1 /* SPDX-License-Identifier: GPL-2.0 */
2 #include <linux/init.h>
3 #include <linux/module.h>
4 #include <linux/netfilter.h>
5 #include <net/flow_offload.h>
6 #include <net/netfilter/nf_tables.h>
7 #include <net/netfilter/nf_tables_offload.h>
8 #include <net/pkt_cls.h>
9
nft_flow_rule_alloc(int num_actions)10 static struct nft_flow_rule *nft_flow_rule_alloc(int num_actions)
11 {
12 struct nft_flow_rule *flow;
13
14 flow = kzalloc(sizeof(struct nft_flow_rule), GFP_KERNEL);
15 if (!flow)
16 return NULL;
17
18 flow->rule = flow_rule_alloc(num_actions);
19 if (!flow->rule) {
20 kfree(flow);
21 return NULL;
22 }
23
24 flow->rule->match.dissector = &flow->match.dissector;
25 flow->rule->match.mask = &flow->match.mask;
26 flow->rule->match.key = &flow->match.key;
27
28 return flow;
29 }
30
nft_flow_rule_set_addr_type(struct nft_flow_rule * flow,enum flow_dissector_key_id addr_type)31 void nft_flow_rule_set_addr_type(struct nft_flow_rule *flow,
32 enum flow_dissector_key_id addr_type)
33 {
34 struct nft_flow_match *match = &flow->match;
35 struct nft_flow_key *mask = &match->mask;
36 struct nft_flow_key *key = &match->key;
37
38 if (match->dissector.used_keys & BIT(FLOW_DISSECTOR_KEY_CONTROL))
39 return;
40
41 key->control.addr_type = addr_type;
42 mask->control.addr_type = 0xffff;
43 match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_CONTROL);
44 match->dissector.offset[FLOW_DISSECTOR_KEY_CONTROL] =
45 offsetof(struct nft_flow_key, control);
46 }
47
48 struct nft_offload_ethertype {
49 __be16 value;
50 __be16 mask;
51 };
52
nft_flow_rule_transfer_vlan(struct nft_offload_ctx * ctx,struct nft_flow_rule * flow)53 static void nft_flow_rule_transfer_vlan(struct nft_offload_ctx *ctx,
54 struct nft_flow_rule *flow)
55 {
56 struct nft_flow_match *match = &flow->match;
57 struct nft_offload_ethertype ethertype = {
58 .value = match->key.basic.n_proto,
59 .mask = match->mask.basic.n_proto,
60 };
61
62 if (match->dissector.used_keys & BIT(FLOW_DISSECTOR_KEY_VLAN) &&
63 (match->key.vlan.vlan_tpid == htons(ETH_P_8021Q) ||
64 match->key.vlan.vlan_tpid == htons(ETH_P_8021AD))) {
65 match->key.basic.n_proto = match->key.cvlan.vlan_tpid;
66 match->mask.basic.n_proto = match->mask.cvlan.vlan_tpid;
67 match->key.cvlan.vlan_tpid = match->key.vlan.vlan_tpid;
68 match->mask.cvlan.vlan_tpid = match->mask.vlan.vlan_tpid;
69 match->key.vlan.vlan_tpid = ethertype.value;
70 match->mask.vlan.vlan_tpid = ethertype.mask;
71 match->dissector.offset[FLOW_DISSECTOR_KEY_CVLAN] =
72 offsetof(struct nft_flow_key, cvlan);
73 match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_CVLAN);
74 } else if (match->dissector.used_keys & BIT(FLOW_DISSECTOR_KEY_BASIC) &&
75 (match->key.basic.n_proto == htons(ETH_P_8021Q) ||
76 match->key.basic.n_proto == htons(ETH_P_8021AD))) {
77 match->key.basic.n_proto = match->key.vlan.vlan_tpid;
78 match->mask.basic.n_proto = match->mask.vlan.vlan_tpid;
79 match->key.vlan.vlan_tpid = ethertype.value;
80 match->mask.vlan.vlan_tpid = ethertype.mask;
81 match->dissector.offset[FLOW_DISSECTOR_KEY_VLAN] =
82 offsetof(struct nft_flow_key, vlan);
83 match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_VLAN);
84 }
85 }
86
nft_flow_rule_create(struct net * net,const struct nft_rule * rule)87 struct nft_flow_rule *nft_flow_rule_create(struct net *net,
88 const struct nft_rule *rule)
89 {
90 struct nft_offload_ctx *ctx;
91 struct nft_flow_rule *flow;
