act_police.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * net/sched/act_police.c Input police filter
  4. *
  5. * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
  6. * J Hadi Salim (action changes)
  7. */
  8. #include <linux/module.h>
  9. #include <linux/types.h>
  10. #include <linux/kernel.h>
  11. #include <linux/string.h>
  12. #include <linux/errno.h>
  13. #include <linux/skbuff.h>
  14. #include <linux/rtnetlink.h>
  15. #include <linux/init.h>
  16. #include <linux/slab.h>
  17. #include <net/act_api.h>
  18. #include <net/netlink.h>
  19. #include <net/pkt_cls.h>
  20. #include <net/tc_act/tc_police.h>
  21. /* Each policer is serialized by its individual spinlock */
  22. static unsigned int police_net_id;
  23. static struct tc_action_ops act_police_ops;
  24. static int tcf_police_walker(struct net *net, struct sk_buff *skb,
  25. struct netlink_callback *cb, int type,
  26. const struct tc_action_ops *ops,
  27. struct netlink_ext_ack *extack)
  28. {
  29. struct tc_action_net *tn = net_generic(net, police_net_id);
  30. return tcf_generic_walker(tn, skb, cb, type, ops, extack);
  31. }
  32. static const struct nla_policy police_policy[TCA_POLICE_MAX + 1] = {
  33. [TCA_POLICE_RATE] = { .len = TC_RTAB_SIZE },
  34. [TCA_POLICE_PEAKRATE] = { .len = TC_RTAB_SIZE },
  35. [TCA_POLICE_AVRATE] = { .type = NLA_U32 },
  36. [TCA_POLICE_RESULT] = { .type = NLA_U32 },
  37. [TCA_POLICE_RATE64] = { .type = NLA_U64 },
  38. [TCA_POLICE_PEAKRATE64] = { .type = NLA_U64 },
  39. };
  40. static int tcf_police_init(struct net *net, struct nlattr *nla,
  41. struct nlattr *est, struct tc_action **a,
  42. int ovr, int bind, bool rtnl_held,
  43. struct tcf_proto *tp, u32 flags,
  44. struct netlink_ext_ack *extack)
  45. {
  46. int ret = 0, tcfp_result = TC_ACT_OK, err, size;
  47. struct nlattr *tb[TCA_POLICE_MAX + 1];
  48. struct tcf_chain *goto_ch = NULL;
  49. struct tc_police *parm;
  50. struct tcf_police *police;
  51. struct qdisc_rate_table *R_tab = NULL, *P_tab = NULL;
  52. struct tc_action_net *tn = net_generic(net, police_net_id);
  53. struct tcf_police_params *new;
  54. bool exists = false;
  55. u32 index;
  56. u64 rate64, prate64;
  57. if (nla == NULL)
  58. return -EINVAL;
  59. err = nla_parse_nested_deprecated(tb, TCA_POLICE_MAX, nla,
  60. police_policy, NULL);
  61. if (err < 0)
  62. return err;
  63. if (tb[TCA_POLICE_TBF] == NULL)
  64. return -EINVAL;
  65. size = nla_len(tb[TCA_POLICE_TBF]);
  66. if (size != sizeof(*parm) && size != sizeof(struct tc_police_compat))
  67. return -EINVAL;
  68. parm = nla_data(tb[TCA_POLICE_TBF]);
  69. index = parm->index;
  70. err = tcf_idr_check_alloc(tn, &index, a, bind);
  71. if (err < 0)
  72. return err;
  73. exists = err;
  74. if (exists && bind)
  75. return 0;
  76. if (!exists) {
  77. ret = tcf_idr_create(tn, index, NULL, a,
  78. &act_police_ops, bind, true, 0);
  79. if (ret) {
  80. tcf_idr_cleanup(tn, index);
  81. return ret;
  82. }
  83. ret = ACT_P_CREATED;
  84. spin_lock_init(&(to_police(*a)->tcfp_lock));
  85. } else if (!ovr) {
  86. tcf_idr_release(*a, bind);
  87. return -EEXIST;
  88. }
