From db8c08794458cf9efabc03ad0ab59ff520415e14 Mon Sep 17 00:00:00 2001
From: "Andrey V. Elsukov" <ae@FreeBSD.org>
Date: Tue, 9 Jul 2013 10:08:13 +0000
Subject: [PATCH] Migrate structs ahstat, espstat, ipcompstat, ipipstat,
 pfkeystat, ipsec4stat, ipsec6stat to PCPU counters.

---
 sys/netipsec/ah_var.h       |  8 +++++---
 sys/netipsec/esp_var.h      | 10 ++++++----
 sys/netipsec/ipcomp_var.h   | 10 ++++++----
 sys/netipsec/ipip_var.h     | 10 ++++++----
 sys/netipsec/ipsec.c        | 30 ++++++++++++++++++------------
 sys/netipsec/ipsec.h        |  8 +++++---
 sys/netipsec/ipsec6.h       |  8 +++++---
 sys/netipsec/keysock.c      |  7 ++++++-
 sys/netipsec/keysock.h      |  8 +++++---
 sys/netipsec/xform_ah.c     | 11 ++++++++---
 sys/netipsec/xform_esp.c    | 12 +++++++++---
 sys/netipsec/xform_ipcomp.c | 21 +++++++++------------
 sys/netipsec/xform_ipip.c   | 12 +++++++++---
 usr.bin/netstat/ipsec.c     |  8 ++++----
 usr.bin/netstat/pfkey.c     |  2 +-
 15 files changed, 102 insertions(+), 63 deletions(-)

diff --git a/sys/netipsec/ah_var.h b/sys/netipsec/ah_var.h
index 96cc271c7576..9b992c07c811 100644
--- a/sys/netipsec/ah_var.h
+++ b/sys/netipsec/ah_var.h
@@ -71,14 +71,16 @@ struct ahstat {
 };
 
 #ifdef _KERNEL
+#include <sys/counter.h>
+
 VNET_DECLARE(int, ah_enable);
 VNET_DECLARE(int, ah_cleartos);
-VNET_DECLARE(struct ahstat, ahstat);
+VNET_PCPUSTAT_DECLARE(struct ahstat, ahstat);
 
-#define	AHSTAT_ADD(name, val)	V_ahstat.name += (val)
+#define	AHSTAT_ADD(name, val)	\
+    VNET_PCPUSTAT_ADD(struct ahstat, ahstat, name , (val))
 #define	AHSTAT_INC(name)	AHSTAT_ADD(name, 1)
 #define	V_ah_enable		VNET(ah_enable)
 #define	V_ah_cleartos		VNET(ah_cleartos)
-#define	V_ahstat		VNET(ahstat)
 #endif /* _KERNEL */
 #endif /*_NETIPSEC_AH_VAR_H_*/
diff --git a/sys/netipsec/esp_var.h b/sys/netipsec/esp_var.h
index 46d45dfef153..482404189036 100644
--- a/sys/netipsec/esp_var.h
+++ b/sys/netipsec/esp_var.h
@@ -72,12 +72,14 @@ struct espstat {
 };
 
 #ifdef _KERNEL
-VNET_DECLARE(int, esp_enable);
-VNET_DECLARE(struct espstat, espstat);
+#include <sys/counter.h>
 
-#define	ESPSTAT_ADD(name, val)	V_espstat.name += (val)
+VNET_DECLARE(int, esp_enable);
+VNET_PCPUSTAT_DECLARE(struct espstat, espstat);
+
+#define	ESPSTAT_ADD(name, val)	\
+    VNET_PCPUSTAT_ADD(struct espstat, espstat, name, (val))
 #define	ESPSTAT_INC(name)	ESPSTAT_ADD(name, 1)
 #define	V_esp_enable	VNET(esp_enable)
-#define	V_espstat	VNET(espstat)
 #endif /* _KERNEL */
 #endif /*_NETIPSEC_ESP_VAR_H_*/
diff --git a/sys/netipsec/ipcomp_var.h b/sys/netipsec/ipcomp_var.h
index fa1f9f13820b..5062c9dddf5a 100644
--- a/sys/netipsec/ipcomp_var.h
+++ b/sys/netipsec/ipcomp_var.h
@@ -64,12 +64,14 @@ struct ipcompstat {
 };
 
 #ifdef _KERNEL
-VNET_DECLARE(int, ipcomp_enable);
-VNET_DECLARE(struct ipcompstat, ipcompstat);
+#include <sys/counter.h>
 