92 int num_actions = 0, err;
93 struct nft_expr *expr;
94
95 expr = nft_expr_first(rule);
96 while (nft_expr_more(rule, expr)) {
97 if (expr->ops->offload_action &&
98 expr->ops->offload_action(expr))
99 num_actions++;
100
101 expr = nft_expr_next(expr);
102 }
103
104 if (num_actions == 0)
105 return ERR_PTR(-EOPNOTSUPP);
106
107 flow = nft_flow_rule_alloc(num_actions);
108 if (!flow)
109 return ERR_PTR(-ENOMEM);
110
111 expr = nft_expr_first(rule);
112
113 ctx = kzalloc(sizeof(struct nft_offload_ctx), GFP_KERNEL);
114 if (!ctx) {
115 err = -ENOMEM;
116 goto err_out;
117 }
118 ctx->net = net;
119 ctx->dep.type = NFT_OFFLOAD_DEP_UNSPEC;
120
121 while (nft_expr_more(rule, expr)) {
122 if (!expr->ops->offload) {
123 err = -EOPNOTSUPP;
124 goto err_out;
125 }
126 err = expr->ops->offload(ctx, flow, expr);
127 if (err < 0)
128 goto err_out;
129
130 expr = nft_expr_next(expr);
131 }
132 nft_flow_rule_transfer_vlan(ctx, flow);
133
134 flow->proto = ctx->dep.l3num;
135 kfree(ctx);
136
137 return flow;
138 err_out:
139 kfree(ctx);
140 nft_flow_rule_destroy(flow);
141
142 return ERR_PTR(err);
143 }
144
nft_flow_rule_destroy(struct nft_flow_rule * flow)145 void nft_flow_rule_destroy(struct nft_flow_rule *flow)
146 {
147 struct flow_action_entry *entry;
148 int i;
149
150 flow_action_for_each(i, entry, &flow->rule->action) {
151 switch (entry->id) {
152 case FLOW_ACTION_REDIRECT:
153 case FLOW_ACTION_MIRRED:
154 dev_put(entry->dev);
155 break;
156 default:
157 break;
158 }
159 }
160 kfree(flow->rule);
161 kfree(flow);
162 }
163
nft_offload_set_dependency(struct nft_offload_ctx * ctx,enum nft_offload_dep_type type)164 void nft_offload_set_dependency(struct nft_offload_ctx *ctx,
165 enum nft_offload_dep_type type)
166 {
167 ctx->dep.type = type;
168 }
169
nft_offload_update_dependency(struct nft_offload_ctx * ctx,const void * data,u32 len)170 void nft_offload_update_dependency(struct nft_offload_ctx *ctx,
171 const void *data, u32 len)
172 {
173 switch (ctx->dep.type) {
174 case NFT_OFFLOAD_DEP_NETWORK:
175 WARN_ON(len != sizeof(__u16));
176 memcpy(&ctx->dep.l3num, data, sizeof(__u16));
177 break;
178 case NFT_OFFLOAD_DEP_TRANSPORT:
179 WARN_ON(len != sizeof(__u8));
180 memcpy(&ctx->dep.protonum, data, sizeof(__u8));
181 break;
182 default:
183 break;
184 }
185 ctx->dep.type = NFT_OFFLOAD_DEP_UNSPEC;
186 }
187
nft_flow_offload_common_init(struct flow_cls_common_offload * common,__be16 proto,int priority,struct netlink_ext_ack * extack)188 static void nft_flow_offload_common_init(struct flow_cls_common_offload *common,
189 __be16 proto, int priority,
190 struct netlink_ext_ack *extack)
191 {
192 common->protocol = proto;
193 common->prio = priority;
194 common->extack = extack;
195 }
196
nft_setup_cb_call(enum tc_setup_type type,void * type_data,struct list_head * cb_list)197 static int nft_setup_cb_call(enum tc_setup_type type, void *type_data,
198 struct list_head *cb_list)
199 {
200 struct flow_block_cb *block_cb;
201 int err;
202
203 list_for_each_entry(block_cb, cb_list, list) {
204 err = block_cb->cb(type, type_data, block_cb->cb_priv);
205 if (err < 0)
206 return err;
207 }
208 return 0;
209 }
210
nft_chain_offload_priority(const struct nft_base_chain * basechain)211 static int nft_chain_offload_priority(const struct nft_base_chain *basechain)
212 {
213 if (basechain->ops.priority <= 0 ||
214 basechain->ops.priority > USHRT_MAX)
215 return -1;
216
217 return 0;
218 }
219
