forked from ~ljy/RK356X_SDK_RELEASE

blame | history | patch | commit | commitdiff
hc
2024-01-03 2f7c68cb55ecb7331f2381deb497c27155f32faf 
 kernel/include/net/netfilter/nf_tables.h
....@@ -28,6 +28,16 @@
2828 	struct xt_action_param		xt;
2929 };
3030 
31
+static inline struct sock *nft_sk(const struct nft_pktinfo *pkt)
32
+{
33
+	return pkt->xt.state->sk;
34
+}
35
+
36
+static inline unsigned int nft_thoff(const struct nft_pktinfo *pkt)
37
+{
38
+	return pkt->xt.thoff;
39
+}
40
+
3141 static inline struct net *nft_net(const struct nft_pktinfo *pkt)
3242 {
3343 	return pkt->xt.state->net;
....@@ -205,7 +215,6 @@
205215 }
206216 
207217 int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest);
208
-unsigned int nft_parse_register(const struct nlattr *attr);
209218 int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg);
210219 
211220 int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len);
....@@ -374,7 +383,8 @@
374383 					       const struct nft_set *set,
375384 					       const struct nft_set_elem *elem,
376385 					       unsigned int flags);
377
-
386
+	void				(*commit)(const struct nft_set *set);
387
+	void				(*abort)(const struct nft_set *set);
378388 	u64				(*privsize)(const struct nlattr * const nla[],
379389 						    const struct nft_set_desc *desc);
380390 	bool				(*estimate)(const struct nft_set_desc *desc,
....@@ -383,7 +393,8 @@
383393 	int				(*init)(const struct nft_set *set,
384394 						const struct nft_set_desc *desc,
385395 						const struct nlattr * const nla[]);
386
-	void				(*destroy)(const struct nft_set *set);
396
+	void				(*destroy)(const struct nft_ctx *ctx,
397
+						   const struct nft_set *set);
387398 	void				(*gc_init)(const struct nft_set *set);
388399 
389400 	unsigned int			elemsize;
....@@ -406,6 +417,7 @@
406417  *
407418  *	@list: table set list node
408419  *	@bindings: list of set bindings
420
+ *	@refs: internal refcounting for async set destruction
409421  *	@table: table this set belongs to
410422  *	@net: netnamespace this set belongs to
411423  * 	@name: name of the set
....@@ -427,6 +439,7 @@
427439  *	@expr: stateful expression
428440  * 	@ops: set ops
429441  * 	@flags: set flags
442
+ *	@dead: set will be freed, never cleared
430443  *	@genmask: generation mask
431444  * 	@klen: key length
432445  * 	@dlen: data length
....@@ -435,6 +448,7 @@
435448 struct nft_set {
436449 	struct list_head		list;
437450 	struct list_head		bindings;
451
+	refcount_t			refs;
438452 	struct nft_table		*table;
439453 	possible_net_t			net;
440454 	char				*name;
....@@ -454,9 +468,11 @@
454468 	u16				udlen;
455469 	unsigned char			*udata;
456470 	struct nft_expr			*expr;
471
+	struct list_head		pending_update;
457472 	/* runtime data below here */
458473 	const struct nft_set_ops	*ops ____cacheline_aligned;
459
-	u16				flags:14,
474
+	u16				flags:13,
475
+					dead:1,
460476 					genmask:2;
461477 	u8				klen;
462478 	u8				dlen;
....@@ -472,6 +488,11 @@
472488 static inline void *nft_set_priv(const struct nft_set *set)
473489 {
474490 	return (void *)set->data;
491
+}
492
+
493
+static inline bool nft_set_gc_is_pending(const struct nft_set *s)
494
+{
495
+	return refcount_read(&s->refs) != 1;
475496 }
476497 
477498 static inline struct nft_set *nft_set_container_of(const void *priv)
....@@ -507,6 +528,7 @@
507528 };
508529 
509530 enum nft_trans_phase;
531
+void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set);
510532 void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
511533 			      struct nft_set_binding *binding,
512534 			      enum nft_trans_phase phase);
....@@ -686,62 +708,8 @@
