1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2008-2009 Patrick McHardy <[email protected]> 4 * 5 * Development of this code funded by Astaro AG (http://www.astaro.com/) 6 */ 7 8 #include <linux/kernel.h> 9 #include <linux/init.h> 10 #include <linux/module.h> 11 #include <linux/seqlock.h> 12 #include <linux/netlink.h> 13 #include <linux/netfilter.h> 14 #include <linux/netfilter/nf_tables.h> 15 #include <net/netfilter/nf_tables.h> 16 #include <net/netfilter/nf_tables_core.h> 17 #include <net/netfilter/nf_tables_offload.h> 18 19 struct nft_counter { 20 s64 bytes; 21 s64 packets; 22 }; 23 24 struct nft_counter_percpu_priv { 25 struct nft_counter __percpu *counter; 26 }; 27 28 static DEFINE_PER_CPU(seqcount_t, nft_counter_seq); 29 30 static inline void nft_counter_do_eval(struct nft_counter_percpu_priv *priv, 31 struct nft_regs *regs, 32 const struct nft_pktinfo *pkt) 33 { 34 struct nft_counter *this_cpu; 35 seqcount_t *myseq; 36 37 local_bh_disable(); 38 this_cpu = this_cpu_ptr(priv->counter); 39 myseq = this_cpu_ptr(&nft_counter_seq); 40 41 write_seqcount_begin(myseq); 42 43 this_cpu->bytes += pkt->skb->len; 44 this_cpu->packets++; 45 46 write_seqcount_end(myseq); 47 local_bh_enable(); 48 } 49 50 static inline void nft_counter_obj_eval(struct nft_object *obj, 51 struct nft_regs *regs, 52 const struct nft_pktinfo *pkt) 53 { 54 struct nft_counter_percpu_priv *priv = nft_obj_data(obj); 55 56 nft_counter_do_eval(priv, regs, pkt); 57 } 58 59 static int nft_counter_do_init(const struct nlattr * const tb[], 60 struct nft_counter_percpu_priv *priv) 61 { 62 struct nft_counter __percpu *cpu_stats; 63 struct nft_counter *this_cpu; 64 65 cpu_stats = alloc_percpu_gfp(struct nft_counter, GFP_KERNEL_ACCOUNT); 66 if (cpu_stats == NULL) 67 return -ENOMEM; 68 69 preempt_disable(); 70 this_cpu = this_cpu_ptr(cpu_stats); 71 if (tb[NFTA_COUNTER_PACKETS]) { 72 this_cpu->packets = 73 be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS])); 74 } 75 if (tb[NFTA_COUNTER_BYTES]) { 76 this_cpu->bytes = 77 be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES])); 78 } 79 preempt_enable(); 80 priv->counter = cpu_stats; 81 return 0; 82 } 83 84 static int nft_counter_obj_init(const struct nft_ctx *ctx, 85 const struct nlattr * const tb[], 86 struct nft_object *obj) 87 { 88 struct nft_counter_percpu_priv *priv = nft_obj_data(obj); 89 90 return nft_counter_do_init(tb, priv); 91 } 92 93 static void nft_counter_do_destroy(struct nft_counter_percpu_priv *priv) 94 { 95 free_percpu(priv->counter); 96 } 97 98 static void nft_counter_obj_destroy(const struct nft_ctx *ctx, 99 struct nft_object *obj) 100 { 101 struct nft_counter_percpu_priv *priv = nft_obj_data(obj); 102 103 nft_counter_do_destroy(priv); 104 } 105 106 static void nft_counter_reset(struct nft_counter_percpu_priv *priv, 107 struct nft_counter *total) 108 { 109 struct nft_counter *this_cpu; 110 seqcount_t *myseq; 111 112 local_bh_disable(); 113 this_cpu = this_cpu_ptr(priv->counter); 114 myseq = this_cpu_ptr(&nft_counter_seq); 115 116 write_seqcount_begin(myseq); 117 this_cpu->packets -= total->packets; 118 this_cpu->bytes -= total->bytes; 119 write_seqcount_end(myseq); 120 local_bh_enable(); 121 } 122 123 static void nft_counter_fetch(struct nft_counter_percpu_priv *priv, 124 struct nft_counter *total) 125 { 126 struct nft_counter *this_cpu; 127 const seqcount_t *myseq; 128 u64 bytes, packets; 129 unsigned int seq; 130 int cpu; 131 132 memset(total, 0, sizeof(*total)); 133 for_each_possible_cpu(cpu) { 134 myseq = per_cpu_ptr(&nft_counter_seq, cpu); 135 this_cpu = per_cpu_ptr(priv->counter, cpu); 136 do { 137 seq = read_seqcount_begin(myseq); 138 bytes = this_cpu->bytes; 139 packets = this_cpu->packets; 140 } while (read_seqcount_retry(myseq, seq)); 141 142 total->bytes += bytes; 143 total->packets += packets; 144 } 145 } 146 147 static int nft_counter_do_dump(struct sk_buff *skb, 148 struct nft_counter_percpu_priv *priv, 149 bool reset) 150 { 151 struct nft_counter total; 152 153 nft_counter_fetch(priv, &total); 154 155 if (nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes), 156 NFTA_COUNTER_PAD) || 157 nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.packets), 158 NFTA_COUNTER_PAD)) 159 goto nla_put_failure; 160 161 if (reset) 162 nft_counter_reset(priv, &total); 163 164 return 0; 165 166 nla_put_failure: 167 return -1; 168 } 