nft_chain_offload_support(const struct nft_base_chain * basechain)220 bool nft_chain_offload_support(const struct nft_base_chain *basechain)
221 {
222 struct net_device *dev;
223 struct nft_hook *hook;
224
225 if (nft_chain_offload_priority(basechain) < 0)
226 return false;
227
228 list_for_each_entry(hook, &basechain->hook_list, list) {
229 if (hook->ops.pf != NFPROTO_NETDEV ||
230 hook->ops.hooknum != NF_NETDEV_INGRESS)
231 return false;
232
233 dev = hook->ops.dev;
234 if (!dev->netdev_ops->ndo_setup_tc && !flow_indr_dev_exists())
235 return false;
236 }
237
238 return true;
239 }
240
nft_flow_cls_offload_setup(struct flow_cls_offload * cls_flow,const struct nft_base_chain * basechain,const struct nft_rule * rule,const struct nft_flow_rule * flow,struct netlink_ext_ack * extack,enum flow_cls_command command)241 static void nft_flow_cls_offload_setup(struct flow_cls_offload *cls_flow,
242 const struct nft_base_chain *basechain,
243 const struct nft_rule *rule,
244 const struct nft_flow_rule *flow,
245 struct netlink_ext_ack *extack,
246 enum flow_cls_command command)
247 {
248 __be16 proto = ETH_P_ALL;
249
250 memset(cls_flow, 0, sizeof(*cls_flow));
251
252 if (flow)
253 proto = flow->proto;
254
255 nft_flow_offload_common_init(&cls_flow->common, proto,
256 basechain->ops.priority, extack);
257 cls_flow->command = command;
258 cls_flow->cookie = (unsigned long) rule;
259 if (flow)
260 cls_flow->rule = flow->rule;
261 }
262
nft_flow_offload_rule(struct nft_chain * chain,struct nft_rule * rule,struct nft_flow_rule * flow,enum flow_cls_command command)263 static int nft_flow_offload_rule(struct nft_chain *chain,
264 struct nft_rule *rule,
265 struct nft_flow_rule *flow,
266 enum flow_cls_command command)
267 {
268 struct netlink_ext_ack extack = {};
269 struct flow_cls_offload cls_flow;
270 struct nft_base_chain *basechain;
271
272 if (!nft_is_base_chain(chain))
273 return -EOPNOTSUPP;
274
275 basechain = nft_base_chain(chain);
276 nft_flow_cls_offload_setup(&cls_flow, basechain, rule, flow, &extack,
277 command);
278
279 return nft_setup_cb_call(TC_SETUP_CLSFLOWER, &cls_flow,
280 &basechain->flow_block.cb_list);
281 }
282
nft_flow_offload_bind(struct flow_block_offload * bo,struct nft_base_chain * basechain)283 static int nft_flow_offload_bind(struct flow_block_offload *bo,
284 struct nft_base_chain *basechain)
285 {
286 list_splice(&bo->cb_list, &basechain->flow_block.cb_list);
287 return 0;
288 }
289
nft_flow_offload_unbind(struct flow_block_offload * bo,struct nft_base_chain * basechain)290 static int nft_flow_offload_unbind(struct flow_block_offload *bo,
291 struct nft_base_chain *basechain)
292 {
293 struct flow_block_cb *block_cb, *next;
294 struct flow_cls_offload cls_flow;
295 struct netlink_ext_ack extack;
296 struct nft_chain *chain;
297 struct nft_rule *rule;
298
299 chain = &basechain->chain;
300 list_for_each_entry(rule, &chain->rules, list) {
301 memset(&extack, 0, sizeof(extack));
302 nft_flow_cls_offload_setup(&cls_flow, basechain, rule, NULL,
303 &extack, FLOW_CLS_DESTROY);
304 nft_setup_cb_call(TC_SETUP_CLSFLOWER, &cls_flow, &bo->cb_list);
305 }
306
307 list_for_each_entry_safe(block_cb, next, &bo->cb_list, list) {
308 list_del(&block_cb->list);
309 flow_block_cb_free(block_cb);
310 }
311
312 return 0;
313 }
314
nft_block_setup(struct nft_base_chain * basechain,struct flow_block_offload * bo,enum flow_block_command cmd)315 static int nft_block_setup(struct nft_base_chain *basechain,