686708 			u64 timeout, u64 expiration, gfp_t gfp);
687709 void nft_set_elem_destroy(const struct nft_set *set, void *elem,
688710 			  bool destroy_expr);
689
-
690
-/**
691
- *	struct nft_set_gc_batch_head - nf_tables set garbage collection batch
692
- *
693
- *	@rcu: rcu head
694
- *	@set: set the elements belong to
695
- *	@cnt: count of elements
696
- */
697
-struct nft_set_gc_batch_head {
698
-	struct rcu_head			rcu;
699
-	const struct nft_set		*set;
700
-	unsigned int			cnt;
701
-};
702
-
703
-#define NFT_SET_GC_BATCH_SIZE	((PAGE_SIZE -				  \
704
-				  sizeof(struct nft_set_gc_batch_head)) / \
705
-				 sizeof(void *))
706
-
707
-/**
708
- *	struct nft_set_gc_batch - nf_tables set garbage collection batch
709
- *
710
- * 	@head: GC batch head
711
- * 	@elems: garbage collection elements
712
- */
713
-struct nft_set_gc_batch {
714
-	struct nft_set_gc_batch_head	head;
715
-	void				*elems[NFT_SET_GC_BATCH_SIZE];
716
-};
717
-
718
-struct nft_set_gc_batch *nft_set_gc_batch_alloc(const struct nft_set *set,
719
-						gfp_t gfp);
720
-void nft_set_gc_batch_release(struct rcu_head *rcu);
721
-
722
-static inline void nft_set_gc_batch_complete(struct nft_set_gc_batch *gcb)
723
-{
724
-	if (gcb != NULL)
725
-		call_rcu(&gcb->head.rcu, nft_set_gc_batch_release);
726
-}
727
-
728
-static inline struct nft_set_gc_batch *
729
-nft_set_gc_batch_check(const struct nft_set *set, struct nft_set_gc_batch *gcb,
730
-		       gfp_t gfp)
731
-{
732
-	if (gcb != NULL) {
733
-		if (gcb->head.cnt + 1 < ARRAY_SIZE(gcb->elems))
734
-			return gcb;
735
-		nft_set_gc_batch_complete(gcb);
736
-	}
737
-	return nft_set_gc_batch_alloc(set, gfp);
738
-}
739
-
740
-static inline void nft_set_gc_batch_add(struct nft_set_gc_batch *gcb,
741
-					void *elem)
742
-{
743
-	gcb->elems[gcb->head.cnt++] = elem;
744
-}
711
+void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
712
+				const struct nft_set *set, void *elem);
745713 
746714 struct nft_expr_ops;
747715 /**
....@@ -777,6 +745,7 @@
777745 
778746 enum nft_trans_phase {
779747 	NFT_TRANS_PREPARE,
748
+	NFT_TRANS_PREPARE_ERROR,
780749 	NFT_TRANS_ABORT,
781750 	NFT_TRANS_COMMIT,
782751 	NFT_TRANS_RELEASE
....@@ -907,7 +876,10 @@
907876 	return (void *)&rule->data[rule->dlen];
908877 }
909878 
910
-void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule);
879
+void nft_rule_expr_activate(const struct nft_ctx *ctx, struct nft_rule *rule);
880
+void nft_rule_expr_deactivate(const struct nft_ctx *ctx, struct nft_rule *rule,
881
+			      enum nft_trans_phase phase);
882
+void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule);
911883 
912884 static inline void nft_set_elem_update_expr(const struct nft_set_ext *ext,
913885 					    struct nft_regs *regs,
....@@ -966,6 +938,8 @@
966938 };
967939 
968940 int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain);
941
+int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain);
942
+void nf_tables_unbind_chain(const struct nft_ctx *ctx, struct nft_chain *chain);
969943 
970944 enum nft_chain_types {
971945 	NFT_CHAIN_T_DEFAULT = 0,
....@@ -1002,11 +976,17 @@
1002976 int nft_chain_validate_hooks(const struct nft_chain *chain,
1003977                              unsigned int hook_flags);
1004978 
979
+static inline bool nft_chain_binding(const struct nft_chain *chain)
980
+{
981
+	return chain->flags & NFT_CHAIN_BINDING;
982
+}
983
+
1005984 static inline bool nft_chain_is_bound(struct nft_chain *chain)
1006985 {
1007986 	return (chain->flags & NFT_CHAIN_BINDING) && chain->bound;
1008987 }
1009988 
989
+int nft_chain_add(struct nft_table *table, struct nft_chain *chain);
1010990 void nft_chain_del(struct nft_chain *chain);
