linux/net/sched/act_police.c
<<
>>
Prefs
   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 * net/sched/act_police.c       Input police filter
   4 *
   5 * Authors:     Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
   6 *              J Hadi Salim (action changes)
   7 */
   8
   9#include <linux/module.h>
  10#include <linux/types.h>
  11#include <linux/kernel.h>
  12#include <linux/string.h>
  13#include <linux/errno.h>
  14#include <linux/skbuff.h>
  15#include <linux/rtnetlink.h>
  16#include <linux/init.h>
  17#include <linux/slab.h>
  18#include <net/act_api.h>
  19#include <net/netlink.h>
  20#include <net/pkt_cls.h>
  21#include <net/tc_act/tc_police.h>
  22
  23/* Each policer is serialized by its individual spinlock */
  24
  25static unsigned int police_net_id;
  26static struct tc_action_ops act_police_ops;
  27
  28static int tcf_police_walker(struct net *net, struct sk_buff *skb,
  29                                 struct netlink_callback *cb, int type,
  30                                 const struct tc_action_ops *ops,
  31                                 struct netlink_ext_ack *extack)
  32{
  33        struct tc_action_net *tn = net_generic(net, police_net_id);
  34
  35        return tcf_generic_walker(tn, skb, cb, type, ops, extack);
  36}
  37
  38static const struct nla_policy police_policy[TCA_POLICE_MAX + 1] = {
  39        [TCA_POLICE_RATE]       = { .len = TC_RTAB_SIZE },
  40        [TCA_POLICE_PEAKRATE]   = { .len = TC_RTAB_SIZE },
  41        [TCA_POLICE_AVRATE]     = { .type = NLA_U32 },
  42        [TCA_POLICE_RESULT]     = { .type = NLA_U32 },
  43        [TCA_POLICE_RATE64]     = { .type = NLA_U64 },
  44        [TCA_POLICE_PEAKRATE64] = { .type = NLA_U64 },
  45        [TCA_POLICE_PKTRATE64]  = { .type = NLA_U64, .min = 1 },
  46        [TCA_POLICE_PKTBURST64] = { .type = NLA_U64, .min = 1 },
  47};
  48
  49static int tcf_police_init(struct net *net, struct nlattr *nla,
  50                               struct nlattr *est, struct tc_action **a,
  51                               int ovr, int bind, bool rtnl_held,
  52                               struct tcf_proto *tp, u32 flags,
  53                               struct netlink_ext_ack *extack)
  54{
  55        int ret = 0, tcfp_result = TC_ACT_OK, err, size;
  56        struct nlattr *tb[TCA_POLICE_MAX + 1];
  57        struct tcf_chain *goto_ch = NULL;
  58        struct tc_police *parm;
  59        struct tcf_police *police;
  60        struct qdisc_rate_table *R_tab = NULL, *P_tab = NULL;
  61        struct tc_action_net *tn = net_generic(net, police_net_id);
  62        struct tcf_police_params *new;
  63        bool exists = false;
  64        u32 index;
  65        u64 rate64, prate64;
  66        u64 pps, ppsburst;
  67
  68        if (nla == NULL)
  69                return -EINVAL;
  70
  71        err = nla_parse_nested_deprecated(tb, TCA_POLICE_MAX, nla,
  72                                          police_policy, NULL);
  73        if (err < 0)
  74                return err;
  75
  76        if (tb[TCA_POLICE_TBF] == NULL)
  77                return -EINVAL;
  78        size = nla_len(tb[TCA_POLICE_TBF]);
  79        if (size != sizeof(*parm) && size != sizeof(struct tc_police_compat))
  80                return -EINVAL;
  81
  82        parm = nla_data(tb[TCA_POLICE_TBF]);
  83        index = parm->index;
  84        err = tcf_idr_check_alloc(tn, &index, a, bind);
  85        if (err < 0)
  86                return err;
  87        exists = err;
  88        if (exists && bind)
  89                return 0;
  90
  91        if (!exists) {
  92                ret = tcf_idr_create(tn, index, NULL, a,
  93                                     &act_police_ops, bind, true, 0);
  94                if (ret) {
  95                        tcf_idr_cleanup(tn, index);
  96                        return ret;
