + XIPIF_V123B_DGIER_OFFSET);
++ reinit_completion(&xspi->done);
+ }
+
+ while (remaining_words) {
--- /dev/null
+From 1b48465500611a2dc5e75800c61ac352e22d41c3 Mon Sep 17 00:00:00 2001
+From: Xie XiuQi <xiexiuqi@huawei.com>
+Date: Wed, 12 Aug 2015 18:29:41 +0200
+Subject: x86/mce: Reenable CMCI banks when swiching back to interrupt mode
+
+From: Xie XiuQi <xiexiuqi@huawei.com>
+
+commit 1b48465500611a2dc5e75800c61ac352e22d41c3 upstream.
+
+Zhang Liguang reported the following issue:
+
+1) System detects a CMCI storm on the current CPU.
+
+2) Kernel disables the CMCI interrupt on banks owned by the
+ current CPU and switches to poll mode
+
+3) After the CMCI storm subsides, kernel switches back to
+ interrupt mode
+
+4) We expect the system to reenable the CMCI interrupt on banks
+ owned by the current CPU
+
+ mce_intel_adjust_timer
+ |-> cmci_reenable
+ |-> cmci_discover # owned banks are ignored here
+
+ static void cmci_discover(int banks)
+ ...
+ for (i = 0; i < banks; i++) {
+ ...
+ if (test_bit(i, owned)) # ownd banks is ignore here
+ continue;
+
+So convert cmci_storm_disable_banks() to
+cmci_toggle_interrupt_mode() which controls whether to enable or
+disable CMCI interrupts with its argument.
+
+NB: We cannot clear the owned bit because the banks won't be
+polled, otherwise. See:
+
+ 27f6c573e0f7 ("x86, CMCI: Add proper detection of end of CMCI storms")
+
+for more info.
+
+Reported-by: Zhang Liguang <zhangliguang@huawei.com>
+Signed-off-by: Xie XiuQi <xiexiuqi@huawei.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: huawei.libin@huawei.com
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Cc: rui.xiang@huawei.com
+Link: http://lkml.kernel.org/r/1439396985-12812-10-git-send-email-bp@alien8.de
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/mcheck/mce_intel.c | 41 ++++++++++++++++++---------------
+ 1 file changed, 23 insertions(+), 18 deletions(-)
+
+--- a/arch/x86/kernel/cpu/mcheck/mce_intel.c
++++ b/arch/x86/kernel/cpu/mcheck/mce_intel.c
+@@ -146,6 +146,27 @@ void mce_intel_hcpu_update(unsigned long
+ per_cpu(cmci_storm_state, cpu) = CMCI_STORM_NONE;
+ }
+
++static void cmci_toggle_interrupt_mode(bool on)
++{
++ unsigned long flags, *owned;
++ int bank;
++ u64 val;
++
++ raw_spin_lock_irqsave(&cmci_discover_lock, flags);
++ owned = this_cpu_ptr(mce_banks_owned);
++ for_each_set_bit(bank, owned, MAX_NR_BANKS) {
++ rdmsrl(MSR_IA32_MCx_CTL2(bank), val);
++
++ if (on)
++ val |= MCI_CTL2_CMCI_EN;
++ else
++ val &= ~MCI_CTL2_CMCI_EN;
++
++ wrmsrl(MSR_IA32_MCx_CTL2(bank), val);
++ }
++ raw_spin_unlock_irqrestore(&cmci_discover_lock, flags);
++}
++
+ unsigned long cmci_intel_adjust_timer(unsigned long interval)
+ {
+ if ((this_cpu_read(cmci_backoff_cnt) > 0) &&
+@@ -175,7 +196,7 @@ unsigned long cmci_intel_adjust_timer(un
+ */
+ if (!atomic_read(&cmci_storm_on_cpus)) {
+ __this_cpu_write(cmci_storm_state, CMCI_STORM_NONE);
+- cmci_reenable();
++ cmci_toggle_interrupt_mode(true);
+ cmci_recheck();
+ }
+ return CMCI_POLL_INTERVAL;
+@@ -186,22 +207,6 @@ unsigned long cmci_intel_adjust_timer(un
+ }
+ }
+
+-static void cmci_storm_disable_banks(void)
+-{
+- unsigned long flags, *owned;
+- int bank;
+- u64 val;
+-
+- raw_spin_lock_irqsave(&cmci_discover_lock, flags);
+- owned = this_cpu_ptr(mce_banks_owned);
+- for_each_set_bit(bank, owned, MAX_NR_BANKS) {
+- rdmsrl(MSR_IA32_MCx_CTL2(bank), val);
+- val &= ~MCI_CTL2_CMCI_EN;
+- wrmsrl(MSR_IA32_MCx_CTL2(bank), val);
+- }
+- raw_spin_unlock_irqrestore(&cmci_discover_lock, flags);
+-}
+-
+ static bool cmci_storm_detect(void)
+ {
+ unsigned int cnt = __this_cpu_read(cmci_storm_cnt);
+@@ -223,7 +228,7 @@ static bool cmci_storm_detect(void)
+ if (cnt <= CMCI_STORM_THRESHOLD)
+ return false;
+
+- cmci_storm_disable_banks();
++ cmci_toggle_interrupt_mode(false);
+ __this_cpu_write(cmci_storm_state, CMCI_STORM_ACTIVE);
+ r = atomic_add_return(1, &cmci_storm_on_cpus);
+ mce_timer_kick(CMCI_STORM_INTERVAL);
--- /dev/null
+From 77d6273e79e3a86552fcf10cdd31a69b46ed2ce6 Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Thu, 16 Jul 2015 10:41:02 +0300
+Subject: xtensa: fix kernel register spilling
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+commit 77d6273e79e3a86552fcf10cdd31a69b46ed2ce6 upstream.