1011991 void nf_tables_chain_destroy(struct nft_ctx *ctx);
1012992 
....@@ -1057,6 +1037,29 @@
10571037 int __nft_release_basechain(struct nft_ctx *ctx);
10581038 
10591039 unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv);
1040
+
1041
+static inline bool nft_use_inc(u32 *use)
1042
+{
1043
+	if (*use == UINT_MAX)
1044
+		return false;
1045
+
1046
+	(*use)++;
1047
+
1048
+	return true;
1049
+}
1050
+
1051
+static inline void nft_use_dec(u32 *use)
1052
+{
1053
+	WARN_ON_ONCE((*use)-- == 0);
1054
+}
1055
+
1056
+/* For error and abort path: restore use counter to previous state. */
1057
+static inline void nft_use_inc_restore(u32 *use)
1058
+{
1059
+	WARN_ON_ONCE(!nft_use_inc(use));
1060
+}
1061
+
1062
+#define nft_use_dec_restore	nft_use_dec
10601063 
10611064 /**
10621065  *	struct nft_table - nf_tables table
....@@ -1135,8 +1138,8 @@
11351138 	struct list_head		list;
11361139 	struct rhlist_head		rhlhead;
11371140 	struct nft_object_hash_key	key;
1138
-	u32				genmask:2,
1139
-					use:30;
1141
+	u32				genmask:2;
1142
+	u32				use;
11401143 	u64				handle;
11411144 	u16				udlen;
11421145 	u8				*udata;
....@@ -1238,8 +1241,8 @@
12381241 	char				*name;
12391242 	int				hooknum;
12401243 	int				ops_len;
1241
-	u32				genmask:2,
1242
-					use:30;
1244
+	u32				genmask:2;
1245
+	u32				use;
12431246 	u64				handle;
12441247 	/* runtime data below here */
12451248 	struct list_head		hook_list ____cacheline_aligned;
....@@ -1375,45 +1378,37 @@
13751378 
13761379 #endif /* IS_ENABLED(CONFIG_NF_TABLES) */
13771380 
1378
-/*
1379
- * We use a free bit in the genmask field to indicate the element
1380
- * is busy, meaning it is currently being processed either by
1381
- * the netlink API or GC.
1382
- *
1383
- * Even though the genmask is only a single byte wide, this works
1384
- * because the extension structure if fully constant once initialized,
1385
- * so there are no non-atomic write accesses unless it is already
1386
- * marked busy.
1387
- */
1388
-#define NFT_SET_ELEM_BUSY_MASK	(1 << 2)
1381
+#define NFT_SET_ELEM_DEAD_MASK	(1 << 2)
13891382 
13901383 #if defined(__LITTLE_ENDIAN_BITFIELD)
1391
-#define NFT_SET_ELEM_BUSY_BIT	2
1384
+#define NFT_SET_ELEM_DEAD_BIT	2
13921385 #elif defined(__BIG_ENDIAN_BITFIELD)
1393
-#define NFT_SET_ELEM_BUSY_BIT	(BITS_PER_LONG - BITS_PER_BYTE + 2)
1386
+#define NFT_SET_ELEM_DEAD_BIT	(BITS_PER_LONG - BITS_PER_BYTE + 2)
13941387 #else
13951388 #error
13961389 #endif
13971390 
1398
-static inline int nft_set_elem_mark_busy(struct nft_set_ext *ext)
1391
+static inline void nft_set_elem_dead(struct nft_set_ext *ext)
13991392 {
14001393 	unsigned long *word = (unsigned long *)ext;
14011394 
14021395 	BUILD_BUG_ON(offsetof(struct nft_set_ext, genmask) != 0);
1403
-	return test_and_set_bit(NFT_SET_ELEM_BUSY_BIT, word);
1396
+	set_bit(NFT_SET_ELEM_DEAD_BIT, word);
14041397 }
14051398 
1406
-static inline void nft_set_elem_clear_busy(struct nft_set_ext *ext)
1399
+static inline int nft_set_elem_is_dead(const struct nft_set_ext *ext)
14071400 {
14081401 	unsigned long *word = (unsigned long *)ext;
14091402 
1410
-	clear_bit(NFT_SET_ELEM_BUSY_BIT, word);
1403
+	BUILD_BUG_ON(offsetof(struct nft_set_ext, genmask) != 0);
1404
+	return test_bit(NFT_SET_ELEM_DEAD_BIT, word);
14111405 }
14121406 
14131407 /**
14141408  *	struct nft_trans - nf_tables object update in transaction
14151409  *
14161410  *	@list: used internally
1411
+ *	@binding_list: list of objects with possible bindings
14171412  *	@msg_type: message type
14181413  *	@put_net: ctx->net needs to be put
14191414  *	@ctx: transaction context
....@@ -1421,6 +1416,7 @@
14211416  */