  97                }
  98                ret = ACT_P_CREATED;
  99                spin_lock_init(&(to_police(*a)->tcfp_lock));
 100        } else if (!ovr) {
 101                tcf_idr_release(*a, bind);
 102                return -EEXIST;
 103        }
 104        err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch, extack);
 105        if (err < 0)
 106                goto release_idr;
 107
 108        police = to_police(*a);
 109        if (parm->rate.rate) {
 110                err = -ENOMEM;
 111                R_tab = qdisc_get_rtab(&parm->rate, tb[TCA_POLICE_RATE], NULL);
 112                if (R_tab == NULL)
 113                        goto failure;
 114
 115                if (parm->peakrate.rate) {
 116                        P_tab = qdisc_get_rtab(&parm->peakrate,
 117                                               tb[TCA_POLICE_PEAKRATE], NULL);
 118                        if (P_tab == NULL)
 119                                goto failure;
 120                }
 121        }
 122
 123        if (est) {
 124                err = gen_replace_estimator(&police->tcf_bstats,
 125                                            police->common.cpu_bstats,
 126                                            &police->tcf_rate_est,
 127                                            &police->tcf_lock,
 128                                            NULL, est);
 129                if (err)
 130                        goto failure;
 131        } else if (tb[TCA_POLICE_AVRATE] &&
 132                   (ret == ACT_P_CREATED ||
 133                    !gen_estimator_active(&police->tcf_rate_est))) {
 134                err = -EINVAL;
 135                goto failure;
 136        }
 137
 138        if (tb[TCA_POLICE_RESULT]) {
 139                tcfp_result = nla_get_u32(tb[TCA_POLICE_RESULT]);
 140                if (TC_ACT_EXT_CMP(tcfp_result, TC_ACT_GOTO_CHAIN)) {
 141                        NL_SET_ERR_MSG(extack,
 142                                       "goto chain not allowed on fallback");
 143                        err = -EINVAL;
 144                        goto failure;
 145                }
 146        }
 147
 148        if ((tb[TCA_POLICE_PKTRATE64] && !tb[TCA_POLICE_PKTBURST64]) ||
 149            (!tb[TCA_POLICE_PKTRATE64] && tb[TCA_POLICE_PKTBURST64])) {
 150                NL_SET_ERR_MSG(extack,
 151                               "Both or neither packet-per-second burst and rate must be provided");
 152                err = -EINVAL;
 153                goto failure;
 154        }
 155
 156        if (tb[TCA_POLICE_PKTRATE64] && R_tab) {
 157                NL_SET_ERR_MSG(extack,
 158                               "packet-per-second and byte-per-second rate limits not allowed in same action");
 159                err = -EINVAL;
 160                goto failure;
 161        }
 162
 163        new = kzalloc(sizeof(*new), GFP_KERNEL);
 164        if (unlikely(!new)) {
 165                err = -ENOMEM;
 166                goto failure;
 167        }
 168
 169        /* No failure allowed after this point */
 170        new->tcfp_result = tcfp_result;
 171        new->tcfp_mtu = parm->mtu;
 172        if (!new->tcfp_mtu) {
 173                new->tcfp_mtu = ~0;
 174                if (R_tab)
 175                        new->tcfp_mtu = 255 << R_tab->rate.cell_log;
 176        }
 177        if (R_tab) {
 178                new->rate_present = true;
 179                rate64 = tb[TCA_POLICE_RATE64] ?
 180                         nla_get_u64(tb[TCA_POLICE_RATE64]) : 0;
 181                psched_ratecfg_precompute(&new->rate, &R_tab->rate, rate64);
 182                qdisc_put_rtab(R_tab);
 183        } else {
 184                new->rate_present = false;
 185        }
 186        if (P_tab) {
 187                new->peak_present = true;
 188                prate64 = tb[TCA_POLICE_PEAKRATE64] ?