  89. err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch, extack);
  90. if (err < 0)
  91. goto release_idr;
  92. police = to_police(*a);
  93. if (parm->rate.rate) {
  94. err = -ENOMEM;
  95. R_tab = qdisc_get_rtab(&parm->rate, tb[TCA_POLICE_RATE], NULL);
  96. if (R_tab == NULL)
  97. goto failure;
  98. if (parm->peakrate.rate) {
  99. P_tab = qdisc_get_rtab(&parm->peakrate,
  100. tb[TCA_POLICE_PEAKRATE], NULL);
  101. if (P_tab == NULL)
  102. goto failure;
  103. }
  104. }
  105. if (est) {
  106. err = gen_replace_estimator(&police->tcf_bstats,
  107. police->common.cpu_bstats,
  108. &police->tcf_rate_est,
  109. &police->tcf_lock,
  110. NULL, est);
  111. if (err)
  112. goto failure;
  113. } else if (tb[TCA_POLICE_AVRATE] &&
  114. (ret == ACT_P_CREATED ||
  115. !gen_estimator_active(&police->tcf_rate_est))) {
  116. err = -EINVAL;
  117. goto failure;
  118. }
  119. if (tb[TCA_POLICE_RESULT]) {
  120. tcfp_result = nla_get_u32(tb[TCA_POLICE_RESULT]);
  121. if (TC_ACT_EXT_CMP(tcfp_result, TC_ACT_GOTO_CHAIN)) {
  122. NL_SET_ERR_MSG(extack,
  123. "goto chain not allowed on fallback");
  124. err = -EINVAL;
  125. goto failure;
  126. }
  127. }
  128. new = kzalloc(sizeof(*new), GFP_KERNEL);
  129. if (unlikely(!new)) {
  130. err = -ENOMEM;
  131. goto failure;
  132. }
  133. /* No failure allowed after this point */
  134. new->tcfp_result = tcfp_result;
  135. new->tcfp_mtu = parm->mtu;
  136. if (!new->tcfp_mtu) {
  137. new->tcfp_mtu = ~0;
  138. if (R_tab)
  139. new->tcfp_mtu = 255 << R_tab->rate.cell_log;
  140. }
  141. if (R_tab) {
  142. new->rate_present = true;
  143. rate64 = tb[TCA_POLICE_RATE64] ?
  144. nla_get_u64(tb[TCA_POLICE_RATE64]) : 0;
  145. psched_ratecfg_precompute(&new->rate, &R_tab->rate, rate64);
  146. qdisc_put_rtab(R_tab);
  147. } else {
  148. new->rate_present = false;
  149. }
  150. if (P_tab) {
  151. new->peak_present = true;
  152. prate64 = tb[TCA_POLICE_PEAKRATE64] ?
  153. nla_get_u64(tb[TCA_POLICE_PEAKRATE64]) : 0;
  154. psched_ratecfg_precompute(&new->peak, &P_tab->rate, prate64);
  155. qdisc_put_rtab(P_tab);
  156. } else {
  157. new->peak_present = false;
  158. }
  159. new->tcfp_burst = PSCHED_TICKS2NS(parm->burst);
  160. if (new->peak_present)
  161. new->tcfp_mtu_ptoks = (s64)psched_l2t_ns(&new->peak,
  162. new->tcfp_mtu);
  163. if (tb[TCA_POLICE_AVRATE])
  164. new->tcfp_ewma_rate = nla_get_u32(tb[TCA_POLICE_AVRATE]);
  165. spin_lock_bh(&police->tcf_lock);
  166. spin_lock_bh(&police->tcfp_lock);
  167. police->tcfp_t_c = ktime_get_ns();
  168. police->tcfp_toks = new->tcfp_burst;
  169. if (new->peak_present)
  170. police->tcfp_ptoks = new->tcfp_mtu_ptoks;
  171. spin_unlock_bh(&police->tcfp_lock);
  172. goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
  173. new = rcu_replace_pointer(police->params,
  174. new,
  175. lockdep_is_held(&police->tcf_lock));
  176. spin_unlock_bh(&police->tcf_lock);
  177. if (goto_ch)
  178. tcf_chain_put_by_act(goto_ch);
  179. if (new)
  180. kfree_rcu(new, rcu);
  181. return ret;
  182. failure:
  183. qdisc_put_rtab(P_tab);
  184. qdisc_put_rtab(R_tab);
  185. if (goto_ch)
