/******************************************************************************
 * callback.h
 *
 * Register guest OS callbacks with Xen.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to
 * deal in the Software without restriction, including without limitation the
 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
 * sell copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 * DEALINGS IN THE SOFTWARE.
 *
 * Copyright (c) 2006, Ian Campbell
 */

#ifndef __XEN_PUBLIC_CALLBACK_H__
#define __XEN_PUBLIC_CALLBACK_H__

#include <xen/interface/xen.h>

/*
 * Prototype for this hypercall is:
 *   long callback_op(int cmd, void *extra_args)
 * @cmd        == CALLBACKOP_??? (callback operation).
 * @extra_args == Operation-specific extra arguments (NULL if none).
 */

/* x86: Callback for event delivery. */
#define CALLBACKTYPE_event                 0

/* x86: Failsafe callback when guest state cannot be restored by Xen. */
#define CALLBACKTYPE_failsafe              1

/* x86/64 hypervisor: Syscall by 64-bit guest app ('64-on-64-on-64'). */
#define CALLBACKTYPE_syscall               2

/*
 * x86/32 hypervisor: Only available on x86/32 when supervisor_mode_kernel
 *     feature is enabled. Do not use this callback type in new code.
 */
#define CALLBACKTYPE_sysenter_deprecated   3

/* x86: Callback for NMI delivery. */
#define CALLBACKTYPE_nmi                   4

/*
 * x86: sysenter is only available as follows:
 * - 32-bit hypervisor: with the supervisor_mode_kernel feature enabled
 * - 64-bit hypervisor: 32-bit guest applications on Intel CPUs
 *                      ('32-on-32-on-64', '32-on-64-on-64')
 *                      [nb. also 64-bit guest applications on Intel CPUs
 *                           ('64-on-64-on-64'), but syscall is preferred]
 */
#define CALLBACKTYPE_sysenter              5

/*
 * x86/64 hypervisor: Syscall by 32-bit guest app on AMD CPUs
 *                    ('32-on-32-on-64', '32-on-64-on-64')
 */
#define CALLBACKTYPE_syscall32             7

/*
 * Disable event deliver during callback? This flag is ignored for event and
 * NMI callbacks: event delivery is unconditionally disabled.
 */
#define _CALLBACKF_mask_events             0
#define CALLBACKF_mask_events              (1U << _CALLBACKF_mask_events)

/*
 * Register a callback.
 */
#define CALLBACKOP_register                0
struct callback_register {
	uint16_t type;
	uint16_t flags;
	xen_callback_t address;
};

/*
 * Unregister a callback.
 *
 * Not all callbacks can be unregistered. -EINVAL will be returned if
 * you attempt to unregister such a callback.
 */
#define CALLBACKOP_unregister              1
struct callback_unregister {
    uint16_t type;
    uint16_t _unused;
};

#endif /* __XEN_PUBLIC_CALLBACK_H__ */
pan></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?h=nds-private-remove&amp;id=5019ab50f26c247abb510a80635b25b64b6c1f4b'>bridge: fdb: converge fdb_delete_by functions into one</a></td><td>Nikolay Aleksandrov</td><td>1</td><td><span class='deletions'>-47</span>/<span class='insertions'>+15</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
We can simplify the logic of entries pointing to the bridge by
converging the fdb_delete_by functions, this would allow us to use the
same function for both cases since the fdb's dst is set to NULL if it is
pointing to the bridge thus we can always check for a port match.

Signed-off-by: Nikolay Aleksandrov &lt;nikolay@cumulusnetworks.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-14 12:41:03 -0500'>2017-02-14</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?h=nds-private-remove&amp;id=410b3d48f5111a28bb8d4c3d3dc5984c1baf7fc9'>bridge: fdb: add proper lock checks in searching functions</a></td><td>Nikolay Aleksandrov</td><td>2</td><td><span class='deletions'>-0</span>/<span class='insertions'>+13</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
In order to avoid new errors add checks to br_fdb_find and fdb_find_rcu
functions. The first requires hash_lock, the second obviously RCU.

Signed-off-by: Nikolay Aleksandrov &lt;nikolay@cumulusnetworks.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-14 12:41:02 -0500'>2017-02-14</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?h=nds-private-remove&amp;id=bfd0aeac52f74bfb44c0974131e44abb33a13e78'>bridge: fdb: converge fdb searching functions into one</a></td><td>Nikolay Aleksandrov</td><td>4</td><td><span class='deletions'>-70</span>/<span class='insertions'>+54</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
Before this patch we had 3 different fdb searching functions which was
confusing. This patch reduces all of them to one - fdb_find_rcu(), and
two flavors: br_fdb_find() which requires hash_lock and br_fdb_find_rcu
which requires RCU. This makes it clear what needs to be used, we also
remove two abusers of __br_fdb_get which called it under hash_lock and
replace them with br_fdb_find().

