There is a misprint in init_usb_class():
IS_ERR is used to get error code instead of PTR_ERR.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch reduces the keepalive threshold of WUSB host controllers from
timeout/2 to timeout/3.  The keepalive timer fires every timeout/2 ms, but
due to rounding errors and jitter, the host may decide not to send a
keepalive at timeout/2.  By the time the next timer fires, a full timeout
period may have expired causing the device to be disconnected without ever
having been sent a keepalive.  Changing the keepalive threshold to
timeout/3 ensures that at least one keepalive will be sent before a device
is disconnected.  The patch also updates the code to use msecs_to_jiffies
consistently.
Signed-off-by: NThomas Pugliese <thomas.pugliese@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The three options USB_ARCH_HAS_{EHCI,OHCI,XHCI} are all well beyond
their recommended shelf life. They have caused numerous build failures
over the years because they are never completely correct, and with
the move to splitting out the platform specific back-ends out of the
driver, there is no real need for them any more. Also, the use of making
USB_ARCH_HAS_HCD depend on it is questionable since one can always enable
dummy_hc these days.

This patch enables them unconditionally for all platforms and
architectures, which means it is now possible to build host controller
drivers for machines that are known not to come with this hardware,
but that is just how we treat most other drivers.

In order to minimise the impact on existing architecture code and
defconfig files, all the Kconfig are left present for now. All platforms
that currently do 'select USB_ARCH_HAS_*' should subsequently be changed
not to select that. All drivers depending on USB_ARCH_HAS_HCD should
be changed to depend on USB_SUPPORT instead.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Cc: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The OHCI host controller driver can be built standalone now,
without enabling any of the available bus glue drivers, so
there is not really a reason to error out here:

drivers/usb/host/ohci-hcd.c:1258: error:
 #error "missing bus glue for ohci-hcd"  #error "missing bus glue for ohci-hcd"

This follows the same change done in ehci recently as 843e56c0
"USB: EHCI: remove bogus #error" and hopefully avoids future
merge conflicts in this list.
Signed-off-by: NArnd Bergmann <arnd@arndb.de>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

My PL2303HX works at 500kbps after applying this patch.
I suppose that it could work at other non standard speeds since this fix

"correctly handle baudrates above 115200"
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/drivers/usb/serial/pl2303.c?id=8d48fdf689fed2c73c493e5146d1463689246442

came after this one

"fix baud rate handling in case of unsupported values"
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/drivers/usb/serial/pl2303.c?id=25b8286805e856c8c7fda127018e31032c918015

but I only can test it with 500000.
Patch made against mainline but tested with 3.4.45
Signed-off-by: NLuca Olivetti <luca@ventoso.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

In kernel we have nice specifier %*ph to dump small buffers. Let's use it.
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch adds an ohci->priv field for private use by OHCI
platform drivers.

Until now none of the platform drivers has used this private space,
but that's about to change in the next patch of this series.
Signed-off-by: NManjunath Goudar <manjunath.goudar@linaro.org>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch splits the ohci-platform code from ohci-hcd out
into its own separate driver module.This work is part of enabling
multi-platform kernels on ARM.