-#define	IPCOMPSTAT_ADD(name, val)	V_ipcompstat.name += (val)
+VNET_DECLARE(int, ipcomp_enable);
+VNET_PCPUSTAT_DECLARE(struct ipcompstat, ipcompstat);
+
+#define	IPCOMPSTAT_ADD(name, val)	\
+    VNET_PCPUSTAT_ADD(struct ipcompstat, ipcompstat, name, (val))
 #define	IPCOMPSTAT_INC(name)		IPCOMPSTAT_ADD(name, 1)
 #define	V_ipcomp_enable		VNET(ipcomp_enable)
-#define	V_ipcompstat		VNET(ipcompstat)
 #endif /* _KERNEL */
 #endif /*_NETIPSEC_IPCOMP_VAR_H_*/
diff --git a/sys/netipsec/ipip_var.h b/sys/netipsec/ipip_var.h
index 2ad2fb1b4674..02420c192e26 100644
--- a/sys/netipsec/ipip_var.h
+++ b/sys/netipsec/ipip_var.h
@@ -58,12 +58,14 @@ struct ipipstat {
 };
 
 #ifdef _KERNEL
-VNET_DECLARE(int, ipip_allow);
-VNET_DECLARE(struct ipipstat, ipipstat);
+#include <sys/counter.h>
 
-#define	IPIPSTAT_ADD(name, val)	V_ipipstat.name += (val)
+VNET_DECLARE(int, ipip_allow);
+VNET_PCPUSTAT_DECLARE(struct ipipstat, ipipstat);
+
+#define	IPIPSTAT_ADD(name, val)	\
+    VNET_PCPUSTAT_ADD(struct ipipstat, ipipstat, name, (val))
 #define	IPIPSTAT_INC(name)	IPIPSTAT_ADD(name, 1)
 #define	V_ipip_allow		VNET(ipip_allow)
-#define	V_ipipstat		VNET(ipipstat)
 #endif /* _KERNEL */
 #endif /* _NETINET_IPIP_H_ */
diff --git a/sys/netipsec/ipsec.c b/sys/netipsec/ipsec.c
index e9e5f7484b84..4a22f3218784 100644
--- a/sys/netipsec/ipsec.c
+++ b/sys/netipsec/ipsec.c
@@ -104,7 +104,13 @@ VNET_DEFINE(int, ipsec_debug) = 0;
 #endif
 
 /* NB: name changed so netstat doesn't use it. */
-VNET_DEFINE(struct ipsecstat, ipsec4stat);
+VNET_PCPUSTAT_DEFINE(struct ipsecstat, ipsec4stat);
+VNET_PCPUSTAT_SYSINIT(ipsec4stat);
+
+#ifdef VIMAGE
+VNET_PCPUSTAT_SYSUNINIT(ipsec4stat);
+#endif /* VIMAGE */
+
 VNET_DEFINE(int, ip4_ah_offsetmask) = 0;	/* maybe IP_DF? */
 /* DF bit on encap. 0: clear 1: set 2: copy */
 VNET_DEFINE(int, ip4_ipsec_dfbit) = 0;
@@ -167,9 +173,8 @@ SYSCTL_VNET_INT(_net_inet_ipsec, IPSECCTL_DEBUG, debug,
 SYSCTL_VNET_INT(_net_inet_ipsec, OID_AUTO, crypto_support,
 	CTLFLAG_RW, &VNET_NAME(crypto_support), 0,
 	"Crypto driver selection.");
-SYSCTL_VNET_STRUCT(_net_inet_ipsec, OID_AUTO, ipsecstats,
-	CTLFLAG_RD, &VNET_NAME(ipsec4stat), ipsecstat,	
-	"IPsec IPv4 statistics.");
+SYSCTL_VNET_PCPUSTAT(_net_inet_ipsec, OID_AUTO, ipsecstats, struct ipsecstat,
+    ipsec4stat, "IPsec IPv4 statistics.");
 
 #ifdef REGRESSION
 /*
@@ -191,7 +196,13 @@ SYSCTL_VNET_INT(_net_inet_ipsec, OID_AUTO, test_integrity,
 #endif
 