  186. tcf_chain_put_by_act(goto_ch);
  187. release_idr:
  188. tcf_idr_release(*a, bind);
  189. return err;
  190. }
  191. static int tcf_police_act(struct sk_buff *skb, const struct tc_action *a,
  192. struct tcf_result *res)
  193. {
  194. struct tcf_police *police = to_police(a);
  195. struct tcf_police_params *p;
  196. s64 now, toks, ptoks = 0;
  197. int ret;
  198. tcf_lastuse_update(&police->tcf_tm);
  199. bstats_cpu_update(this_cpu_ptr(police->common.cpu_bstats), skb);
  200. ret = READ_ONCE(police->tcf_action);
  201. p = rcu_dereference_bh(police->params);
  202. if (p->tcfp_ewma_rate) {
  203. struct gnet_stats_rate_est64 sample;
  204. if (!gen_estimator_read(&police->tcf_rate_est, &sample) ||
  205. sample.bps >= p->tcfp_ewma_rate)
  206. goto inc_overlimits;
  207. }
  208. if (qdisc_pkt_len(skb) <= p->tcfp_mtu) {
  209. if (!p->rate_present) {
  210. ret = p->tcfp_result;
  211. goto end;
  212. }
  213. now = ktime_get_ns();
  214. spin_lock_bh(&police->tcfp_lock);
  215. toks = min_t(s64, now - police->tcfp_t_c, p->tcfp_burst);
  216. if (p->peak_present) {
  217. ptoks = toks + police->tcfp_ptoks;
  218. if (ptoks > p->tcfp_mtu_ptoks)
  219. ptoks = p->tcfp_mtu_ptoks;
  220. ptoks -= (s64)psched_l2t_ns(&p->peak,
  221. qdisc_pkt_len(skb));
  222. }
  223. toks += police->tcfp_toks;
  224. if (toks > p->tcfp_burst)
  225. toks = p->tcfp_burst;
  226. toks -= (s64)psched_l2t_ns(&p->rate, qdisc_pkt_len(skb));
  227. if ((toks|ptoks) >= 0) {
  228. police->tcfp_t_c = now;
  229. police->tcfp_toks = toks;
  230. police->tcfp_ptoks = ptoks;
  231. spin_unlock_bh(&police->tcfp_lock);
  232. ret = p->tcfp_result;
  233. goto inc_drops;
  234. }
  235. spin_unlock_bh(&police->tcfp_lock);
  236. }
  237. inc_overlimits:
  238. qstats_overlimit_inc(this_cpu_ptr(police->common.cpu_qstats));
  239. inc_drops:
  240. if (ret == TC_ACT_SHOT)
  241. qstats_drop_inc(this_cpu_ptr(police->common.cpu_qstats));
  242. end:
  243. return ret;
  244. }
  245. static void tcf_police_cleanup(struct tc_action *a)
  246. {
  247. struct tcf_police *police = to_police(a);
  248. struct tcf_police_params *p;
  249. p = rcu_dereference_protected(police->params, 1);
  250. if (p)
  251. kfree_rcu(p, rcu);
  252. }
  253. static void tcf_police_stats_update(struct tc_action *a,
  254. u64 bytes, u64 packets, u64 drops,
  255. u64 lastuse, bool hw)
  256. {
  257. struct tcf_police *police = to_police(a);
  258. struct tcf_t *tm = &police->tcf_tm;
  259. tcf_action_update_stats(a, bytes, packets, drops, hw);
  260. tm->lastuse = max_t(u64, tm->lastuse, lastuse);
  261. }
  262. static int tcf_police_dump(struct sk_buff *skb, struct tc_action *a,
  263. int bind, int ref)
  264. {
  265. unsigned char *b = skb_tail_pointer(skb);
  266. struct tcf_police *police = to_police(a);
  267. struct tcf_police_params *p;
  268. struct tc_police opt = {
  269. .index = police->tcf_index,
  270. .refcnt = refcount_read(&police->tcf_refcnt) - ref,
  271. .bindcnt = atomic_read(&police->tcf_bindcnt) - bind,
  272. };
  273. struct tcf_t t;
  274. spin_lock_bh(&police->tcf_lock);
  275. opt.action = police->tcf_action;