 189                          nla_get_u64(tb[TCA_POLICE_PEAKRATE64]) : 0;
 190                psched_ratecfg_precompute(&new->peak, &P_tab->rate, prate64);
 191                qdisc_put_rtab(P_tab);
 192        } else {
 193                new->peak_present = false;
 194        }
 195
 196        new->tcfp_burst = PSCHED_TICKS2NS(parm->burst);
 197        if (new->peak_present)
 198                new->tcfp_mtu_ptoks = (s64)psched_l2t_ns(&new->peak,
 199                                                         new->tcfp_mtu);
 200
 201        if (tb[TCA_POLICE_AVRATE])
 202                new->tcfp_ewma_rate = nla_get_u32(tb[TCA_POLICE_AVRATE]);
 203
 204        if (tb[TCA_POLICE_PKTRATE64]) {
 205                pps = nla_get_u64(tb[TCA_POLICE_PKTRATE64]);
 206                ppsburst = nla_get_u64(tb[TCA_POLICE_PKTBURST64]);
 207                new->pps_present = true;
 208                new->tcfp_pkt_burst = PSCHED_TICKS2NS(ppsburst);
 209                psched_ppscfg_precompute(&new->ppsrate, pps);
 210        }
 211
 212        spin_lock_bh(&police->tcf_lock);
 213        spin_lock_bh(&police->tcfp_lock);
 214        police->tcfp_t_c = ktime_get_ns();
 215        police->tcfp_toks = new->tcfp_burst;
 216        if (new->peak_present)
 217                police->tcfp_ptoks = new->tcfp_mtu_ptoks;
 218        spin_unlock_bh(&police->tcfp_lock);
 219        goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
 220        new = rcu_replace_pointer(police->params,
 221                                  new,
 222                                  lockdep_is_held(&police->tcf_lock));
 223        spin_unlock_bh(&police->tcf_lock);
 224
 225        if (goto_ch)
 226                tcf_chain_put_by_act(goto_ch);
 227        if (new)
 228                kfree_rcu(new, rcu);
 229
 230        return ret;
 231
 232failure:
 233        qdisc_put_rtab(P_tab);
 234        qdisc_put_rtab(R_tab);
 235        if (goto_ch)
 236                tcf_chain_put_by_act(goto_ch);
 237release_idr:
 238        tcf_idr_release(*a, bind);
 239        return err;
 240}
 241
 242static int tcf_police_act(struct sk_buff *skb, const struct tc_action *a,
 243                          struct tcf_result *res)
 244{
 245        struct tcf_police *police = to_police(a);
 246        s64 now, toks, ppstoks = 0, ptoks = 0;
 247        struct tcf_police_params *p;
 248        int ret;
 249
 250        tcf_lastuse_update(&police->tcf_tm);
 251        bstats_cpu_update(this_cpu_ptr(police->common.cpu_bstats), skb);
 252
 253        ret = READ_ONCE(police->tcf_action);
 254        p = rcu_dereference_bh(police->params);
 255
 256        if (p->tcfp_ewma_rate) {
 257                struct gnet_stats_rate_est64 sample;
 258
 259                if (!gen_estimator_read(&police->tcf_rate_est, &sample) ||
 260                    sample.bps >= p->tcfp_ewma_rate)
 261                        goto inc_overlimits;
 262        }
 263
 264        if (qdisc_pkt_len(skb) <= p->tcfp_mtu) {
 265                if (!p->rate_present && !p->pps_present) {
 266                        ret = p->tcfp_result;
 267                        goto end;
 268                }
 269
 270                now = ktime_get_ns();
 271                spin_lock_bh(&police->tcfp_lock);
 272                toks = min_t(s64, now - police->tcfp_t_c, p->tcfp_burst);
 273                if (p->peak_present) {
 274                        ptoks = toks + police->tcfp_ptoks;
 275                        if (ptoks > p->tcfp_mtu_ptoks)
 276                                ptoks = p->tcfp_mtu_ptoks;
 277                        ptoks -= (s64)psched_l2t_ns(&p->peak,
 278                                                    qdisc_pkt_len(skb));
