4.19-stable patches

added patches:
	arm64-insn-fix-ldadd-instruction-encoding.patch
	usb-dwc3-reset-num_trbs-after-skipping.patch

diff --git a/queue-4.19/arm64-insn-fix-ldadd-instruction-encoding.patch b/queue-4.19/arm64-insn-fix-ldadd-instruction-encoding.patch
new file mode 100644 (file)
index 0000000..9ec3fc7
--- /dev/null
+++ b/queue-4.19/arm64-insn-fix-ldadd-instruction-encoding.patch
@@ -0,0 +1,45 @@
+From c5e2edeb01ae9ffbdde95bdcdb6d3614ba1eb195 Mon Sep 17 00:00:00 2001
+From: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+Date: Fri, 24 May 2019 13:52:19 +0100
+Subject: arm64: insn: Fix ldadd instruction encoding
+
+From: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+
+commit c5e2edeb01ae9ffbdde95bdcdb6d3614ba1eb195 upstream.
+
+GCC 8.1.0 reports that the ldadd instruction encoding, recently added to
+insn.c, doesn't match the mask and couldn't possibly be identified:
+
+ linux/arch/arm64/include/asm/insn.h: In function 'aarch64_insn_is_ldadd':
+ linux/arch/arm64/include/asm/insn.h:280:257: warning: bitwise comparison always evaluates to false [-Wtautological-compare]
+
+Bits [31:30] normally encode the size of the instruction (1 to 8 bytes)
+and the current instruction value only encodes the 4- and 8-byte
+variants. At the moment only the BPF JIT needs this instruction, and
+doesn't require the 1- and 2-byte variants, but to be consistent with
+our other ldr and str instruction encodings, clear the size field in the
+insn value.
+
+Fixes: 34b8ab091f9ef57a ("bpf, arm64: use more scalable stadd over ldxr / stxr loop in xadd")
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Reported-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/include/asm/insn.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/include/asm/insn.h
++++ b/arch/arm64/include/asm/insn.h
+@@ -272,7 +272,7 @@ __AARCH64_INSN_FUNCS(adrp, 0x9F000000, 0
+ __AARCH64_INSN_FUNCS(prfm,    0x3FC00000, 0x39800000)
+ __AARCH64_INSN_FUNCS(prfm_lit,        0xFF000000, 0xD8000000)
+ __AARCH64_INSN_FUNCS(str_reg, 0x3FE0EC00, 0x38206800)
+-__AARCH64_INSN_FUNCS(ldadd,   0x3F20FC00, 0xB8200000)
++__AARCH64_INSN_FUNCS(ldadd,   0x3F20FC00, 0x38200000)
+ __AARCH64_INSN_FUNCS(ldr_reg, 0x3FE0EC00, 0x38606800)
+ __AARCH64_INSN_FUNCS(ldr_lit, 0xBF000000, 0x18000000)
+ __AARCH64_INSN_FUNCS(ldrsw_lit,       0xFF000000, 0x98000000)

diff --git a/queue-4.19/series b/queue-4.19/series
index 8eb2eb164c37aba4446f02b9e9239c605727fdc6..4576a51919ce16c095349f2c41c42a190cd3e441 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -70,3 +70,5 @@ bpf-arm64-use-more-scalable-stadd-over-ldxr-stxr-loop-in-xadd.patch
 futex-update-comments-and-docs-about-return-values-of-arch-futex-code.patch
 rdma-directly-cast-the-sockaddr-union-to-sockaddr.patch
 tipc-pass-tunnel-dev-as-null-to-udp_tunnel-6-_xmit_skb.patch
+usb-dwc3-reset-num_trbs-after-skipping.patch
+arm64-insn-fix-ldadd-instruction-encoding.patch

diff --git a/queue-4.19/usb-dwc3-reset-num_trbs-after-skipping.patch b/queue-4.19/usb-dwc3-reset-num_trbs-after-skipping.patch
new file mode 100644 (file)
index 0000000..8d6a808
--- /dev/null
+++ b/queue-4.19/usb-dwc3-reset-num_trbs-after-skipping.patch
@@ -0,0 +1,37 @@
+From c7152763f02e05567da27462b2277a554e507c89 Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <thinh.nguyen@synopsys.com>
+Date: Tue, 12 Feb 2019 19:39:27 -0800
+Subject: usb: dwc3: Reset num_trbs after skipping
+
+From: Thinh Nguyen <thinh.nguyen@synopsys.com>
+
+commit c7152763f02e05567da27462b2277a554e507c89 upstream.
+
+Currently req->num_trbs is not reset after the TRBs are skipped and
+processed from the cancelled list. The gadget driver may reuse the
+request with an invalid req->num_trbs, and DWC3 will incorrectly skip
+trbs. To fix this, simply reset req->num_trbs to 0 after skipping
+through all of them.
+
+Fixes: c3acd5901414 ("usb: dwc3: gadget: use num_trbs when skipping TRBs on ->dequeue()")
+Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Cc: Sasha Levin <sashal@kernel.org>
+Cc: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1361,6 +1361,8 @@ static void dwc3_gadget_ep_skip_trbs(str
+               trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+               dwc3_ep_inc_deq(dep);
+       }
++
++      req->num_trbs = 0;
+ }
+ 
+ static void dwc3_gadget_ep_cleanup_cancelled_requests(struct dwc3_ep *dep)