 #ifdef INET6 
-VNET_DEFINE(struct ipsecstat, ipsec6stat);
+VNET_PCPUSTAT_DEFINE(struct ipsecstat, ipsec6stat);
+VNET_PCPUSTAT_SYSINIT(ipsec6stat);
+
+#ifdef VIMAGE
+VNET_PCPUSTAT_SYSUNINIT(ipsec6stat);
+#endif /* VIMAGE */
+
 VNET_DEFINE(int, ip6_esp_trans_deflev) = IPSEC_LEVEL_USE;
 VNET_DEFINE(int, ip6_esp_net_deflev) = IPSEC_LEVEL_USE;
 VNET_DEFINE(int, ip6_ah_trans_deflev) = IPSEC_LEVEL_USE;
@@ -201,10 +212,6 @@ VNET_DEFINE(int, ip6_ipsec_ecn) = 0;	/* ECN ignore(-1)/forbidden(0)/allowed(1) *
 SYSCTL_DECL(_net_inet6_ipsec6);
 
 /* net.inet6.ipsec6 */
-#ifdef COMPAT_KAME
-SYSCTL_OID(_net_inet6_ipsec6, IPSECCTL_STATS, stats, CTLFLAG_RD,
-    0, 0, compat_ipsecstats_sysctl, "S", "IPsec IPv6 statistics.");
-#endif /* COMPAT_KAME */
 SYSCTL_VNET_INT(_net_inet6_ipsec6, IPSECCTL_DEF_POLICY, def_policy, CTLFLAG_RW,
 	&VNET_NAME(ip4_def_policy).policy, 0,
 	"IPsec default policy.");
@@ -226,9 +233,8 @@ SYSCTL_VNET_INT(_net_inet6_ipsec6, IPSECCTL_ECN,
 SYSCTL_VNET_INT(_net_inet6_ipsec6, IPSECCTL_DEBUG, debug, CTLFLAG_RW,
 	&VNET_NAME(ipsec_debug), 0,
 	"Enable IPsec debugging output when set.");
-SYSCTL_VNET_STRUCT(_net_inet6_ipsec6, IPSECCTL_STATS,
-	ipsecstats, CTLFLAG_RD, &VNET_NAME(ipsec6stat), ipsecstat,
-	"IPsec IPv6 statistics.");
+SYSCTL_VNET_PCPUSTAT(_net_inet6_ipsec6, IPSECCTL_STATS, ipsecstats,
+    struct ipsecstat, ipsec6stat, "IPsec IPv6 statistics.");
 #endif /* INET6 */
 
 static int ipsec_setspidx_inpcb __P((struct mbuf *, struct inpcb *));
diff --git a/sys/netipsec/ipsec.h b/sys/netipsec/ipsec.h
index 4c198f6a0e54..d5bd4cd554bc 100644
--- a/sys/netipsec/ipsec.h
+++ b/sys/netipsec/ipsec.h
@@ -325,6 +325,8 @@ struct ipsecstat {
 }
 
 #ifdef _KERNEL
+#include <sys/counter.h>
+
 struct ipsec_output_state {
 	struct mbuf *m;
 	struct route *ro;
@@ -347,7 +349,7 @@ VNET_DECLARE(int, ipsec_integrity);
 #define	V_ipsec_integrity	VNET(ipsec_integrity)
 #endif
 
-VNET_DECLARE(struct ipsecstat, ipsec4stat);
+VNET_PCPUSTAT_DECLARE(struct ipsecstat, ipsec4stat);
 VNET_DECLARE(struct secpolicy, ip4_def_policy);
 VNET_DECLARE(int, ip4_esp_trans_deflev);
 VNET_DECLARE(int, ip4_esp_net_deflev);
@@ -359,8 +361,8 @@ VNET_DECLARE(int, ip4_ipsec_ecn);
 VNET_DECLARE(int, ip4_esp_randpad);
 VNET_DECLARE(int, crypto_support);
 
-#define	IPSECSTAT_INC(name)	V_ipsec4stat.name += 1
-#define	V_ipsec4stat		VNET(ipsec4stat)
+#define	IPSECSTAT_INC(name)	\
+    VNET_PCPUSTAT_ADD(struct ipsecstat, ipsec4stat, name, 1)
 #define	V_ip4_def_policy	VNET(ip4_def_policy)
 #define	V_ip4_esp_trans_deflev	VNET(ip4_esp_trans_deflev)
 #define	V_ip4_esp_net_deflev	VNET(ip4_esp_net_deflev)
diff --git a/sys/netipsec/ipsec6.h b/sys/netipsec/ipsec6.h
index 21ec6b364864..ee6dc6a07ab2 100644
--- a/sys/netipsec/ipsec6.h
+++ b/sys/netipsec/ipsec6.h
@@ -41,15 +41,17 @@
 #include <netipsec/keydb.h>
 