Signed-off-by: Nikolay Aleksandrov &lt;nikolay@cumulusnetworks.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-14 11:44:14 -0500'>2017-02-14</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?h=nds-private-remove&amp;id=d7cf52c249d7aa797ea27808e1526604309ec142'>sched: Fix accidental removal of errout goto</a></td><td>Jiri Pirko</td><td>1</td><td><span class='deletions'>-0</span>/<span class='insertions'>+1</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
Bring back the goto that was removed by accident.

Reported-by: Colin Ian King &lt;colin.king@canonical.com&gt;
Fixes: 40c81b25b16c ("sched: check negative err value to safe one level of indent")
Signed-off-by: Jiri Pirko &lt;jiri@mellanox.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-13 22:23:39 -0500'>2017-02-13</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?h=nds-private-remove&amp;id=37fabbf4d489cc2e1cbf7cde816d9453a65ddfb7'>net: busy-poll: remove LL_FLUSH_FAILED and LL_FLUSH_BUSY</a></td><td>Eric Dumazet</td><td>1</td><td><span class='deletions'>-3</span>/<span class='insertions'>+0</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
Commit 79e7fff47b7b ("net: remove support for per driver
ndo_busy_poll()") made them obsolete.

Signed-off-by: Eric Dumazet &lt;edumazet@google.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-12 22:11:43 -0500'>2017-02-12</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?h=nds-private-remove&amp;id=7c92d61eca453d5007669e4322dd8e469d443d04'>Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next</a></td><td>David S. Miller</td><td>11</td><td><span class='deletions'>-112</span>/<span class='insertions'>+778</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
Pablo Neira Ayuso says:

====================
Netfilter updates for net-next

The following patchset contains Netfilter updates for your net-next
tree, most relevantly they are:

1) Extend nft_exthdr to allow to match TCP options bitfields, from
   Manuel Messner.

2) Allow to check if IPv6 extension header is present in nf_tables,
   from Phil Sutter.

3) Allow to set and match conntrack zone in nf_tables, patches from
   Florian Westphal.

4) Several patches for the nf_tables set infrastructure, this includes
   cleanup and preparatory patches to add the new bitmap set type.

5) Add optional ruleset generation ID check to nf_tables and allow to
   delete rules that got no public handle yet via NFTA_RULE_ID. These
   patches add the missing kernel infrastructure to support rule
   deletion by description from userspace.

6) Missing NFT_SET_OBJECT flag to select the right backend when sets
   stores an object map.

7) A couple of cleanups for the expectation and SIP helper, from Gao
   feng.
====================

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-12 14:45:14 +0100'>2017-02-12</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?h=nds-private-remove&amp;id=7286ff7fde9f963736c7e575572899d8e16b06b7'>netfilter: nf_tables: honor NFT_SET_OBJECT in set backend selection</a></td><td>Pablo Neira Ayuso</td><td>3</td><td><span class='deletions'>-3</span>/<span class='insertions'>+4</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
Check for NFT_SET_OBJECT feature flag, otherwise we may end up selecting
the wrong set backend.

Signed-off-by: Pablo Neira Ayuso &lt;pablo@netfilter.org&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-12 14:45:13 +0100'>2017-02-12</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?h=nds-private-remove&amp;id=1a94e38d254b3622d5d53f74b3b716b0fcab0ba8'>netfilter: nf_tables: add NFTA_RULE_ID attribute</a></td><td>Pablo Neira Ayuso</td><td>1</td><td><span class='deletions'>-0</span>/<span class='insertions'>+26</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
This new attribute allows us to uniquely identify a rule in transaction.
Robots may trigger an insertion followed by deletion in a batch, in that
scenario we still don't have a public rule handle that we can use to
delete the rule. This is similar to the NFTA_SET_ID attribute that
allows us to refer to an anonymous set from a batch.

Signed-off-by: Pablo Neira Ayuso &lt;pablo@netfilter.org&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-12 14:45:12 +0100'>2017-02-12</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?h=nds-private-remove&amp;id=74e8bcd21c40dbbb3d74fa904536f8a3bddafed3'>netfilter: nf_tables: add check_genid to the nfnetlink subsystem</a></td><td>Pablo Neira Ayuso</td><td>1</td><td><span class='deletions'>-0</span>/<span class='insertions'>+6</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
This patch implements the check generation id as provided by nfnetlink.
This allows us to reject ruleset updates against stale baseline, so
userspace can retry update with a fresh ruleset cache.

