These changes are the raw update to linux-4.4.6-rt14. Kernel sources

[kvmfornfv.git] / kernel / include / linux / netfilter / x_tables.h

diff --git a/kernel/include/linux/netfilter/x_tables.h b/kernel/include/linux/netfilter/x_tables.h
index f434fc0..8d8b410 100644 (file)
--- a/kernel/include/linux/netfilter/x_tables.h
+++ b/kernel/include/linux/netfilter/x_tables.h
@@ -3,6 +3,7 @@
 
 
 #include <linux/netdevice.h>
+#include <linux/static_key.h>
 #include <linux/locallock.h>
 #include <uapi/linux/netfilter/x_tables.h>
 
@@ -13,6 +14,7 @@
  * @target:    the target extension
  * @matchinfo: per-match data
  * @targetinfo:        per-target data
+ * @net                network namespace through which the action was invoked
  * @in:                input netdevice
  * @out:       output netdevice
  * @fragoff:   packet is a fragment, this is the data offset
@@ -24,7 +26,6 @@
  * Fields written to by extensions:
  *
  * @hotdrop:   drop packet if we had inspection problems
- * Network namespace obtainable using dev_net(in/out)
  */
 struct xt_action_param {
        union {
@@ -34,6 +35,7 @@ struct xt_action_param {
        union {
                const void *matchinfo, *targinfo;
        };
+       struct net *net;
        const struct net_device *in, *out;
        int fragoff;
        unsigned int thoff;
@@ -63,6 +65,7 @@ struct xt_mtchk_param {
        void *matchinfo;
        unsigned int hook_mask;
        u_int8_t family;
+       bool nft_compat;
 };
 
 /**
@@ -93,6 +96,7 @@ struct xt_tgchk_param {
        void *targinfo;
        unsigned int hook_mask;
        u_int8_t family;
+       bool nft_compat;
 };
 
 /* Target destructor parameters */
@@ -221,15 +225,11 @@ struct xt_table_info {
         * @stacksize jumps (number of user chains) can possibly be made.
         */
        unsigned int stacksize;
-       unsigned int __percpu *stackptr;
        void ***jumpstack;
-       /* ipt_entry tables: one per CPU */
-       /* Note : this field MUST be the last one, see XT_TABLE_INFO_SZ */
-       void *entries[1];
+
+       unsigned char entries[0] __aligned(8);
 };
 
-#define XT_TABLE_INFO_SZ (offsetof(struct xt_table_info, entries) \
-                         + nr_cpu_ids * sizeof(char *))
 int xt_register_target(struct xt_target *target);
 void xt_unregister_target(struct xt_target *target);
 int xt_register_targets(struct xt_target *target, unsigned int n);
@@ -285,6 +285,12 @@ DECLARE_PER_CPU(seqcount_t, xt_recseq);
 
 DECLARE_LOCAL_IRQ_LOCK(xt_write_lock);
 
+/* xt_tee_enabled - true if x_tables needs to handle reentrancy
+ *
+ * Enabled if current ip(6)tables ruleset has at least one -j TEE rule.
+ */
+extern struct static_key xt_tee_enabled;
+
 /**
  * xt_write_recseq_begin - start of a write section
  *
@@ -358,6 +364,57 @@ static inline unsigned long ifname_compare_aligned(const char *_a,
        return ret;
 }
 
+
+/* On SMP, ip(6)t_entry->counters.pcnt holds address of the
+ * real (percpu) counter.  On !SMP, its just the packet count,
+ * so nothing needs to be done there.
+ *
+ * xt_percpu_counter_alloc returns the address of the percpu
+ * counter, or 0 on !SMP. We force an alignment of 16 bytes
+ * so that bytes/packets share a common cache line.
+ *
+ * Hence caller must use IS_ERR_VALUE to check for error, this
+ * allows us to return 0 for single core systems without forcing
+ * callers to deal with SMP vs. NONSMP issues.
+ */
+static inline u64 xt_percpu_counter_alloc(void)
+{
+       if (nr_cpu_ids > 1) {
+               void __percpu *res = __alloc_percpu(sizeof(struct xt_counters),
+                                                   sizeof(struct xt_counters));
+
+               if (res == NULL)
+                       return (u64) -ENOMEM;
+
+               return (u64) (__force unsigned long) res;
+       }
+
+       return 0;
+}
+static inline void xt_percpu_counter_free(u64 pcnt)
+{
+       if (nr_cpu_ids > 1)
+               free_percpu((void __percpu *) (unsigned long) pcnt);
+}
+
+static inline struct xt_counters *
+xt_get_this_cpu_counter(struct xt_counters *cnt)
+{
+       if (nr_cpu_ids > 1)
+               return this_cpu_ptr((void __percpu *) (unsigned long) cnt->pcnt);
+
+       return cnt;
+}
+
+static inline struct xt_counters *
+xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu)
+{
+       if (nr_cpu_ids > 1)
+               return per_cpu_ptr((void __percpu *) (unsigned long) cnt->pcnt, cpu);
+
+       return cnt;
+}
+
 struct nf_hook_ops *xt_hook_link(const struct xt_table *, nf_hookfn *);
 void xt_hook_unlink(const struct xt_table *, struct nf_hook_ops *);