Merge master.kernel.org:/pub/scm/linux/kernel/git/paulus/powerpc

* master.kernel.org:/pub/scm/linux/kernel/git/paulus/powerpc: (116 commits)
  [POWERPC] Add export of vgacon_remap_base
  [POWERPC] Remove bogus comment about page_is_ram
  [POWERPC] windfarm: don't die on suspend thread signal
  [POWERPC] Fix comment in kernel/irq.c
  [POWERPC] ppc: Fix booke watchdog initialization
  [POWERPC] PPC: Use ARRAY_SIZE macro when appropriate
  [POWERPC] Use ARRAY_SIZE macro when appropriate
  [POWERPC] Fix ppc64's writing to struct file_operations
  [POWERPC] ppc: use syslog macro for the printk log level
  [POWERPC] ppc: cs4218_tdm remove extra brace
  [POWERPC] Add mpc52xx/lite5200 PCI support
  [POWERPC] Only use H_BULK_REMOVE if the firmware supports it
  [POWERPC] Fixup error handling when emulating a floating point instruction
  [POWERPC] Enable interrupts if we are doing fp math emulation
  [POWERPC] Added kprobes support to ppc32
  [POWERPC] Make pSeries use the H_BULK_REMOVE hypervisor call
  [POWERPC] Clear RI bit in MSR before restoring r13 when returning to userspace
  [POWERPC] Fix performance monitor exception
  [POWERPC] Compile fixes for arch/powerpc dcr code
  [POWERPC] Maple: use mmio nvram
  ...

1 files changed, 33 insertions, 26 deletions

diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 2551c0884af..2b66d53dcc5 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -172,13 +172,18 @@ syscall_error_cont:
 	stdcx.	r0,0,r1			/* to clear the reservation */
 	andi.	r6,r8,MSR_PR
 	ld	r4,_LINK(r1)
+	/*
+	 * Clear RI before restoring r13.  If we are returning to
+	 * userspace and we take an exception after restoring r13,
+	 * we end up corrupting the userspace r13 value.
+	 */
+	li	r12,MSR_RI
+	andc	r11,r10,r12
+	mtmsrd	r11,1			/* clear MSR.RI */
 	beq-	1f
 	ACCOUNT_CPU_USER_EXIT(r11, r12)
 	ld	r13,GPR13(r1)	/* only restore r13 if returning to usermode */
 1:	ld	r2,GPR2(r1)
-	li	r12,MSR_RI
-	andc	r11,r10,r12
-	mtmsrd	r11,1			/* clear MSR.RI */
 	ld	r1,GPR1(r1)
 	mtlr	r4
 	mtcr	r5
@@ -488,42 +493,44 @@ END_FW_FTR_SECTION_IFSET(FW_FEATURE_ISERIES)
 #endif
 	stb	r5,PACASOFTIRQEN(r13)
 
+	/* extract EE bit and use it to restore paca->hard_enabled */
 	ld	r3,_MSR(r1)
+	rldicl	r4,r3,49,63		/* r0 = (r3 >> 15) & 1 */
+	stb	r4,PACAHARDIRQEN(r13)
+
+	ld	r4,_CTR(r1)
+	ld	r0,_LINK(r1)
+	mtctr	r4
+	mtlr	r0
+	ld	r4,_XER(r1)
+	mtspr	SPRN_XER,r4
+
+	REST_8GPRS(5, r1)
+
 	andi.	r0,r3,MSR_RI
 	beq-	unrecov_restore
 
-	/* extract EE bit and use it to restore paca->hard_enabled */
-	rldicl	r4,r3,49,63		/* r0 = (r3 >> 15) & 1 */
-	stb	r4,PACAHARDIRQEN(r13)
+	stdcx.	r0,0,r1		/* to clear the reservation */
 
-	andi.	r0,r3,MSR_PR
+	/*
+	 * Clear RI before restoring r13.  If we are returning to
+	 * userspace and we take an exception after restoring r13,
+	 * we end up corrupting the userspace r13 value.
+	 */
+	mfmsr	r4
+	andc	r4,r4,r0	/* r0 contains MSR_RI here */
+	mtmsrd	r4,1
 
 	/*
 	 * r13 is our per cpu area, only restore it if we are returning to
 	 * userspace
 	 */
+	andi.	r0,r3,MSR_PR
 	beq	1f
-	ACCOUNT_CPU_USER_EXIT(r3, r4)
+	ACCOUNT_CPU_USER_EXIT(r2, r4)
 	REST_GPR(13, r1)
 1:
-	ld	r3,_CTR(r1)
-	ld	r0,_LINK(r1)
-	mtctr	r3
-	mtlr	r0
-	ld	r3,_XER(r1)
-	mtspr	SPRN_XER,r3
-
-	REST_8GPRS(5, r1)
-
-	stdcx.	r0,0,r1		/* to clear the reservation */
-
-	mfmsr	r0
-	li	r2, MSR_RI
-	andc	r0,r0,r2
-	mtmsrd	r0,1
-
-	ld	r0,_MSR(r1)
-	mtspr	SPRN_SRR1,r0
+	mtspr	SPRN_SRR1,r3
 
 	ld	r2,_CCR(r1)
 	mtcrf	0xFF,r2