Signed-off-by: Pablo Neira Ayuso &lt;pablo@netfilter.org&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-12 14:45:11 +0100'>2017-02-12</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?h=nds-private-remove&amp;id=8c4d4e8b5626fec965fd5034e5bd5e57790f243f'>netfilter: nfnetlink: allow to check for generation ID</a></td><td>Pablo Neira Ayuso</td><td>1</td><td><span class='deletions'>-4</span>/<span class='insertions'>+27</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
This patch allows userspace to specify the generation ID that has been
used to build an incremental batch update.

If userspace specifies the generation ID in the batch message as
attribute, then nfnetlink compares it to the current generation ID so
you make sure that you work against the right baseline. Otherwise, bail
out with ERESTART so userspace knows that its changeset is stale and
needs to respin. Userspace can do this transparently at the cost of
taking slightly more time to refresh caches and rework the changeset.

This check is optional, if there is no NFNL_BATCH_GENID attribute in the
batch begin message, then no check is performed.

Signed-off-by: Pablo Neira Ayuso &lt;pablo@netfilter.org&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-12 14:45:10 +0100'>2017-02-12</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?h=nds-private-remove&amp;id=48656835c0405aa2e6c0d6a4305c77b70758d168'>netfilter: nfnetlink: add nfnetlink_rcv_skb_batch()</a></td><td>Pablo Neira Ayuso</td><td>1</td><td><span class='deletions'>-23</span>/<span class='insertions'>+28</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
Add new nfnetlink_rcv_skb_batch() to wrap initial nfnetlink batch
handling.

Signed-off-by: Pablo Neira Ayuso &lt;pablo@netfilter.org&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-12 14:45:09 +0100'>2017-02-12</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?h=nds-private-remove&amp;id=b745d0358db44ebcef31478314436d6d4ff93bfa'>netfilter: nfnetlink: get rid of u_intX_t types</a></td><td>Pablo Neira Ayuso</td><td>1</td><td><span class='deletions'>-8</span>/<span class='insertions'>+8</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
Use uX types instead.

Signed-off-by: Pablo Neira Ayuso &lt;pablo@netfilter.org&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-12 14:44:08 +0100'>2017-02-12</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?h=nds-private-remove&amp;id=4dee62b1b9b43c9bbf49c93cd114e1bf1334fb6a'>netfilter: nf_ct_expect: nf_ct_expect_insert() returns void</a></td><td>Gao Feng</td><td>1</td><td><span class='deletions'>-5</span>/<span class='insertions'>+3</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
Because nf_ct_expect_insert() always succeeds now, its return value can
be just void instead of int. And remove code that checks for its return
value.

Signed-off-by: Gao Feng &lt;fgao@ikuai8.com&gt;
Signed-off-by: Pablo Neira Ayuso &lt;pablo@netfilter.org&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-12 14:39:06 +0100'>2017-02-12</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?h=nds-private-remove&amp;id=a96e66e702bc615f5927b15c739c91d5098dac59'>netfilter: nf_ct_sip: Use mod_timer_pending()</a></td><td>Gao Feng</td><td>1</td><td><span class='deletions'>-7</span>/<span class='insertions'>+5</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
timer_del() followed by timer_add() can be replaced by
mod_timer_pending().

Signed-off-by: Gao Feng &lt;fgao@ikuai8.com&gt;
Signed-off-by: Pablo Neira Ayuso &lt;pablo@netfilter.org&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-11 21:38:58 -0500'>2017-02-11</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?h=nds-private-remove&amp;id=87b60cfacf9f17cf71933c6e33b66e68160af71d'>net_sched: fix error recovery at qdisc creation</a></td><td>Eric Dumazet</td><td>5</td><td><span class='deletions'>-23</span>/<span class='insertions'>+19</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
Dmitry reported uses after free in qdisc code [1]

The problem here is that ops-&gt;init() can return an error.

qdisc_create_dflt() then call ops-&gt;destroy(),
while qdisc_create() does _not_ call it.

Four qdisc chose to call their own ops-&gt;destroy(), assuming their caller
would not.

This patch makes sure qdisc_create() calls ops-&gt;destroy()
and fixes the four qdisc to avoid double free.