 #ifdef _KERNEL
-VNET_DECLARE(struct ipsecstat, ipsec6stat);
+#include <sys/counter.h>
+
+VNET_PCPUSTAT_DECLARE(struct ipsecstat, ipsec6stat);
 VNET_DECLARE(int, ip6_esp_trans_deflev);
 VNET_DECLARE(int, ip6_esp_net_deflev);
 VNET_DECLARE(int, ip6_ah_trans_deflev);
 VNET_DECLARE(int, ip6_ah_net_deflev);
 VNET_DECLARE(int, ip6_ipsec_ecn);
 
-#define	IPSEC6STAT_INC(name)	V_ipsec6stat.name += 1
-#define	V_ipsec6stat		VNET(ipsec6stat)
+#define	IPSEC6STAT_INC(name)	\
+    VNET_PCPUSTAT_ADD(struct ipsecstat, ipsec6stat, name, 1)
 #define	V_ip6_esp_trans_deflev	VNET(ip6_esp_trans_deflev)
 #define	V_ip6_esp_net_deflev	VNET(ip6_esp_net_deflev)
 #define	V_ip6_ah_trans_deflev	VNET(ip6_ah_trans_deflev)
diff --git a/sys/netipsec/keysock.c b/sys/netipsec/keysock.c
index a29d8b02097f..5a6b84a70aff 100644
--- a/sys/netipsec/keysock.c
+++ b/sys/netipsec/keysock.c
@@ -77,7 +77,12 @@ static struct sockaddr key_src = { 2, PF_KEY, };
 
 static int key_sendup0 __P((struct rawcb *, struct mbuf *, int));
 
-VNET_DEFINE(struct pfkeystat, pfkeystat);
+VNET_PCPUSTAT_DEFINE(struct pfkeystat, pfkeystat);
+VNET_PCPUSTAT_SYSINIT(pfkeystat);
+
+#ifdef VIMAGE
+VNET_PCPUSTAT_SYSUNINIT(pfkeystat);
+#endif /* VIMAGE */
 
 /*
  * key_output()
diff --git a/sys/netipsec/keysock.h b/sys/netipsec/keysock.h
index 9479bb1fc02f..e40f9c3405fa 100644
--- a/sys/netipsec/keysock.h
+++ b/sys/netipsec/keysock.h
@@ -63,16 +63,18 @@ struct pfkeystat {
 #define KEY_SENDUP_REGISTERED	2
 
 #ifdef _KERNEL
+#include <sys/counter.h>
+
 struct keycb {
 	struct rawcb kp_raw;	/* rawcb */
 	int kp_promisc;		/* promiscuous mode */
 	int kp_registered;	/* registered socket */
 };
 
-VNET_DECLARE(struct pfkeystat, pfkeystat);
-#define	PFKEYSTAT_ADD(name, val)	V_pfkeystat.name += (val)
+VNET_PCPUSTAT_DECLARE(struct pfkeystat, pfkeystat);
+#define	PFKEYSTAT_ADD(name, val)	\
+    VNET_PCPUSTAT_ADD(struct pfkeystat, pfkeystat, name, (val))
 #define	PFKEYSTAT_INC(name)		PFKEYSTAT_ADD(name, 1)
-#define	V_pfkeystat		VNET(pfkeystat)
 
 extern int key_output(struct mbuf *m, struct socket *so);
 extern int key_usrreq __P((struct socket *,
diff --git a/sys/netipsec/xform_ah.c b/sys/netipsec/xform_ah.c
index 82c9a65a7cc2..3666b541c5a9 100644
--- a/sys/netipsec/xform_ah.c
+++ b/sys/netipsec/xform_ah.c
@@ -89,7 +89,12 @@
 
 VNET_DEFINE(int, ah_enable) = 1;	/* control flow of packets with AH */
 VNET_DEFINE(int, ah_cleartos) = 1;	/* clear ip_tos when doing AH calc */
-VNET_DEFINE(struct ahstat, ahstat);
+VNET_PCPUSTAT_DEFINE(struct ahstat, ahstat);
+VNET_PCPUSTAT_SYSINIT(ahstat);
+
+#ifdef VIMAGE
+VNET_PCPUSTAT_SYSUNINIT(ahstat);
+#endif /* VIMAGE */
 