In V2:
  -Passed "hcd" argument instead of "ohci" in ohci_setup() because it is
   using "struct usb_hcd" argument.
In V3:
  -Directly passed "hcd" argument not required to call ohci_to_hcd() function.
Signed-off-by: NManjunath Goudar <manjunath.goudar@linaro.org>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Pci_enable_device() will set device power state to D0,
so it's no need to do it again in ci13xxx_pci_probe().
Signed-off-by: NYijing Wang <wangyijing@huawei.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: linux-usb@vger.kernel.org
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The usb3503 driver sleeps a flat 100ms when resetting the chip, with a
comment about waiting for the reference clock. This seems to be a
board-specific detail that should not hold up boot across all platforms.
This patch reduces the sleep to the 4ms initialization delay that the
chip itself actually requires (as per its data sheet). If certain boards
require more time to set up the reference clock, they should change this
through local patches or add a proper, configurable synchronization
mechanism.
Signed-off-by: NJulius Werner <jwerner@chromium.org>
Signed-off-by: NDongjin Kim <tobetter@gmail.com>
Acked-by: NOlof Johansson <olof@lixom.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove an erroneous tab that should be a space.
Signed-off-by: NJulius Werner <jwerner@chromium.org>
Signed-off-by: NDongjin Kim <tobetter@gmail.com>
Acked-by: NOlof Johansson <olof@lixom.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch adds Wireless USB root hub support to the USB HCD.  It allows
the HWA to create its root hub which previously failed because the HCD
treated wireless root hubs the same as USB2 high speed hubs.  The creation
of the root hub would fail in that case due to lack of TTs which wireless
root hubs do not support.
Signed-off-by: NThomas Pugliese <thomas.pugliese@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove redundant "_fusbh200_" from fusbh200_hcd_fusbh200_probe
and fusbh200_hcd_fusbh200_remove
Signed-off-by: NYuan-Hsin Chen <yhchen@faraday-tech.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

If you want to download Infineon modem via USB, this Infineon USB
flashloader driver is required.
Signed-off-by: NWei Shuai <cpuwolf@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch splits the PCI portion of ohci-hcd out into its
own separate driver module, called ohci-pci.

The major point of difficulty lies in ohci-pci's many vendor- and
device-specific workarounds.  Some of them have to be applied before
calling ohci_start() some after, which necessitates a fair amount of
code motion.  The other platform drivers require much smaller changes.

The complete sb800_prefetch() function moved to ohci-q.c,because its
only related to ohci-pci driver.

USB_OHCI_HCD_PCI symbol no longer dependence on STB03xxx, PPC_MPC52xx and
USB_OHCI_HCD_PPC_OF that's what removed.

V2:
  - few specific content of pci related code in ohci_pci_start function has been moved to ohci_pci_reset
    and rest of the generic code is written in ohci_start of ohci-hcd.c file.
V3:
 - ohci_restart() has been called in ohci_pci_reset() function for to reset the ohci pci.

V4:
 -sb800_prefetch() moved to ohci-q.c,because its only related to ohci-pci.
 -no longer _creating_ CONFIG_USB_OHCI_PCI,creating CONFIG_USB_OHCI_HCD_PCI.
 -overrides renamed with pci_override,its giving proper meaning.

V5:
 -sb800_prefetch() moved to pci-quirks.c,because its only related to pci.

V6:
 -sb800_prefetch() function has been moved to pci-quirks.c made as separate patch in 2/3.
 -Most of the generic ohci pci changes moved in 2/3 patch,now this is complete  ohci-pci separation patch.

V7:
 -Unrelated include file has been removed from ohci.h file.

V8:
 -USB_OHCI_HCD_PCI symbol does not dependence on STB03xxx, PPC_MPC52xx and USB_OHCI_HCD_PPC_OF.
Signed-off-by: NManjunath Goudar <manjunath.goudar@linaro.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Note that this changes is part of separating the ohci pci host controller
driver from ohci-hcd host code.
This contains :
     -Moved sb800_prefetch() function from ohci-pci.c to pci-quirks.c file
      and EXPORTed, this is part of the effort to move the ohci pci related
      code to generic pci code.
     -Passed "device" argument instead  of "ohci_hcd" in sb800_prefetch()
      function to avoid extra include file in pci-quirks.c.

V2:
     -Passed "device" argment instead of "pci_dev", then we use to_pci_dev()
      to get the "pci_dev" structure.
Signed-off-by: NManjunath Goudar <manjunath.goudar@linaro.org>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch prepares ohci-hcd for being split up into a core
library and separate platform driver modules.  A generic
ohci_hc_driver structure is created, containing all the "standard"
values, and a new mechanism is added whereby a driver module can
specify a set of overrides to those values.  In addition the
ohci_restart(),ohci_suspend() and ohci_resume() routines need
to be EXPORTed for use by the drivers.