316 struct flow_block_offload *bo,
317 enum flow_block_command cmd)
318 {
319 int err;
320
321 switch (cmd) {
322 case FLOW_BLOCK_BIND:
323 err = nft_flow_offload_bind(bo, basechain);
324 break;
325 case FLOW_BLOCK_UNBIND:
326 err = nft_flow_offload_unbind(bo, basechain);
327 break;
328 default:
329 WARN_ON_ONCE(1);
330 err = -EOPNOTSUPP;
331 }
332
333 return err;
334 }
335
nft_flow_block_offload_init(struct flow_block_offload * bo,struct net * net,enum flow_block_command cmd,struct nft_base_chain * basechain,struct netlink_ext_ack * extack)336 static void nft_flow_block_offload_init(struct flow_block_offload *bo,
337 struct net *net,
338 enum flow_block_command cmd,
339 struct nft_base_chain *basechain,
340 struct netlink_ext_ack *extack)
341 {
342 memset(bo, 0, sizeof(*bo));
343 bo->net = net;
344 bo->block = &basechain->flow_block;
345 bo->command = cmd;
346 bo->binder_type = FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS;
347 bo->extack = extack;
348 bo->cb_list_head = &basechain->flow_block.cb_list;
349 INIT_LIST_HEAD(&bo->cb_list);
350 }
351
nft_block_offload_cmd(struct nft_base_chain * chain,struct net_device * dev,enum flow_block_command cmd)352 static int nft_block_offload_cmd(struct nft_base_chain *chain,
353 struct net_device *dev,
354 enum flow_block_command cmd)
355 {
356 struct netlink_ext_ack extack = {};
357 struct flow_block_offload bo;
358 int err;
359
360 nft_flow_block_offload_init(&bo, dev_net(dev), cmd, chain, &extack);
361
362 err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_BLOCK, &bo);
363 if (err < 0)
364 return err;
365
366 return nft_block_setup(chain, &bo, cmd);
367 }
368
nft_indr_block_cleanup(struct flow_block_cb * block_cb)369 static void nft_indr_block_cleanup(struct flow_block_cb *block_cb)
370 {
371 struct nft_base_chain *basechain = block_cb->indr.data;
372 struct net_device *dev = block_cb->indr.dev;
373 struct netlink_ext_ack extack = {};
374 struct net *net = dev_net(dev);
375 struct flow_block_offload bo;
376
377 nft_flow_block_offload_init(&bo, dev_net(dev), FLOW_BLOCK_UNBIND,
378 basechain, &extack);
379 mutex_lock(&net->nft.commit_mutex);
380 list_del(&block_cb->driver_list);
381 list_move(&block_cb->list, &bo.cb_list);
382 nft_flow_offload_unbind(&bo, basechain);
383 mutex_unlock(&net->nft.commit_mutex);
384 }
385
nft_indr_block_offload_cmd(struct nft_base_chain * basechain,struct net_device * dev,enum flow_block_command cmd)386 static int nft_indr_block_offload_cmd(struct nft_base_chain *basechain,
387 struct net_device *dev,
388 enum flow_block_command cmd)
389 {
390 struct netlink_ext_ack extack = {};
391 struct flow_block_offload bo;
392 int err;
393
394 nft_flow_block_offload_init(&bo, dev_net(dev), cmd, basechain, &extack);
395
396 err = flow_indr_dev_setup_offload(dev, NULL, TC_SETUP_BLOCK, basechain, &bo,
397 nft_indr_block_cleanup);
398 if (err < 0)
399 return err;
400
401 if (list_empty(&bo.cb_list))
402 return -EOPNOTSUPP;
403
404 return nft_block_setup(basechain, &bo, cmd);
405 }
406
nft_chain_offload_cmd(struct nft_base_chain * basechain,struct net_device * dev,enum flow_block_command cmd)407 static int nft_chain_offload_cmd(struct nft_base_chain *basechain,
408 struct net_device *dev,
409 enum flow_block_command cmd)
410 {
411 int err;
412
413 if (dev->netdev_ops->ndo_setup_tc)
414 err = nft_block_offload_cmd(basechain, dev, cmd);
415 else