14221417 struct nft_trans {
14231418 	struct list_head		list;
1419
+	struct list_head		binding_list;
14241420 	int				msg_type;
14251421 	bool				put_net;
14261422 	struct nft_ctx			ctx;
....@@ -1431,6 +1427,7 @@
14311427 	struct nft_rule			*rule;
14321428 	struct nft_flow_rule		*flow;
14331429 	u32				rule_id;
1430
+	bool				bound;
14341431 };
14351432 
14361433 #define nft_trans_rule(trans)	\
....@@ -1439,6 +1436,8 @@
14391436 	(((struct nft_trans_rule *)trans->data)->flow)
14401437 #define nft_trans_rule_id(trans)	\
14411438 	(((struct nft_trans_rule *)trans->data)->rule_id)
1439
+#define nft_trans_rule_bound(trans)	\
1440
+	(((struct nft_trans_rule *)trans->data)->bound)
14421441 
14431442 struct nft_trans_set {
14441443 	struct nft_set			*set;
....@@ -1454,13 +1453,17 @@
14541453 	(((struct nft_trans_set *)trans->data)->bound)
14551454 
14561455 struct nft_trans_chain {
1456
+	struct nft_chain		*chain;
14571457 	bool				update;
14581458 	char				*name;
14591459 	struct nft_stats __percpu	*stats;
14601460 	u8				policy;
1461
+	bool				bound;
14611462 	u32				chain_id;
14621463 };
14631464 
1465
+#define nft_trans_chain(trans)	\
1466
+	(((struct nft_trans_chain *)trans->data)->chain)
14641467 #define nft_trans_chain_update(trans)	\
14651468 	(((struct nft_trans_chain *)trans->data)->update)
14661469 #define nft_trans_chain_name(trans)	\
....@@ -1469,6 +1472,8 @@
14691472 	(((struct nft_trans_chain *)trans->data)->stats)
14701473 #define nft_trans_chain_policy(trans)	\
14711474 	(((struct nft_trans_chain *)trans->data)->policy)
1475
+#define nft_trans_chain_bound(trans)	\
1476
+	(((struct nft_trans_chain *)trans->data)->bound)
14721477 #define nft_trans_chain_id(trans)	\
14731478 	(((struct nft_trans_chain *)trans->data)->chain_id)
14741479 
....@@ -1524,6 +1529,35 @@
15241529 #define nft_trans_flowtable_flags(trans)	\
15251530 	(((struct nft_trans_flowtable *)trans->data)->flags)
15261531 
1532
+#define NFT_TRANS_GC_BATCHCOUNT		256
1533
+
1534
+struct nft_trans_gc {
1535
+	struct list_head	list;
1536
+	struct net		*net;
1537
+	struct nft_set		*set;
1538
+	u32			seq;
1539
+	u16			count;
1540
+	void			*priv[NFT_TRANS_GC_BATCHCOUNT];
1541
+	struct rcu_head		rcu;
1542
+};
1543
+
1544
+struct nft_trans_gc *nft_trans_gc_alloc(struct nft_set *set,
1545
+					unsigned int gc_seq, gfp_t gfp);
1546
+void nft_trans_gc_destroy(struct nft_trans_gc *trans);
1547
+
1548
+struct nft_trans_gc *nft_trans_gc_queue_async(struct nft_trans_gc *gc,
1549
+					      unsigned int gc_seq, gfp_t gfp);
1550
+void nft_trans_gc_queue_async_done(struct nft_trans_gc *gc);
1551
+
1552
+struct nft_trans_gc *nft_trans_gc_queue_sync(struct nft_trans_gc *gc, gfp_t gfp);
1553
+void nft_trans_gc_queue_sync_done(struct nft_trans_gc *trans);
1554
+
1555
+void nft_trans_gc_elem_add(struct nft_trans_gc *gc, void *priv);
1556
+
1557
+void nft_setelem_data_deactivate(const struct net *net,
1558
+				 const struct nft_set *set,
1559
+				 struct nft_set_elem *elem);
1560
+
15271561 int __init nft_chain_filter_init(void);
15281562 void nft_chain_filter_fini(void);
15291563 
....@@ -1535,4 +1569,16 @@
15351569 int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result);
15361570 __be64 nf_jiffies64_to_msecs(u64 input);
15371571 
1572
+struct nftables_pernet {
1573
+	struct list_head	tables;
1574
+	struct list_head	commit_list;
1575
+	struct list_head	binding_list;
1576
+	struct list_head	module_list;
1577
+	struct list_head	notify_list;
1578
+	struct mutex		commit_mutex;
1579
+	unsigned int		base_seq;
1580
+	u8			validate_state;
1581
+	unsigned int		gc_seq;
1582
+};
1583
+
15381584 #endif /* _NET_NF_TABLES_H */