+
+call12 can't be safely used as the first call in the inline function,
+because the compiler does not extend the stack frame of the bounding
+function accordingly, which may result in corruption of local variables.
+
+If a call needs to be done, do call8 first followed by call12.
+
+For pure assembly code in _switch_to increase stack frame size of the
+bounding function.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/xtensa/include/asm/traps.h | 29 +++++++++++++++++++----------
+ arch/xtensa/kernel/entry.S | 4 ++--
+ 2 files changed, 21 insertions(+), 12 deletions(-)
+
+--- a/arch/xtensa/include/asm/traps.h
++++ b/arch/xtensa/include/asm/traps.h
+@@ -25,30 +25,39 @@ static inline void spill_registers(void)
+ {
+ #if XCHAL_NUM_AREGS > 16
+ __asm__ __volatile__ (
+- " call12 1f\n"
++ " call8 1f\n"
+ " _j 2f\n"
+ " retw\n"
+ " .align 4\n"
+ "1:\n"
++#if XCHAL_NUM_AREGS == 32
++ " _entry a1, 32\n"
++ " addi a8, a0, 3\n"
++ " _entry a1, 16\n"
++ " mov a12, a12\n"
++ " retw\n"
++#else
+ " _entry a1, 48\n"
+- " addi a12, a0, 3\n"
+-#if XCHAL_NUM_AREGS > 32
+- " .rept (" __stringify(XCHAL_NUM_AREGS) " - 32) / 12\n"
++ " call12 1f\n"
++ " retw\n"
++ " .align 4\n"
++ "1:\n"
++ " .rept (" __stringify(XCHAL_NUM_AREGS) " - 16) / 12\n"
+ " _entry a1, 48\n"
+ " mov a12, a0\n"
+ " .endr\n"
+-#endif
+- " _entry a1, 48\n"
++ " _entry a1, 16\n"
+ #if XCHAL_NUM_AREGS % 12 == 0
+- " mov a8, a8\n"
+-#elif XCHAL_NUM_AREGS % 12 == 4
+ " mov a12, a12\n"
+-#elif XCHAL_NUM_AREGS % 12 == 8
++#elif XCHAL_NUM_AREGS % 12 == 4
+ " mov a4, a4\n"
++#elif XCHAL_NUM_AREGS % 12 == 8
++ " mov a8, a8\n"
+ #endif
+ " retw\n"
++#endif
+ "2:\n"
+- : : : "a12", "a13", "memory");
++ : : : "a8", "a9", "memory");
+ #else
+ __asm__ __volatile__ (
+ " mov a12, a12\n"
+--- a/arch/xtensa/kernel/entry.S
++++ b/arch/xtensa/kernel/entry.S
+@@ -1821,7 +1821,7 @@ ENDPROC(system_call)
+ mov a12, a0
+ .endr
+ #endif
+- _entry a1, 48
++ _entry a1, 16
+ #if XCHAL_NUM_AREGS % 12 == 0
+ mov a8, a8
+ #elif XCHAL_NUM_AREGS % 12 == 4
+@@ -1845,7 +1845,7 @@ ENDPROC(system_call)
+
+ ENTRY(_switch_to)
+
+- entry a1, 16
++ entry a1, 48
+
+ mov a11, a3 # and 'next' (a3)
+
--- /dev/null
+From 4229fb12a03e5da5882b420b0aa4a02e77447b86 Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Sat, 4 Jul 2015 15:27:39 +0300
+Subject: xtensa: fix threadptr reload on return to userspace
+
+From: Max Filippov <jcmvbkbc@gmail.com>
+
+commit 4229fb12a03e5da5882b420b0aa4a02e77447b86 upstream.
+
+Userspace return code may skip restoring THREADPTR register if there are
+no registers that need to be zeroed. This leads to spurious failures in
+libc NPTL tests.
+
+Always restore THREADPTR on return to userspace.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/xtensa/kernel/entry.S | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/xtensa/kernel/entry.S
++++ b/arch/xtensa/kernel/entry.S
+@@ -568,12 +568,13 @@ user_exception_exit:
+ * (if we have restored WSBITS-1 frames).
+ */
+
++2:
+ #if XCHAL_HAVE_THREADPTR
+ l32i a3, a1, PT_THREADPTR
+ wur a3, threadptr
+ #endif
+
+-2: j common_exception_exit
++ j common_exception_exit
+
+ /* This is the kernel exception exit.
+ * We avoided to do a MOVSP when we entered the exception, but we
projects / thirdparty / kernel / stable-queue.git / commitdiff