Added ohci_setip(() and ohci_start() routine for to start the generic
controller rather than each having its own idiosyncratic approach.
This allow to clean duplicated code in most of SOC driver

In V2:
 -ohci_hcd_init() ohci_run() and ohci_stop() are not made non-static.
 -Adds the ohci_setup() and ohci_start() routine.

In V3:
 -purpose of ohci_setup() and ohci_start() function description written in the patch
  description.
 -ohci_init() are not made non-static but now called beginning of the ohci_restart().
 -ohci_run() signature change reverted back.
 -unrelated changes removed.
 -duplicate comment line removed.
 -inline ohci_suspend() and ohci_resume() is not needed so removed from ohci.h file.

In V4:
 -ohci-init() EXPORTed because it is called by all bus glue modules.
 -ohci-setup() removed from 1/2 added into 2/2 patch.

In V5:
 -Again ohci_setup() is added and EXPORTed because to replace the ohci_init() from
  all bus glues.
 -ohci_init() is not made non-static function.

In V6:
  -ohci_init() call is removed from ohci_quirk_nec_worker(), because it is already called in ohci_restart().

In V8:
  -ohci_hcd_init() is called by ohci_setup() to make generic ohci initialization in all ohci drivers.
Signed-off-by: NManjunath Goudar <manjunath.goudar@linaro.org>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch attempts to fix the isochronous API in the fhci-hcd
driver.  There are two problems with the current code:

	ed->last_iso is used but not set anywhere.  The patch changes
	its name to ed->next_iso and uses it to store the frame number
	of the next available slot in the isochronous stream.

	urb->start_frame isn't set when the URB_ISO_ASAP flag is off.
	The patch sets it to the next available slot if the stream is
	in use, or the current frame otherwise.

This won't give the right behavior when an underrun occurs, but I
don't know enough about the driver to handle that case.

Unfortunately, I don't have any way to test these changes.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
CC: Anton Vorontsov <avorontsov@ru.mvista.com>
CC: Li Yang <leoli@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch attempts to update the imx21-hcd driver to the current
standard for the isochronous API.  Firstly, urb->start_frame should
always be set by the driver; it is not an input parameter.  Secondly,
the URB_ISO_ASAP flag matters only when an URB is submitted to a
stream that has gotten an underrun.  It causes the URB to be scheduled
for the next available slot in the future, rather than the earliest
unused (and expired) slot.

Unfortunately, I don't have any way to test these changes.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
CC: Sascha Hauer <kernel@pengutronix.de>
CC: Martin Fuzzey <mfuzzey@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch attempts to fix the isochonour API in the musb host
driver.  In particular, the urb->start_frame field should always be
set by the driver; it isn't an input parameter.

The simplest way to accomplish this is to treat all URBs as though the
URB_ISO_ASAP flag was set.  This won't give the right behavior when an
underrun occurs, but I don't know enough about the musb driver to
handle that case.

Unfortunately, I have no way to test this change.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Exynos5440 does not require any explict USB phy configuration. So skip
the USB phy configuration for Exynos5440 based platforms.
Signed-off-by: NThomas Abraham <thomas.ab@samsung.com>
Ackked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

There is a specifier we may use to dump small buffers.
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Use the wrapper functions for getting and setting the driver data using
platform_device instead of using dev_{get,set}_drvdata() with &pdev->dev,
so we can directly pass a struct platform_device.

Also, unnecessary dev_set_drvdata() is removed, because the driver core
clears the driver data to NULL after device_release or on probe failure.
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

'hcd' can never be NULL and the spear_ehci_hcd_drv_remove routine
will never be called in_interrupt. Hence remove these checks.
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Cc: Viresh Kumar <viresh.kumar@linaro.org>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

When converting this driver to devm_ioremap_resource, the removal of this now
unneeded function has been forgotten.
Signed-off-by: NWolfram Sang <wsa@the-dreams.de>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch is to add a property 'disabled-ports' representing the unused port
of USB3503. USB3503 can support up to 3 USB host port and each ports can be
controlled to be enabled or disabled. Do not describe this property if all
ports must be enabled.