[1]
BUG: KASAN: use-after-free in mq_destroy+0x242/0x290 net/sched/sch_mq.c:33 at addr ffff8801d415d440
Read of size 8 by task syz-executor2/5030
CPU: 0 PID: 5030 Comm: syz-executor2 Not tainted 4.3.5-smp-DEV #119
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000046 ffff8801b435b870 ffffffff81bbbed4 ffff8801db000400
 ffff8801d415d440 ffff8801d415dc40 ffff8801c4988510 ffff8801b435b898
 ffffffff816682b1 ffff8801b435b928 ffff8801d415d440 ffff8801c49880c0
Call Trace:
 [&lt;ffffffff81bbbed4&gt;] __dump_stack lib/dump_stack.c:15 [inline]
 [&lt;ffffffff81bbbed4&gt;] dump_stack+0x6c/0x98 lib/dump_stack.c:51
 [&lt;ffffffff816682b1&gt;] kasan_object_err+0x21/0x70 mm/kasan/report.c:158
 [&lt;ffffffff81668524&gt;] print_address_description mm/kasan/report.c:196 [inline]
 [&lt;ffffffff81668524&gt;] kasan_report_error+0x1b4/0x4b0 mm/kasan/report.c:285
 [&lt;ffffffff81668953&gt;] kasan_report mm/kasan/report.c:305 [inline]
 [&lt;ffffffff81668953&gt;] __asan_report_load8_noabort+0x43/0x50 mm/kasan/report.c:326
 [&lt;ffffffff82527b02&gt;] mq_destroy+0x242/0x290 net/sched/sch_mq.c:33
 [&lt;ffffffff82524bdd&gt;] qdisc_destroy+0x12d/0x290 net/sched/sch_generic.c:953
 [&lt;ffffffff82524e30&gt;] qdisc_create_dflt+0xf0/0x120 net/sched/sch_generic.c:848
 [&lt;ffffffff8252550d&gt;] attach_default_qdiscs net/sched/sch_generic.c:1029 [inline]
 [&lt;ffffffff8252550d&gt;] dev_activate+0x6ad/0x880 net/sched/sch_generic.c:1064
 [&lt;ffffffff824b1db1&gt;] __dev_open+0x221/0x320 net/core/dev.c:1403
 [&lt;ffffffff824b24ce&gt;] __dev_change_flags+0x15e/0x3e0 net/core/dev.c:6858
 [&lt;ffffffff824b27de&gt;] dev_change_flags+0x8e/0x140 net/core/dev.c:6926
 [&lt;ffffffff824f5bf6&gt;] dev_ifsioc+0x446/0x890 net/core/dev_ioctl.c:260
 [&lt;ffffffff824f61fa&gt;] dev_ioctl+0x1ba/0xb80 net/core/dev_ioctl.c:546
 [&lt;ffffffff82430509&gt;] sock_do_ioctl+0x99/0xb0 net/socket.c:879
 [&lt;ffffffff82430d30&gt;] sock_ioctl+0x2a0/0x390 net/socket.c:958
 [&lt;ffffffff816f3b68&gt;] vfs_ioctl fs/ioctl.c:44 [inline]
 [&lt;ffffffff816f3b68&gt;] do_vfs_ioctl+0x8a8/0xe50 fs/ioctl.c:611
 [&lt;ffffffff816f41a4&gt;] SYSC_ioctl fs/ioctl.c:626 [inline]
 [&lt;ffffffff816f41a4&gt;] SyS_ioctl+0x94/0xc0 fs/ioctl.c:617
 [&lt;ffffffff8123e357&gt;] entry_SYSCALL_64_fastpath+0x12/0x17

Signed-off-by: Eric Dumazet &lt;edumazet@google.com&gt;
Reported-by: Dmitry Vyukov &lt;dvyukov@google.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-11 21:25:18 -0500'>2017-02-11</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?h=nds-private-remove&amp;id=c16ec18599c8c1722d476011786fd9e2529888f7'>net: rename dst_neigh_output back to neigh_output</a></td><td>Julian Anastasov</td><td>2</td><td><span class='deletions'>-2</span>/<span class='insertions'>+2</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
After the dst-&gt;pending_confirm flag was removed, we do not
need anymore to provide dst arg to dst_neigh_output.
So, rename it to neigh_output as before commit 5110effee8fd
("net: Do delayed neigh confirmation.").

Signed-off-by: Julian Anastasov &lt;ja@ssi.bg&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>
<tr class='logheader'><td><span title='2017-02-11 02:31:11 -0500'>2017-02-11</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net?h=nds-private-remove&amp;id=35eeacf1820a08305c2b0960febfa190f5a6dd63'>Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net</a></td><td>David S. Miller