 279                }
 280                if (p->rate_present) {
 281                        toks += police->tcfp_toks;
 282                        if (toks > p->tcfp_burst)
 283                                toks = p->tcfp_burst;
 284                        toks -= (s64)psched_l2t_ns(&p->rate, qdisc_pkt_len(skb));
 285                } else if (p->pps_present) {
 286                        ppstoks = min_t(s64, now - police->tcfp_t_c, p->tcfp_pkt_burst);
 287                        ppstoks += police->tcfp_pkttoks;
 288                        if (ppstoks > p->tcfp_pkt_burst)
 289                                ppstoks = p->tcfp_pkt_burst;
 290                        ppstoks -= (s64)psched_pkt2t_ns(&p->ppsrate, 1);
 291                }
 292                if ((toks | ptoks | ppstoks) >= 0) {
 293                        police->tcfp_t_c = now;
 294                        police->tcfp_toks = toks;
 295                        police->tcfp_ptoks = ptoks;
 296                        police->tcfp_pkttoks = ppstoks;
 297                        spin_unlock_bh(&police->tcfp_lock);
 298                        ret = p->tcfp_result;
 299                        goto inc_drops;
 300                }
 301                spin_unlock_bh(&police->tcfp_lock);
 302        }
 303
 304inc_overlimits:
 305        qstats_overlimit_inc(this_cpu_ptr(police->common.cpu_qstats));
 306inc_drops:
 307        if (ret == TC_ACT_SHOT)
 308                qstats_drop_inc(this_cpu_ptr(police->common.cpu_qstats));
 309end:
 310        return ret;
 311}
 312
 313static void tcf_police_cleanup(struct tc_action *a)
 314{
 315        struct tcf_police *police = to_police(a);
 316        struct tcf_police_params *p;
 317
 318        p = rcu_dereference_protected(police->params, 1);
 319        if (p)
 320                kfree_rcu(p, rcu);
 321}
 322
 323static void tcf_police_stats_update(struct tc_action *a,
 324                                    u64 bytes, u64 packets, u64 drops,
 325                                    u64 lastuse, bool hw)
 326{
 327        struct tcf_police *police = to_police(a);
 328        struct tcf_t *tm = &police->tcf_tm;
 329
 330        tcf_action_update_stats(a, bytes, packets, drops, hw);
 331        tm->lastuse = max_t(u64, tm->lastuse, lastuse);
 332}
 333
 334static int tcf_police_dump(struct sk_buff *skb, struct tc_action *a,
 335                               int bind, int ref)
 336{
 337        unsigned char *b = skb_tail_pointer(skb);
 338        struct tcf_police *police = to_police(a);
 339        struct tcf_police_params *p;
 340        struct tc_police opt = {
 341                .index = police->tcf_index,
 342                .refcnt = refcount_read(&police->tcf_refcnt) - ref,
 343                .bindcnt = atomic_read(&police->tcf_bindcnt) - bind,
 344        };
 345        struct tcf_t t;
 346
 347        spin_lock_bh(&police->tcf_lock);
 348        opt.action = police->tcf_action;
 349        p = rcu_dereference_protected(police->params,
 350                                      lockdep_is_held(&police->tcf_lock));
 351        opt.mtu = p->tcfp_mtu;
 352        opt.burst = PSCHED_NS2TICKS(p->tcfp_burst);
 353        if (p->rate_present) {
 354                psched_ratecfg_getrate(&opt.rate, &p->rate);
 355                if ((police->params->rate.rate_bytes_ps >= (1ULL << 32)) &&
 356                    nla_put_u64_64bit(skb, TCA_POLICE_RATE64,
 357                                      police->params->rate.rate_bytes_ps,
 358                                      TCA_POLICE_PAD))
 359                        goto nla_put_failure;
 360        }
 361        if (p->peak_present) {