416 err = nft_indr_block_offload_cmd(basechain, dev, cmd);
417
418 return err;
419 }
420
nft_flow_block_chain(struct nft_base_chain * basechain,const struct net_device * this_dev,enum flow_block_command cmd)421 static int nft_flow_block_chain(struct nft_base_chain *basechain,
422 const struct net_device *this_dev,
423 enum flow_block_command cmd)
424 {
425 struct net_device *dev;
426 struct nft_hook *hook;
427 int err, i = 0;
428
429 list_for_each_entry(hook, &basechain->hook_list, list) {
430 dev = hook->ops.dev;
431 if (this_dev && this_dev != dev)
432 continue;
433
434 err = nft_chain_offload_cmd(basechain, dev, cmd);
435 if (err < 0 && cmd == FLOW_BLOCK_BIND) {
436 if (!this_dev)
437 goto err_flow_block;
438
439 return err;
440 }
441 i++;
442 }
443
444 return 0;
445
446 err_flow_block:
447 list_for_each_entry(hook, &basechain->hook_list, list) {
448 if (i-- <= 0)
449 break;
450
451 dev = hook->ops.dev;
452 nft_chain_offload_cmd(basechain, dev, FLOW_BLOCK_UNBIND);
453 }
454 return err;
455 }
456
nft_flow_offload_chain(struct nft_chain * chain,u8 * ppolicy,enum flow_block_command cmd)457 static int nft_flow_offload_chain(struct nft_chain *chain, u8 *ppolicy,
458 enum flow_block_command cmd)
459 {
460 struct nft_base_chain *basechain;
461 u8 policy;
462
463 if (!nft_is_base_chain(chain))
464 return -EOPNOTSUPP;
465
466 basechain = nft_base_chain(chain);
467 policy = ppolicy ? *ppolicy : basechain->policy;
468
469 /* Only default policy to accept is supported for now. */
470 if (cmd == FLOW_BLOCK_BIND && policy == NF_DROP)
471 return -EOPNOTSUPP;
472
473 return nft_flow_block_chain(basechain, NULL, cmd);
474 }
475
nft_flow_rule_offload_abort(struct net * net,struct nft_trans * trans)476 static void nft_flow_rule_offload_abort(struct net *net,
477 struct nft_trans *trans)
478 {
479 int err = 0;
480
481 list_for_each_entry_continue_reverse(trans, &net->nft.commit_list, list) {
482 if (trans->ctx.family != NFPROTO_NETDEV)
483 continue;
484
485 switch (trans->msg_type) {
486 case NFT_MSG_NEWCHAIN:
487 if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) ||
488 nft_trans_chain_update(trans))
489 continue;
490
491 err = nft_flow_offload_chain(trans->ctx.chain, NULL,
492 FLOW_BLOCK_UNBIND);
493 break;
494 case NFT_MSG_DELCHAIN:
495 if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
496 continue;
497
498 err = nft_flow_offload_chain(trans->ctx.chain, NULL,
499 FLOW_BLOCK_BIND);
500 break;
501 case NFT_MSG_NEWRULE:
502 if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
503 continue;
504
505 err = nft_flow_offload_rule(trans->ctx.chain,
506 nft_trans_rule(trans),
507 NULL, FLOW_CLS_DESTROY);
508 break;
509 case NFT_MSG_DELRULE:
510 if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
511 continue;
512
513 err = nft_flow_offload_rule(trans->ctx.chain,
514 nft_trans_rule(trans),
515 nft_trans_flow_rule(trans),
516 FLOW_CLS_REPLACE);
517 break;
518 }
519
520 if (WARN_ON_ONCE(err))
521 break;
522 }
523 }
524
nft_flow_rule_offload_commit(struct net * net)525 int nft_flow_rule_offload_commit(struct net *net)
526 {
527 struct nft_trans *trans;
528 int err = 0;
529 u8 policy;
530
531 list_for_each_entry(trans, &net->nft.commit_list, list) {
532 if (trans->ctx.family != NFPROTO_NETDEV)
533 continue;
534
535 switch (trans->msg_type) {
536 case NFT_MSG_NEWCHAIN:
537 if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) ||
538 nft_trans_chain_update(trans))