  276. p = rcu_dereference_protected(police->params,
  277. lockdep_is_held(&police->tcf_lock));
  278. opt.mtu = p->tcfp_mtu;
  279. opt.burst = PSCHED_NS2TICKS(p->tcfp_burst);
  280. if (p->rate_present) {
  281. psched_ratecfg_getrate(&opt.rate, &p->rate);
  282. if ((police->params->rate.rate_bytes_ps >= (1ULL << 32)) &&
  283. nla_put_u64_64bit(skb, TCA_POLICE_RATE64,
  284. police->params->rate.rate_bytes_ps,
  285. TCA_POLICE_PAD))
  286. goto nla_put_failure;
  287. }
  288. if (p->peak_present) {
  289. psched_ratecfg_getrate(&opt.peakrate, &p->peak);
  290. if ((police->params->peak.rate_bytes_ps >= (1ULL << 32)) &&
  291. nla_put_u64_64bit(skb, TCA_POLICE_PEAKRATE64,
  292. police->params->peak.rate_bytes_ps,
  293. TCA_POLICE_PAD))
  294. goto nla_put_failure;
  295. }
  296. if (nla_put(skb, TCA_POLICE_TBF, sizeof(opt), &opt))
  297. goto nla_put_failure;
  298. if (p->tcfp_result &&
  299. nla_put_u32(skb, TCA_POLICE_RESULT, p->tcfp_result))
  300. goto nla_put_failure;
  301. if (p->tcfp_ewma_rate &&
  302. nla_put_u32(skb, TCA_POLICE_AVRATE, p->tcfp_ewma_rate))
  303. goto nla_put_failure;
  304. tcf_tm_dump(&t, &police->tcf_tm);
  305. if (nla_put_64bit(skb, TCA_POLICE_TM, sizeof(t), &t, TCA_POLICE_PAD))
  306. goto nla_put_failure;
  307. spin_unlock_bh(&police->tcf_lock);
  308. return skb->len;
  309. nla_put_failure:
  310. spin_unlock_bh(&police->tcf_lock);
  311. nlmsg_trim(skb, b);
  312. return -1;
  313. }
  314. static int tcf_police_search(struct net *net, struct tc_action **a, u32 index)
  315. {
  316. struct tc_action_net *tn = net_generic(net, police_net_id);
  317. return tcf_idr_search(tn, a, index);
  318. }
  319. MODULE_AUTHOR("Alexey Kuznetsov");
  320. MODULE_DESCRIPTION("Policing actions");
  321. MODULE_LICENSE("GPL");
  322. static struct tc_action_ops act_police_ops = {
  323. .kind = "police",
  324. .id = TCA_ID_POLICE,
  325. .owner = THIS_MODULE,
  326. .stats_update = tcf_police_stats_update,
  327. .act = tcf_police_act,
  328. .dump = tcf_police_dump,
  329. .init = tcf_police_init,
  330. .walk = tcf_police_walker,
  331. .lookup = tcf_police_search,
  332. .cleanup = tcf_police_cleanup,
  333. .size = sizeof(struct tcf_police),
  334. };
  335. static __net_init int police_init_net(struct net *net)
  336. {
  337. struct tc_action_net *tn = net_generic(net, police_net_id);
  338. return tc_action_net_init(net, tn, &act_police_ops);
  339. }
  340. static void __net_exit police_exit_net(struct list_head *net_list)
  341. {
  342. tc_action_net_exit(net_list, police_net_id);
  343. }
  344. static struct pernet_operations police_net_ops = {
  345. .init = police_init_net,
  346. .exit_batch = police_exit_net,
  347. .id = &police_net_id,
  348. .size = sizeof(struct tc_action_net),
  349. };
  350. static int __init police_init_module(void)
  351. {
  352. return tcf_register_action(&act_police_ops, &police_net_ops);
  353. }
  354. static void __exit police_cleanup_module(void)
  355. {
  356. tcf_unregister_action(&act_police_ops, &police_net_ops);
  357. }
  358. module_init(police_init_module);
  359. module_exit(police_cleanup_module);