You can represent the ports to disable in the device tree.

	usb3503@08{
		...
		disabled-ports = <2 3>;
		...
	};
Signed-off-by: NDongjin Kim <tobetter@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch is to disable the USB ports unconnected to USB3503. In order to
disable the port, 'port_off_mask' must be set.

* Disable PORT1 only
	.port_off_mask = USB3503_OFF_PORT1;

* Disable PORT1 and PORT3 only
	.port_off_mask = USB3503_OFF_PORT1 | USB3503_OFF_PORT3;

* Enables all ports
	.port_off_mask = 0;
Signed-off-by: NDongjin Kim <tobetter@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

We want these fixes.
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

do_smart_update_queue() is called when an operation (semop,
semctl(SETVAL), semctl(SETALL), ...) modified the array.  It must check
which of the sleeping tasks can proceed.

do_smart_update_queue() missed a few wakeups:
 - if a sleeping complex op was completed, then all per-semaphore queues
   must be scanned - not only those that were modified by *sops
 - if a sleeping simple op proceeded, then the global queue must be
   scanned again

And:
 - the test for "|sops == NULL) before scanning the global queue is not
   required: If the global queue is empty, then it doesn't need to be
   scanned - regardless of the reason for calling do_smart_update_queue()

The patch is not optimized, i.e.  even completing a wait-for-zero
operation causes a rescan.  This is done to keep the patch as simple as
possible.
Signed-off-by: NManfred Spraul <manfred@colorfullife.com>
Acked-by: NDavidlohr Bueso <davidlohr.bueso@hp.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Pull NFS client bugfixes from Trond Myklebust:

 - Stable fix to prevent an rpc_task wakeup race
 - Fix a NFSv4.1 session drain deadlock
 - Fix a NFSv4/v4.1 mount regression when not running rpc.gssd
 - Ensure auth_gss pipe detection works in namespaces
 - Fix SETCLIENTID fallback if rpcsec_gss is not available

* tag 'nfs-for-3.10-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
  NFS: Fix SETCLIENTID fallback if GSS is not available
  SUNRPC: Prevent an rpc_task wakeup race
  NFSv4.1 Fix a pNFS session draining deadlock
  SUNRPC: Convert auth_gss pipe detection to work in namespaces
  SUNRPC: Faster detection if gssd is actually running
  SUNRPC: Fix a bug in gss_create_upcall

Pull amd64 edac fix from Borislav Petkov:
 "A sysfs file permissions correction"

* tag 'edac_fixes_for_3.10' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp:
  amd64_edac: Fix bogus sysfs file permissions

Pull parisc fixes from Helge Deller:
 "This time we made the kernel- and interruption stack allocation
  reentrant which fixed some strange kernel crashes (specifically
  protection ID traps).

  Furthemore this patchset fixes the interrupt stack in UP and SMP
  configurations by using native locking instructions.  And finally
  usage of floating point calculations on parisc were disabled in the
  MPILIB."

* 'parisc-for-3.10' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
  parisc: fix irq stack on UP and SMP
  parisc/superio: Use module_pci_driver to register driver
  parisc: make interrupt and interruption stack allocation reentrant
  parisc: show number of FPE and unaligned access handler calls in /proc/interrupts
  parisc: add additional parisc git tree to MAINTAINERS file
  parisc: use PAGE_SHIFT instead of hardcoded value 12 in pacache.S
  parisc: add rp5470 entry to machine database
  MPILIB: disable usage of floating point registers on parisc

Pull xfs fixes from Ben Myers:
 "Here are fixes for corruption on 512 byte filesystems, a rounding
  error, a use-after-free, some flags to fix lockdep reports, and
  several fixes related to CRCs.  We have a somewhat larger post -rc1
  queue than usual due to fixes related to the CRC feature we merged for
  3.10:

   - Fix for corruption with FSX on 512 byte blocksize filesystems
   - Fix rounding error in xfs_free_file_space
   - Fix use-after-free with extent free intents
   - Add several missing KM_NOFS flags to fix lockdep reports
   - Several fixes for CRC related code"

* tag 'for-linus-v3.10-rc3' of git://oss.sgi.com/xfs/xfs:
  xfs: remote attribute lookups require the value length
  xfs: xfs_attr_shortform_allfit() does not handle attr3 format.
  xfs: xfs_da3_node_read_verify() doesn't handle XFS_ATTR3_LEAF_MAGIC
  xfs: fix missing KM_NOFS tags to keep lockdep happy
  xfs: Don't reference the EFI after it is freed
  xfs: fix rounding in xfs_free_file_space
  xfs: fix sub-page blocksize data integrity writes

Pull bettery fixes from Anton Vorontsov:
 "Last minute one-liners: wrong kfree usage fix, module alias fixup and
  kconfig adjustments"

* tag 'for-v3.10-fixes' of git://git.infradead.org/battery-2.6:
  pm2301_charger: Fix module alias prefix
  wm831x_backup: Fix wrong kfree call for devdata->backup.name
  bq27x00: Fix I2C dependency in KConfig
  lp8788-charger: Fix kconfig dependency

Pull power management and ACPI fixes from Rafael Wysocki:

 - Additional CPU ID for the intel_pstate driver from Dirk Brandewie.

 - More cpufreq fixes related to ARM big.LITTLE support and locking from
   Viresh Kumar.

 - VIA C7 cpufreq build fix from Rafał Bilski.

 - ACPI power management fix making it possible to use device power
   states regardless of the CONFIG_PM setting from Rafael J Wysocki.

 - New ACPI video blacklist item from Bastian Triller.

* tag 'pm+acpi-3.10-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI / video: Add "Asus UL30A" to ACPI video detect blacklist
  cpufreq: arm_big_little_dt: Instantiate as platform_driver
  cpufreq: arm_big_little_dt: Register driver only if DT has valid data
  cpufreq / e_powersaver: Fix linker error when ACPI processor is a module
  cpufreq / intel_pstate: Add additional supported CPU ID
  cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT
  ACPI / PM: Allow device power states to be used for CONFIG_PM unset

Pull slave-dma fixes from Vinod Koul:
 "We have two patches from Andy & Rafael fixing the Lynxpoint dma"

* 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
  ACPI / LPSS: register clock device for Lynxpoint DMA properly
  dma: acpi-dma: parse CSRT to extract additional resources

kcore_vmalloc is in fs/proc/kcore.c and kcore_mem is unused across
the tree. Noticed while grepping the tree for some other kcore stuff.

(score looks pretty unmaintained to me.)
Signed-off-by: NKyle McMartin <kyle@redhat.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Pull ARC fixes from Vineet Gupta:

 - Fallouts/wreckage of Cache Flush optimizations / aliasing dcache
   support

 - Fix for an interesting bug where piped input to grep was getting
   mysteriously clobbered

* tag 'arc-v3.10-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
  ARC: lazy dcache flush broke gdb in non-aliasing configs
  ARC: Use enough bits for determining page's cache color
  ARC: Brown paper bag bug in macro for checking cache color
  ARC: copy_(to|from)_user() to honor usermode-access permissions
  ARC: [mm] Prevent stray dcache lines after__sync_icache_dcach()
  ARC: [TB10x] Remove redundant abilis,simple-pinctrl mechanism

Pull ARM fixes from Russell King:
 "Just three this time, all really quite small"

* 'fixes' of git://git.linaro.org/people/rmk/linux-arm:
  ARM: 7729/1: vfp: ensure VFP_arch is non-zero when VFP is not supported
  ARM: 7727/1: remove the .vm_mm value from gate_vma
  ARM: 7723/1: crypto: sha1-armv4-large.S: fix SP handling