539 continue;
540
541 policy = nft_trans_chain_policy(trans);
542 err = nft_flow_offload_chain(trans->ctx.chain, &policy,
543 FLOW_BLOCK_BIND);
544 break;
545 case NFT_MSG_DELCHAIN:
546 if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
547 continue;
548
549 policy = nft_trans_chain_policy(trans);
550 err = nft_flow_offload_chain(trans->ctx.chain, &policy,
551 FLOW_BLOCK_UNBIND);
552 break;
553 case NFT_MSG_NEWRULE:
554 if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
555 continue;
556
557 if (trans->ctx.flags & NLM_F_REPLACE ||
558 !(trans->ctx.flags & NLM_F_APPEND)) {
559 err = -EOPNOTSUPP;
560 break;
561 }
562 err = nft_flow_offload_rule(trans->ctx.chain,
563 nft_trans_rule(trans),
564 nft_trans_flow_rule(trans),
565 FLOW_CLS_REPLACE);
566 break;
567 case NFT_MSG_DELRULE:
568 if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
569 continue;
570
571 err = nft_flow_offload_rule(trans->ctx.chain,
572 nft_trans_rule(trans),
573 NULL, FLOW_CLS_DESTROY);
574 break;
575 }
576
577 if (err) {
578 nft_flow_rule_offload_abort(net, trans);
579 break;
580 }
581 }
582
583 list_for_each_entry(trans, &net->nft.commit_list, list) {
584 if (trans->ctx.family != NFPROTO_NETDEV)
585 continue;
586
587 switch (trans->msg_type) {
588 case NFT_MSG_NEWRULE:
589 case NFT_MSG_DELRULE:
590 if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
591 continue;
592
593 nft_flow_rule_destroy(nft_trans_flow_rule(trans));
594 break;
595 default:
596 break;
597 }
598 }
599
600 return err;
601 }
602
__nft_offload_get_chain(struct net_device * dev)603 static struct nft_chain *__nft_offload_get_chain(struct net_device *dev)
604 {
605 struct nft_base_chain *basechain;
606 struct net *net = dev_net(dev);
607 struct nft_hook *hook, *found;
608 const struct nft_table *table;
609 struct nft_chain *chain;
610
611 list_for_each_entry(table, &net->nft.tables, list) {
612 if (table->family != NFPROTO_NETDEV)
613 continue;
614
615 list_for_each_entry(chain, &table->chains, list) {
616 if (!nft_is_base_chain(chain) ||
617 !(chain->flags & NFT_CHAIN_HW_OFFLOAD))
618 continue;
619
620 found = NULL;
621 basechain = nft_base_chain(chain);
622 list_for_each_entry(hook, &basechain->hook_list, list) {
623 if (hook->ops.dev != dev)
624 continue;
625
626 found = hook;
627 break;
628 }
629 if (!found)
630 continue;
631
632 return chain;
633 }
634 }
635
636 return NULL;
637 }
638
nft_offload_netdev_event(struct notifier_block * this,unsigned long event,void * ptr)639 static int nft_offload_netdev_event(struct notifier_block *this,
640 unsigned long event, void *ptr)
641 {
642 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
643 struct net *net = dev_net(dev);
644 struct nft_chain *chain;
645
646 if (event != NETDEV_UNREGISTER)
647 return NOTIFY_DONE;
648
649 mutex_lock(&net->nft.commit_mutex);
650 chain = __nft_offload_get_chain(dev);
651 if (chain)
652 nft_flow_block_chain(nft_base_chain(chain), dev,
653 FLOW_BLOCK_UNBIND);
654
655 mutex_unlock(&net->nft.commit_mutex);
656
657 return NOTIFY_DONE;
658 }
659
660 static struct notifier_block nft_offload_netdev_notifier = {
661 .notifier_call = nft_offload_netdev_event,
662 };
663
nft_offload_init(void)664 int nft_offload_init(void)
665 {
666 return register_netdevice_notifier(&nft_offload_netdev_notifier);
667 }
668
nft_offload_exit(void)669 void nft_offload_exit(void)
670 {
671 unregister_netdevice_notifier(&nft_offload_netdev_notifier);
672 }
673