net: filter: add vlan tag access

BPF filters lack ability to access skb->vlan_tci

This patch adds two new ancillary accessors :

SKF_AD_VLAN_TAG         (44) mapped to vlan_tx_tag_get(skb)

SKF_AD_VLAN_TAG_PRESENT (48) mapped to vlan_tx_tag_present(skb)

This allows libpcap/tcpdump to use a kernel filter instead of
having to fallback to accept all packets, then filter them in
user space.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Suggested-by: Ani Sinha <ani@aristanetworks.com>
Suggested-by: Daniel Borkmann <danborkmann@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
modified for mako kernel form Linux 3.9+

Signed-off-by: Paul Reioux <reioux@gmail.com>
net/compat.c,linux/filter.h: share compat_sock_fprog
Any other users of bpf_*_filter that take a struct sock_fprog from
userspace will need to be able to also accept a compat_sock_fprog
if the arch supports compat calls.  This change allows the existing
compat_sock_fprog be shared.

Signed-off-by: Will Drewry <wad@chromium.org>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Eric Paris <eparis@redhat.com>

v18: tasered by the apostrophe police
v14: rebase/nochanges
v13: rebase on to 88ebdda
v12: rebase on to linux-next
v11: introduction
Signed-off-by: James Morris <james.l.morris@oracle.com>
ARM: 7421/1: bpf_jit: BPF_S_ANC_ALU_XOR_X support

JIT support for the XOR operation introduced by the commit
ffe06c17afbb.

Signed-off-by: Mircea Gherzan <mgherzan@gmail.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
ARM: net: bpf_jit_32: add XOR instruction for BPF JIT

This patch is a follow-up for patch "filter: add XOR instruction for use
with X/K" that implements BPF ARM JIT parts for the BPF XOR operation.

Signed-off-by: Daniel Borkmann <daniel.borkmann@tik.ee.ethz.ch>
Cc: Mircea Gherzan <mgherzan@gmail.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Acked-by: Mircea Gherzan <mgherzan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ARM: net: bpf_jit_32: add VLAN instructions for BPF JIT

This patch is a follow-up for patch "net: filter: add vlan tag access"
to support the new VLAN_TAG/VLAN_TAG_PRESENT accessors in BPF JIT.

Signed-off-by: Daniel Borkmann <daniel.borkmann@tik.ee.ethz.ch>
Cc: Mircea Gherzan <mgherzan@gmail.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Acked-by: Mircea Gherzan <mgherzan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ARM: 7597/1: net: bpf_jit_32: fix kzalloc gfp/size mismatch.

Official prototype for kzalloc is:

void *kzalloc(size_t, gfp_t);

The ARM bpf_jit code was having the assumption that it was:

void *kzalloc(gfp_t, size);

This was resulting the use of some random GFP flags depending on the
size requested and some random overflows once the really needed size
was more than the value of GFP_KERNEL.

This bug was present since the original inclusion of bpf_jit for ARM
(ddecdfce: ARM: 7259/3: net: JIT compiler for packet filters).

Signed-off-by: Nicolas Schichan <nschichan@freebox.fr>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
ARM: 7598/1: net: bpf_jit_32: fix sp-relative load/stores offsets.

The offset must be multiplied by 4 to be sure to access the correct
32bit word in the stack scratch space.

For instance, a store at scratch memory cell #1 was generating the
following:

st	r4, [sp, #1]

While the correct code for this is:

st	r4, [sp, #4]

To reproduce the bug (assuming your system has a NIC with the mac
address 52:54:00:12:34:56):

echo 0 > /proc/sys/net/core/bpf_jit_enable
tcpdump -ni eth0 "ether[1] + ether[2] - ether[3] * ether[4] - ether[5] \
	== -0x3AA" # this will capture packets as expected

echo 1 > /proc/sys/net/core/bpf_jit_enable
tcpdump -ni eth0 "ether[1] + ether[2] - ether[3] * ether[4] - ether[5] \
	== -0x3AA" # this will not.

This bug was present since the original inclusion of bpf_jit for ARM
(ddecdfce: ARM: 7259/3: net: JIT compiler for packet filters).

Signed-off-by: Nicolas Schichan <nschichan@freebox.fr>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
ARM: net: bpf_jit: fix emit_swap16() for non ARMv6+.

The original code was generating an lsl instructions using the value
of ARM_R8 (skb_headlen, possibly uninitialized if no skb_headlen
access was required) as a shift amount.

Signed-off-by: Nicolas Schichan <nschichan@freebox.fr>
Acked-by: Mircea Gherzan <mgherzan@gmail.com>
Acked-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
ARM:net: an issue for k which is u32, never < 0

  k is u32 which never < 0, need type cast, or cause issue.

Signed-off-by: Chen Gang <gang.chen@asianux.com>
Acked-by: Russell King <rmk+kernel@arm.linux.org.uk>
Acked-by: Mircea Gherzan <mgherzan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
rtc: rtc-pm8xxx: Enable RTC write operation

Enable RTC write operation for the APQ based target where user-space
time-service is disabled.

CRs-Fixed: 467157
Change-Id: I20500866b56d7372feeb629cf9e4e360aa8d4bba
Signed-off-by: Ashay Jaiswal <ashayj@codeaurora.org>

Conflicts:
	arch/arm/mach-msm/board-8064-pmic.c
USB: ci13xxx_udc: Don't free dTD immediately after active bit is cleared

USB controller may access the dTD one more time after clearing the active
bit in token field.  There is a possibility of software freeing it in this
window.  When this happens, USB controller may access incorrect memory and
leads to system level issues.

dTDs are freed when requests are freed by function drivers during
disconnect or unbind.  The above race condition will come into effect only
for zero length packets.  dTDs are dynamically created for sending zero
length packets on IN endpoints.  These dTDs are immediately freed after
active bit is cleared.  Defer this to next dTD completion.  It is safe to
assume that hardware will no longer access the previous dTD when the next
dTD is completed.