169 170 static int nft_counter_obj_dump(struct sk_buff *skb, 171 struct nft_object *obj, bool reset) 172 { 173 struct nft_counter_percpu_priv *priv = nft_obj_data(obj); 174 175 return nft_counter_do_dump(skb, priv, reset); 176 } 177 178 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = { 179 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 }, 180 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 }, 181 }; 182 183 struct nft_object_type nft_counter_obj_type; 184 static const struct nft_object_ops nft_counter_obj_ops = { 185 .type = &nft_counter_obj_type, 186 .size = sizeof(struct nft_counter_percpu_priv), 187 .eval = nft_counter_obj_eval, 188 .init = nft_counter_obj_init, 189 .destroy = nft_counter_obj_destroy, 190 .dump = nft_counter_obj_dump, 191 }; 192 193 struct nft_object_type nft_counter_obj_type __read_mostly = { 194 .type = NFT_OBJECT_COUNTER, 195 .ops = &nft_counter_obj_ops, 196 .maxattr = NFTA_COUNTER_MAX, 197 .policy = nft_counter_policy, 198 .owner = THIS_MODULE, 199 }; 200 201 void nft_counter_eval(const struct nft_expr *expr, struct nft_regs *regs, 202 const struct nft_pktinfo *pkt) 203 { 204 struct nft_counter_percpu_priv *priv = nft_expr_priv(expr); 205 206 nft_counter_do_eval(priv, regs, pkt); 207 } 208 209 static int nft_counter_dump(struct sk_buff *skb, 210 const struct nft_expr *expr, bool reset) 211 { 212 struct nft_counter_percpu_priv *priv = nft_expr_priv(expr); 213 214 return nft_counter_do_dump(skb, priv, reset); 215 } 216 217 static int nft_counter_init(const struct nft_ctx *ctx, 218 const struct nft_expr *expr, 219 const struct nlattr * const tb[]) 220 { 221 struct nft_counter_percpu_priv *priv = nft_expr_priv(expr); 222 223 return nft_counter_do_init(tb, priv); 224 } 225 226 static void nft_counter_destroy(const struct nft_ctx *ctx, 227 const struct nft_expr *expr) 228 { 229 struct nft_counter_percpu_priv *priv = nft_expr_priv(expr); 230 231 nft_counter_do_destroy(priv); 232 } 233 234 static int nft_counter_clone(struct nft_expr *dst, const struct nft_expr *src, gfp_t gfp) 235 { 236 struct nft_counter_percpu_priv *priv = nft_expr_priv(src); 237 struct nft_counter_percpu_priv *priv_clone = nft_expr_priv(dst); 238 struct nft_counter __percpu *cpu_stats; 239 struct nft_counter *this_cpu; 240 struct nft_counter total; 241 242 nft_counter_fetch(priv, &total); 243 244 cpu_stats = alloc_percpu_gfp(struct nft_counter, gfp); 245 if (cpu_stats == NULL) 246 return -ENOMEM; 247 248 preempt_disable(); 249 this_cpu = this_cpu_ptr(cpu_stats); 250 this_cpu->packets = total.packets; 251 this_cpu->bytes = total.bytes; 252 preempt_enable(); 253 254 priv_clone->counter = cpu_stats; 255 return 0; 256 } 257 258 static int nft_counter_offload(struct nft_offload_ctx *ctx, 259 struct nft_flow_rule *flow, 260 const struct nft_expr *expr) 261 { 262 /* No specific offload action is needed, but report success. */ 263 return 0; 264 } 265 266 static void nft_counter_offload_stats(struct nft_expr *expr, 267 const struct flow_stats *stats) 268 { 269 struct nft_counter_percpu_priv *priv = nft_expr_priv(expr); 270 struct nft_counter *this_cpu; 271 seqcount_t *myseq; 272 273 local_bh_disable(); 274 this_cpu = this_cpu_ptr(priv->counter); 275 myseq = this_cpu_ptr(&nft_counter_seq); 276 277 write_seqcount_begin(myseq); 278 this_cpu->packets += stats->pkts; 279 this_cpu->bytes += stats->bytes; 280 write_seqcount_end(myseq); 281 local_bh_enable(); 282 } 283 284 void nft_counter_init_seqcount(void) 285 { 286 int cpu; 287 288 for_each_possible_cpu(cpu) 289 seqcount_init(per_cpu_ptr(&nft_counter_seq, cpu)); 290 } 291 292 struct nft_expr_type nft_counter_type; 293 static const struct nft_expr_ops nft_counter_ops = { 294 .type = &nft_counter_type, 295 .size = NFT_EXPR_SIZE(sizeof(struct nft_counter_percpu_priv)), 296 .eval = nft_counter_eval, 297 .init = nft_counter_init, 298 .destroy = nft_counter_destroy, 299 .destroy_clone = nft_counter_destroy, 300 .dump = nft_counter_dump, 301 .clone = nft_counter_clone, 302 .reduce = NFT_REDUCE_READONLY, 303 .offload = nft_counter_offload, 304 .offload_stats = nft_counter_offload_stats, 305 }; 306 307 struct nft_expr_type nft_counter_type __read_mostly = { 308 .name = "counter", 309 .ops = &nft_counter_ops, 310 .policy = nft_counter_policy, 311 .maxattr = NFTA_COUNTER_MAX, 312 .flags = NFT_EXPR_STATEFUL, 313 .owner = THIS_MODULE, 314 }; 315