 362                psched_ratecfg_getrate(&opt.peakrate, &p->peak);
 363                if ((police->params->peak.rate_bytes_ps >= (1ULL << 32)) &&
 364                    nla_put_u64_64bit(skb, TCA_POLICE_PEAKRATE64,
 365                                      police->params->peak.rate_bytes_ps,
 366                                      TCA_POLICE_PAD))
 367                        goto nla_put_failure;
 368        }
 369        if (p->pps_present) {
 370                if (nla_put_u64_64bit(skb, TCA_POLICE_PKTRATE64,
 371                                      police->params->ppsrate.rate_pkts_ps,
 372                                      TCA_POLICE_PAD))
 373                        goto nla_put_failure;
 374                if (nla_put_u64_64bit(skb, TCA_POLICE_PKTBURST64,
 375                                      PSCHED_NS2TICKS(p->tcfp_pkt_burst),
 376                                      TCA_POLICE_PAD))
 377                        goto nla_put_failure;
 378        }
 379        if (nla_put(skb, TCA_POLICE_TBF, sizeof(opt), &opt))
 380                goto nla_put_failure;
 381        if (p->tcfp_result &&
 382            nla_put_u32(skb, TCA_POLICE_RESULT, p->tcfp_result))
 383                goto nla_put_failure;
 384        if (p->tcfp_ewma_rate &&
 385            nla_put_u32(skb, TCA_POLICE_AVRATE, p->tcfp_ewma_rate))
 386                goto nla_put_failure;
 387
 388        tcf_tm_dump(&t, &police->tcf_tm);
 389        if (nla_put_64bit(skb, TCA_POLICE_TM, sizeof(t), &t, TCA_POLICE_PAD))
 390                goto nla_put_failure;
 391        spin_unlock_bh(&police->tcf_lock);
 392
 393        return skb->len;
 394
 395nla_put_failure:
 396        spin_unlock_bh(&police->tcf_lock);
 397        nlmsg_trim(skb, b);
 398        return -1;
 399}
 400
 401static int tcf_police_search(struct net *net, struct tc_action **a, u32 index)
 402{
 403        struct tc_action_net *tn = net_generic(net, police_net_id);
 404
 405        return tcf_idr_search(tn, a, index);
 406}
 407
 408MODULE_AUTHOR("Alexey Kuznetsov");
 409MODULE_DESCRIPTION("Policing actions");
 410MODULE_LICENSE("GPL");
 411
 412static struct tc_action_ops act_police_ops = {
 413        .kind           =       "police",
 414        .id             =       TCA_ID_POLICE,
 415        .owner          =       THIS_MODULE,
 416        .stats_update   =       tcf_police_stats_update,
 417        .act            =       tcf_police_act,
 418        .dump           =       tcf_police_dump,
 419        .init           =       tcf_police_init,
 420        .walk           =       tcf_police_walker,
 421        .lookup         =       tcf_police_search,
 422        .cleanup        =       tcf_police_cleanup,
 423        .size           =       sizeof(struct tcf_police),
 424};
 425
 426static __net_init int police_init_net(struct net *net)
 427{
 428        struct tc_action_net *tn = net_generic(net, police_net_id);
 429
 430        return tc_action_net_init(net, tn, &act_police_ops);
 431}
 432
 433static void __net_exit police_exit_net(struct list_head *net_list)
 434{
 435        tc_action_net_exit(net_list, police_net_id);
 436}
 437
 438static struct pernet_operations police_net_ops = {
 439        .init = police_init_net,
 440        .exit_batch = police_exit_net,
 441        .id   = &police_net_id,
 442        .size = sizeof(struct tc_action_net),
 443};
 444
 445static int __init police_init_module(void)
 446{
 447        return tcf_register_action(&act_police_ops, &police_net_ops);
 448}
 449
 450static void __exit police_cleanup_module(void)
 451{
 452        tcf_unregister_action(&act_police_ops, &police_net_ops);
 453}
 454
 455module_init(police_init_module);
 456module_exit(police_cleanup_module);
 457