 #ifdef INET
 SYSCTL_DECL(_net_inet_ah);
@@ -97,8 +102,8 @@ SYSCTL_VNET_INT(_net_inet_ah, OID_AUTO,
 	ah_enable,	CTLFLAG_RW,	&VNET_NAME(ah_enable),	0, "");
 SYSCTL_VNET_INT(_net_inet_ah, OID_AUTO,
 	ah_cleartos,	CTLFLAG_RW,	&VNET_NAME(ah_cleartos), 0, "");
-SYSCTL_VNET_STRUCT(_net_inet_ah, IPSECCTL_STATS,
-	stats,		CTLFLAG_RD,	&VNET_NAME(ahstat), ahstat, "");
+SYSCTL_VNET_PCPUSTAT(_net_inet_ah, IPSECCTL_STATS, stats, struct ahstat,
+    ahstat, "AH statistics (struct ahstat, netipsec/ah_var.h)");
 #endif
 
 static unsigned char ipseczeroes[256];	/* larger than an ip6 extension hdr */
diff --git a/sys/netipsec/xform_esp.c b/sys/netipsec/xform_esp.c
index 127bbad7c7ef..bb6d1e6c2a5f 100644
--- a/sys/netipsec/xform_esp.c
+++ b/sys/netipsec/xform_esp.c
@@ -77,13 +77,19 @@
 #include <opencrypto/xform.h>
 
 VNET_DEFINE(int, esp_enable) = 1;
-VNET_DEFINE(struct espstat, espstat);
+VNET_PCPUSTAT_DEFINE(struct espstat, espstat);
+VNET_PCPUSTAT_SYSINIT(espstat);
+
+#ifdef VIMAGE
+VNET_PCPUSTAT_SYSUNINIT(espstat);
+#endif /* VIMAGE */
 
 SYSCTL_DECL(_net_inet_esp);
 SYSCTL_VNET_INT(_net_inet_esp, OID_AUTO,
 	esp_enable,	CTLFLAG_RW,	&VNET_NAME(esp_enable),	0, "");
-SYSCTL_VNET_STRUCT(_net_inet_esp, IPSECCTL_STATS,
-	stats,		CTLFLAG_RD,	&VNET_NAME(espstat),	espstat, "");
+SYSCTL_VNET_PCPUSTAT(_net_inet_esp, IPSECCTL_STATS, stats,
+    struct espstat, espstat,
+    "ESP statistics (struct espstat, netipsec/esp_var.h");
 
 static int esp_input_cb(struct cryptop *op);
 static int esp_output_cb(struct cryptop *crp);
diff --git a/sys/netipsec/xform_ipcomp.c b/sys/netipsec/xform_ipcomp.c
index ef248e0079c3..1fa1057572a7 100644
--- a/sys/netipsec/xform_ipcomp.c
+++ b/sys/netipsec/xform_ipcomp.c
@@ -70,13 +70,19 @@
 #include <opencrypto/xform.h>
 
 VNET_DEFINE(int, ipcomp_enable) = 1;
-VNET_DEFINE(struct ipcompstat, ipcompstat);
+VNET_PCPUSTAT_DEFINE(struct ipcompstat, ipcompstat);
+VNET_PCPUSTAT_SYSINIT(ipcompstat);
+
+#ifdef VIMAGE
+VNET_PCPUSTAT_SYSUNINIT(ipcompstat);
+#endif /* VIMAGE */
 
 SYSCTL_DECL(_net_inet_ipcomp);
 SYSCTL_VNET_INT(_net_inet_ipcomp, OID_AUTO,
 	ipcomp_enable,	CTLFLAG_RW,	&VNET_NAME(ipcomp_enable),	0, "");
-SYSCTL_VNET_STRUCT(_net_inet_ipcomp, IPSECCTL_STATS,
-	stats,		CTLFLAG_RD,	&VNET_NAME(ipcompstat),	ipcompstat, "");
+SYSCTL_VNET_PCPUSTAT(_net_inet_ipcomp, IPSECCTL_STATS, stats,
+    struct ipcompstat, ipcompstat,
+    "IPCOMP statistics (struct ipcompstat, netipsec/ipcomp_var.h");
 
 static int ipcomp_input_cb(struct cryptop *crp);
 static int ipcomp_output_cb(struct cryptop *crp);
@@ -631,12 +637,3 @@ ipcomp_attach(void)
 }
 
