1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net> 4 * 5 * Development of this code funded by Astaro AG (http://www.astaro.com/) 6 */ 7 8 #include <linux/kernel.h> 9 #include <linux/init.h> 10 #include <linux/module.h> 11 #include <linux/seqlock.h> 12 #include <linux/netlink.h> 13 #include <linux/netfilter.h> 14 #include <linux/netfilter/nf_tables.h> 15 #include <net/netfilter/nf_tables.h> 16 #include <net/netfilter/nf_tables_core.h> 17 #include <net/netfilter/nf_tables_offload.h> 18 19 struct nft_counter { 20 s64 bytes; 21 s64 packets; 22 }; 23 24 struct nft_counter_percpu_priv { 25 struct nft_counter __percpu *counter; 26 }; 27 28 static DEFINE_PER_CPU(seqcount_t, nft_counter_seq); 29 30 static inline void nft_counter_do_eval(struct nft_counter_percpu_priv *priv, 31 struct nft_regs *regs, 32 const struct nft_pktinfo *pkt) 33 { 34 struct nft_counter *this_cpu; 35 seqcount_t *myseq; 36 37 local_bh_disable(); 38 this_cpu = this_cpu_ptr(priv->counter); 39 myseq = this_cpu_ptr(&nft_counter_seq); 40 41 write_seqcount_begin(myseq); 42 43 this_cpu->bytes += pkt->skb->len; 44 this_cpu->packets++; 45 46 write_seqcount_end(myseq); 47 local_bh_enable(); 48 } 49 50 static inline void nft_counter_obj_eval(struct nft_object *obj, 51 struct nft_regs *regs, 52 const struct nft_pktinfo *pkt) 53 { 54 struct nft_counter_percpu_priv *priv = nft_obj_data(obj); 55 56 nft_counter_do_eval(priv, regs, pkt); 57 } 58 59 static int nft_counter_do_init(const struct nlattr * const tb[], 60 struct nft_counter_percpu_priv *priv) 61 { 62 struct nft_counter __percpu *cpu_stats; 63 struct nft_counter *this_cpu; 64 65 cpu_stats = alloc_percpu_gfp(struct nft_counter, GFP_KERNEL_ACCOUNT); 66 if (cpu_stats == NULL) 67 return -ENOMEM; 68 69 preempt_disable(); 70 this_cpu = this_cpu_ptr(cpu_stats); 71 if (tb[NFTA_COUNTER_PACKETS]) { 72 this_cpu->packets = 73 be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_PACKETS])); 74 } 75 if (tb[NFTA_COUNTER_BYTES]) { 76 this_cpu->bytes = 77 be64_to_cpu(nla_get_be64(tb[NFTA_COUNTER_BYTES])); 78 } 79 preempt_enable(); 80 priv->counter = cpu_stats; 81 return 0; 82 } 83 84 static int nft_counter_obj_init(const struct nft_ctx *ctx, 85 const struct nlattr * const tb[], 86 struct nft_object *obj) 87 { 88 struct nft_counter_percpu_priv *priv = nft_obj_data(obj); 89 90 return nft_counter_do_init(tb, priv); 91 } 92 93 static void nft_counter_do_destroy(struct nft_counter_percpu_priv *priv) 94 { 95 free_percpu(priv->counter); 96 } 97 98 static void nft_counter_obj_destroy(const struct nft_ctx *ctx, 99 struct nft_object *obj) 100 { 101 struct nft_counter_percpu_priv *priv = nft_obj_data(obj); 102 103 nft_counter_do_destroy(priv); 104 } 105 106 static void nft_counter_reset(struct nft_counter_percpu_priv *priv, 107 struct nft_counter *total) 108 { 109 struct nft_counter *this_cpu; 110 111 local_bh_disable(); 112 this_cpu = this_cpu_ptr(priv->counter); 113 this_cpu->packets -= total->packets; 114 this_cpu->bytes -= total->bytes; 115 local_bh_enable(); 116 } 117 118 static void nft_counter_fetch(struct nft_counter_percpu_priv *priv, 119 struct nft_counter *total) 120 { 121 struct nft_counter *this_cpu; 122 const seqcount_t *myseq; 123 u64 bytes, packets; 124 unsigned int seq; 125 int cpu; 126 127 memset(total, 0, sizeof(*total)); 128 for_each_possible_cpu(cpu) { 129 myseq = per_cpu_ptr(&nft_counter_seq, cpu); 130 this_cpu = per_cpu_ptr(priv->counter, cpu); 131 do { 132 seq = read_seqcount_begin(myseq); 133 bytes = this_cpu->bytes; 134 packets = this_cpu->packets; 135 } while (read_seqcount_retry(myseq, seq)); 136 137 total->bytes += bytes; 138 total->packets += packets; 139 } 140 } 141 142 static int nft_counter_do_dump(struct sk_buff *skb, 143 struct nft_counter_percpu_priv *priv, 144 bool reset) 145 { 146 struct nft_counter total; 147 148 nft_counter_fetch(priv, &total); 149 150 if (nla_put_be64(skb, NFTA_COUNTER_BYTES, cpu_to_be64(total.bytes), 151 NFTA_COUNTER_PAD) || 152 nla_put_be64(skb, NFTA_COUNTER_PACKETS, cpu_to_be64(total.packets), 153 NFTA_COUNTER_PAD)) 154 goto nla_put_failure; 155 156 if (reset) 157 nft_counter_reset(priv, &total); 158 159 return 0; 160 161 nla_put_failure: 162 return -1; 163 } 164 165 static int nft_counter_obj_dump(struct sk_buff *skb, 166 struct nft_object *obj, bool reset) 167 { 168 struct nft_counter_percpu_priv *priv = nft_obj_data(obj); 169 170 return nft_counter_do_dump(skb, priv, reset); 171 } 172 173 static const struct nla_policy nft_counter_policy[NFTA_COUNTER_MAX + 1] = { 174 [NFTA_COUNTER_PACKETS] = { .type = NLA_U64 }, 175 [NFTA_COUNTER_BYTES] = { .type = NLA_U64 }, 176 }; 177 178 struct nft_object_type nft_counter_obj_type; 179 static const struct nft_object_ops nft_counter_obj_ops = { 180 .type = &nft_counter_obj_type, 181 .size = sizeof(struct nft_counter_percpu_priv), 182 .eval = nft_counter_obj_eval, 183 .init = nft_counter_obj_init, 184 .destroy = nft_counter_obj_destroy, 185 .dump = nft_counter_obj_dump, 186 }; 187 188 struct nft_object_type nft_counter_obj_type __read_mostly = { 189 .type = NFT_OBJECT_COUNTER, 190 .ops = &nft_counter_obj_ops, 191 .maxattr = NFTA_COUNTER_MAX, 192 .policy = nft_counter_policy, 193 .owner = THIS_MODULE, 194 }; 195 196 void nft_counter_eval(const struct nft_expr *expr, struct nft_regs *regs, 197 const struct nft_pktinfo *pkt) 198 { 199 struct nft_counter_percpu_priv *priv = nft_expr_priv(expr); 200 201 nft_counter_do_eval(priv, regs, pkt); 202 } 203 204 static int nft_counter_dump(struct sk_buff *skb, 205 const struct nft_expr *expr, bool reset) 206 { 207 struct nft_counter_percpu_priv *priv = nft_expr_priv(expr); 208 209 return nft_counter_do_dump(skb, priv, reset); 210 } 211 212 static int nft_counter_init(const struct nft_ctx *ctx, 213 const struct nft_expr *expr, 214 const struct nlattr * const tb[]) 215 { 216 struct nft_counter_percpu_priv *priv = nft_expr_priv(expr); 217 218 return nft_counter_do_init(tb, priv); 219 } 220 221 static void nft_counter_destroy(const struct nft_ctx *ctx, 222 const struct nft_expr *expr) 223 { 224 struct nft_counter_percpu_priv *priv = nft_expr_priv(expr); 225 226 nft_counter_do_destroy(priv); 227 } 228 229 static int nft_counter_clone(struct nft_expr *dst, const struct nft_expr *src) 230 { 231 struct nft_counter_percpu_priv *priv = nft_expr_priv(src); 232 struct nft_counter_percpu_priv *priv_clone = nft_expr_priv(dst); 233 struct nft_counter __percpu *cpu_stats; 234 struct nft_counter *this_cpu; 235 struct nft_counter total; 236 237 nft_counter_fetch(priv, &total); 238 239 cpu_stats = alloc_percpu_gfp(struct nft_counter, GFP_ATOMIC); 240 if (cpu_stats == NULL) 241 return -ENOMEM; 242 243 preempt_disable(); 244 this_cpu = this_cpu_ptr(cpu_stats); 245 this_cpu->packets = total.packets; 246 this_cpu->bytes = total.bytes; 247 preempt_enable(); 248 249 priv_clone->counter = cpu_stats; 250 return 0; 251 } 252 253 static int nft_counter_offload(struct nft_offload_ctx *ctx, 254 struct nft_flow_rule *flow, 255 const struct nft_expr *expr) 256 { 257 /* No specific offload action is needed, but report success. */ 258 return 0; 259 } 260 261 static void nft_counter_offload_stats(struct nft_expr *expr, 262 const struct flow_stats *stats) 263 { 264 struct nft_counter_percpu_priv *priv = nft_expr_priv(expr); 265 struct nft_counter *this_cpu; 266 seqcount_t *myseq; 267 268 preempt_disable(); 269 this_cpu = this_cpu_ptr(priv->counter); 270 myseq = this_cpu_ptr(&nft_counter_seq); 271 272 write_seqcount_begin(myseq); 273 this_cpu->packets += stats->pkts; 274 this_cpu->bytes += stats->bytes; 275 write_seqcount_end(myseq); 276 preempt_enable(); 277 } 278 279 void nft_counter_init_seqcount(void) 280 { 281 int cpu; 282 283 for_each_possible_cpu(cpu) 284 seqcount_init(per_cpu_ptr(&nft_counter_seq, cpu)); 285 } 286 287 struct nft_expr_type nft_counter_type; 288 static const struct nft_expr_ops nft_counter_ops = { 289 .type = &nft_counter_type, 290 .size = NFT_EXPR_SIZE(sizeof(struct nft_counter_percpu_priv)), 291 .eval = nft_counter_eval, 292 .init = nft_counter_init, 293 .destroy = nft_counter_destroy, 294 .destroy_clone = nft_counter_destroy, 295 .dump = nft_counter_dump, 296 .clone = nft_counter_clone, 297 .reduce = NFT_REDUCE_READONLY, 298 .offload = nft_counter_offload, 299 .offload_stats = nft_counter_offload_stats, 300 }; 301 302 struct nft_expr_type nft_counter_type __read_mostly = { 303 .name = "counter", 304 .ops = &nft_counter_ops, 305 .policy = nft_counter_policy, 306 .maxattr = NFTA_COUNTER_MAX, 307 .flags = NFT_EXPR_STATEFUL, 308 .owner = THIS_MODULE, 309 }; 310