Don't allocate/free setup status phase and GET_STATUS data phase requests
dynamically.  Use  one request for both cases and allocate it during bind.

CRs-Fixed: 474557
Change-Id: I5d41c310e1bb35d93b5af7d90a24ce5aab24f5f9
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: ci13xxx_udc patch 2/2
USB: mdm_bridge: Fix a possible freed memory access

When tethered rmnet/dun interface probe is failed, the bridge channel
platform device is removed in error path.  The gadget driver schedule
a work to open the bridge channel in probe.  Cancel this work in remove
before closing the channel.

Cancel any pending work while closing the bridge.  Otherwise there is
a possibility of rx work running in parallel with probe error path.  If
this happens, rx work access already freed memory.

CRs-Fixed: 442119
(cherry picked from commit 50f3815166483c654ebb325c49e50af4e31547da)

Change-Id: I78c2ee04cfd083248127cfd6b9f07994087729ca
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: gadget: u_data_hsic: Cancel pending MDM write work during remove

The HSIC bridge driver removes the data bridge platform device
during subsystem restart.  If gadget driver does not cancel pending
MDM write work, we end up accessing interface structure after it
is unbounded.

CRs-Fixed: 465383
Change-Id: I05fe3e2b625e87137681477aaaf1082ba1b81bae
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: gadget: u_data_hsic: Use GFP_KERNEL where ever possible

The USB requests are allocated using dma pool API.  The dma pool has
limited memory for non-sleeping use case.  The current code does not
free USB requests during subsystem restart.  The requests are freed
only after cable is disconnected.  If subsystem restart happens
multiple  times without disconnecting cable, system may run out of the
dma pool memory.  This is leading to URB submission failures.  Use
GFP_KERNEL where ever possible.

CRs-Fixed: 463423
Change-Id: I0fca533e460e7b4234fe771e048e0e50494cb1da
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: mdm_ctrl_bridge: Do not unlink URB upon cable disconnect

MDM control bridge driver unlinks the pending URBs when control
bridge gets closed as a result of usb cable disconnect. Driver
sends set_control_line_state request to MDM upon bridge close.
Right after sending the setup request driver unlinks the pending
URBs. In case if the URB is unlinked after setup stage is completed,
status stage remains pending. This results in a control transfer
stall. Similarly, when the bridge is reopened as a result of USB
cable plug-in, the interrupt URB is not resubmitted, which can also
lead to a QMI stall since the MDM is waiting indefinitely to send
its response available notification. Fix these two potential stall
conditions by not unlinking URBs upon cable disconnect; this will
allow in-progress control transfers to finish gracefully and will
also allow notification interrupts to always be handled. Unlinking
of the URBs will happen during MDM device disconnect, instead of
upon bridge close.

(cherry picked from commit 77f79575ebe35f2ec329827290e7a67fb0e75286)
CRs-Fixed: 419128,418478

Change-Id: I5474372d832de2fd49f17faf77e7e549e80566ad
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Neha Pandey <nehap@codeaurora.org>
usb: misc: Avoid excessive logging during disconnect

When the device is in the midst of being disconnected, calls to
usb_autopm_get_interface() may fail, and a ERR-level message is
printed. Callers of such I/O functions may repeatedly try calling
again, and could end up flooding the console leading to a watchdog
timeout. Replace these printks with DBG-level messages since the
device disconnection is normal and the errors they indicate are
usually benign.

Change-Id: I03045e866c0b35bd1a698d91c12661c6df660d25
CRs-fixed: 394256
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Neha Pandey <nehap@codeaurora.org>
usb: mdm_bridge: Fix race between disconnect and I/O completion handler

There is a possibility of race between device disconnect and I/O
completion handler. In this case disconnect frees bridge device
memory in thread context and I/O completion handler uses already
freed bridge device memory in interrupt context. Hence allocate
bridge device memory at the time of driver load and free it
during unload. Also, do not anchor interrupt and read urb and
unlink them synchronously to avoid accessing transfer buffers
associated to these urbs when driver disconnect frees them.

Guard the race condition by:-
1) Adding check for usb device disconnect state in the I/O
completion handler to avoid further processing I/O completion.

2) Unlinking tx urbs synchronously since asynchronous unlinking
results in the same race condition.

CRs-Fixed: 447591
Change-Id: Iae4c2a1920c16fcf3e1728144a7cfe6ca66c7705
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

Conflicts:
	drivers/usb/misc/mdm_ctrl_bridge.c
USB: mdm_bridge: Fix control bridge suspend

The current code does not abort suspend when there are pending URBs.
They are simply killed during suspend. This may lead to QMI stall.
Add proper checks to ensure that there is no pending Tx/Rx data
during suspend.  Clear the "SUSPENDED" flag in resume only after
taking out all the URBs from "tx_deferred" anchor.

CRs-Fixed: 451414
Change-Id: Icc48afc5eeedcc126d0ab1bec951bde4a53ac165
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
USB: mdm_bridge: Fix probe error path

The platform device is not unregistered in probe error path.  The
platform device is added again during next probe and it fails.  But
the return value is not checked.  Kernel panic happens when platform
device is removed during disconnect.

CRs-Fixed: 465508
Change-Id: I4db613e72d8b405f10cde0d1335d231cf5079e64
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>

Conflicts:

	drivers/usb/misc/mdm_data_bridge.c
Merge branch 'ck' of github.com:ChangYeoun/Kite2 into ck