 SYSINIT(ipcomp_xform_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ipcomp_attach, NULL);
-
-static void
-vnet_ipcomp_attach(const void *unused __unused)
-{
-
-}
-
-VNET_SYSINIT(vnet_ipcomp_xform_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE,
-    vnet_ipcomp_attach, NULL);
diff --git a/sys/netipsec/xform_ipip.c b/sys/netipsec/xform_ipip.c
index 8d00228be697..1d2aff2e4f6c 100644
--- a/sys/netipsec/xform_ipip.c
+++ b/sys/netipsec/xform_ipip.c
@@ -91,13 +91,19 @@
  * net.inet.ipip.allow value.  Zero means drop them, all else is acceptance.
  */
 VNET_DEFINE(int, ipip_allow) = 0;
-VNET_DEFINE(struct ipipstat, ipipstat);
+VNET_PCPUSTAT_DEFINE(struct ipipstat, ipipstat);
+VNET_PCPUSTAT_SYSINIT(ipipstat);
+
+#ifdef VIMAGE
+VNET_PCPUSTAT_SYSUNINIT(ipipstat);
+#endif /* VIMAGE */
 
 SYSCTL_DECL(_net_inet_ipip);
 SYSCTL_VNET_INT(_net_inet_ipip, OID_AUTO,
 	ipip_allow,	CTLFLAG_RW,	&VNET_NAME(ipip_allow),	0, "");
-SYSCTL_VNET_STRUCT(_net_inet_ipip, IPSECCTL_STATS,
-	stats,		CTLFLAG_RD,	&VNET_NAME(ipipstat),	ipipstat, "");
+SYSCTL_VNET_PCPUSTAT(_net_inet_ipip, IPSECCTL_STATS, stats,
+    struct ipipstat, ipipstat,
+    "IPIP statistics (struct ipipstat, netipsec/ipip_var.h)");
 
 /* XXX IPCOMP */
 #define	M_IPSEC	(M_AUTHIPHDR|M_AUTHIPDGM|M_DECRYPTED)
diff --git a/usr.bin/netstat/ipsec.c b/usr.bin/netstat/ipsec.c
index ad3c092aa9ce..2eb8ee0723cb 100644
--- a/usr.bin/netstat/ipsec.c
+++ b/usr.bin/netstat/ipsec.c
@@ -268,7 +268,7 @@ ipsec_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 	if (off == 0)
 		return;
 	printf ("%s:\n", name);
-	kread(off, (char *)&ipsecstat, sizeof(ipsecstat));
+	kread_counters(off, (char *)&ipsecstat, sizeof(ipsecstat));
 
 	print_ipsecstats(&ipsecstat);
 }
@@ -354,7 +354,7 @@ ah_stats(u_long off, const char *name, int family __unused, int proto __unused)
 	if (off == 0)
 		return;
 	printf ("%s:\n", name);
-	kread(off, (char *)&ahstat, sizeof(ahstat));
+	kread_counters(off, (char *)&ahstat, sizeof(ahstat));
 
 	print_ahstats(&ahstat);
 }
@@ -401,7 +401,7 @@ esp_stats(u_long off, const char *name, int family __unused, int proto __unused)
 	if (off == 0)
 		return;
 	printf ("%s:\n", name);
-	kread(off, (char *)&espstat, sizeof(espstat));
+	kread_counters(off, (char *)&espstat, sizeof(espstat));
 
 	print_espstats(&espstat);
 }
@@ -446,7 +446,7 @@ ipcomp_stats(u_long off, const char *name, int family __unused,
 	if (off == 0)
 		return;
 	printf ("%s:\n", name);
-	kread(off, (char *)&ipcompstat, sizeof(ipcompstat));
+	kread_counters(off, (char *)&ipcompstat, sizeof(ipcompstat));
 
 	print_ipcompstats(&ipcompstat);
 }
diff --git a/usr.bin/netstat/pfkey.c b/usr.bin/netstat/pfkey.c
index 0d48e5d87752..da81485fbdcb 100644
--- a/usr.bin/netstat/pfkey.c
+++ b/usr.bin/netstat/pfkey.c
@@ -119,7 +119,7 @@ pfkey_stats(u_long off, const char *name, int family __unused,
 	if (off == 0)
 		return;
 	printf ("%s:\n", name);
-	kread(off, (char *)&pfkeystat, sizeof(pfkeystat));
+	kread_counters(off, (char *)&pfkeystat, sizeof(pfkeystat));
 
 #define	p(f, m) if (pfkeystat.f || sflag <= 1) \
     printf(m, (uintmax_t)pfkeystat.f, plural(pfkeystat.f))