1 /* 2 * net/sched/act_police.c Input police filter 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 7 * 2 of the License, or (at your option) any later version. 8 * 9 * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> 10 * J Hadi Salim (action changes) 11 */ 12 13 #include <linux/module.h> 14 #include <linux/types.h> 15 #include <linux/kernel.h> 16 #include <linux/string.h> 17 #include <linux/errno.h> 18 #include <linux/skbuff.h> 19 #include <linux/rtnetlink.h> 20 #include <linux/init.h> 21 #include <linux/slab.h> 22 #include <net/act_api.h> 23 #include <net/netlink.h> 24 25 struct tcf_police { 26 struct tc_action common; 27 int tcfp_result; 28 u32 tcfp_ewma_rate; 29 s64 tcfp_burst; 30 u32 tcfp_mtu; 31 s64 tcfp_toks; 32 s64 tcfp_ptoks; 33 s64 tcfp_mtu_ptoks; 34 s64 tcfp_t_c; 35 struct psched_ratecfg rate; 36 bool rate_present; 37 struct psched_ratecfg peak; 38 bool peak_present; 39 }; 40 41 #define to_police(pc) ((struct tcf_police *)pc) 42 43 /* old policer structure from before tc actions */ 44 struct tc_police_compat { 45 u32 index; 46 int action; 47 u32 limit; 48 u32 burst; 49 u32 mtu; 50 struct tc_ratespec rate; 51 struct tc_ratespec peakrate; 52 }; 53 54 /* Each policer is serialized by its individual spinlock */ 55 56 static unsigned int police_net_id; 57 static struct tc_action_ops act_police_ops; 58 59 static int tcf_act_police_walker(struct net *net, struct sk_buff *skb, 60 struct netlink_callback *cb, int type, 61 const struct tc_action_ops *ops) 62 { 63 struct tc_action_net *tn = net_generic(net, police_net_id); 64 65 return tcf_generic_walker(tn, skb, cb, type, ops); 66 } 67 68 static const struct nla_policy police_policy[TCA_POLICE_MAX + 1] = { 69 [TCA_POLICE_RATE] = { .len = TC_RTAB_SIZE }, 70 [TCA_POLICE_PEAKRATE] = { .len = TC_RTAB_SIZE }, 71 [TCA_POLICE_AVRATE] = { .type = NLA_U32 }, 72 [TCA_POLICE_RESULT] = { .type = NLA_U32 }, 73 }; 74 75 static int tcf_act_police_init(struct net *net, struct nlattr *nla, 76 struct nlattr *est, struct tc_action **a, 77 int ovr, int bind) 78 { 79 int ret = 0, err; 80 struct nlattr *tb[TCA_POLICE_MAX + 1]; 81 struct tc_police *parm; 82 struct tcf_police *police; 83 struct qdisc_rate_table *R_tab = NULL, *P_tab = NULL; 84 struct tc_action_net *tn = net_generic(net, police_net_id); 85 bool exists = false; 86 int size; 87 88 if (nla == NULL) 89 return -EINVAL; 90 91 err = nla_parse_nested(tb, TCA_POLICE_MAX, nla, police_policy, NULL); 92 if (err < 0) 93 return err; 94 95 if (tb[TCA_POLICE_TBF] == NULL) 96 return -EINVAL; 97 size = nla_len(tb[TCA_POLICE_TBF]); 98 if (size != sizeof(*parm) && size != sizeof(struct tc_police_compat)) 99 return -EINVAL; 100 101 parm = nla_data(tb[TCA_POLICE_TBF]); 102 exists = tcf_idr_check(tn, parm->index, a, bind); 103 if (exists && bind) 104 return 0; 105 106 if (!exists) { 107 ret = tcf_idr_create(tn, parm->index, NULL, a, 108 &act_police_ops, bind, false); 109 if (ret) 110 return ret; 111 ret = ACT_P_CREATED; 112 } else { 113 tcf_idr_release(*a, bind); 114 if (!ovr) 115 return -EEXIST; 116 } 117 118 police = to_police(*a); 119 if (parm->rate.rate) { 120 err = -ENOMEM; 121 R_tab = qdisc_get_rtab(&parm->rate, tb[TCA_POLICE_RATE]); 122 if (R_tab == NULL) 123 goto failure; 124 125 if (parm->peakrate.rate) { 126 P_tab = qdisc_get_rtab(&parm->peakrate, 127 tb[TCA_POLICE_PEAKRATE]); 128 if (P_tab == NULL) 129 goto failure; 130 } 131 } 132 133 if (est) { 134 err = gen_replace_estimator(&police->tcf_bstats, NULL, 135 &police->tcf_rate_est, 136 &police->tcf_lock, 137 NULL, est); 138 if (err) 139 goto failure; 140 } else if (tb[TCA_POLICE_AVRATE] && 141 (ret == ACT_P_CREATED || 142 !gen_estimator_active(&police->tcf_rate_est))) { 143 err = -EINVAL; 144 goto failure; 145 } 146 147 spin_lock_bh(&police->tcf_lock); 148 /* No failure allowed after this point */ 149 police->tcfp_mtu = parm->mtu; 150 if (police->tcfp_mtu == 0) { 151 police->tcfp_mtu = ~0; 152 if (R_tab) 153 police->tcfp_mtu = 255 << R_tab->rate.cell_log; 154 } 155 if (R_tab) { 156 police->rate_present = true; 157 psched_ratecfg_precompute(&police->rate, &R_tab->rate, 0); 158 qdisc_put_rtab(R_tab); 159 } else { 160 police->rate_present = false; 161 } 162 if (P_tab) { 163 police->peak_present = true; 164 psched_ratecfg_precompute(&police->peak, &P_tab->rate, 0); 165 qdisc_put_rtab(P_tab); 166 } else { 167 police->peak_present = false; 168 } 169 170 if (tb[TCA_POLICE_RESULT]) 171 police->tcfp_result = nla_get_u32(tb[TCA_POLICE_RESULT]); 172 police->tcfp_burst = PSCHED_TICKS2NS(parm->burst); 173 police->tcfp_toks = police->tcfp_burst; 174 if (police->peak_present) { 175 police->tcfp_mtu_ptoks = (s64) psched_l2t_ns(&police->peak, 176 police->tcfp_mtu); 177 police->tcfp_ptoks = police->tcfp_mtu_ptoks; 178 } 179 police->tcf_action = parm->action; 180 181 if (tb[TCA_POLICE_AVRATE]) 182 police->tcfp_ewma_rate = nla_get_u32(tb[TCA_POLICE_AVRATE]); 183 184 spin_unlock_bh(&police->tcf_lock); 185 if (ret != ACT_P_CREATED) 186 return ret; 187 188 police->tcfp_t_c = ktime_get_ns(); 189 tcf_idr_insert(tn, *a); 190 191 return ret; 192 193 failure: 194 qdisc_put_rtab(P_tab); 195 qdisc_put_rtab(R_tab); 196 if (ret == ACT_P_CREATED) 197 tcf_idr_cleanup(*a, est); 198 return err; 199 } 200 201 static int tcf_act_police(struct sk_buff *skb, const struct tc_action *a, 202 struct tcf_result *res) 203 { 204 struct tcf_police *police = to_police(a); 205 s64 now; 206 s64 toks; 207 s64 ptoks = 0; 208 209 spin_lock(&police->tcf_lock); 210 211 bstats_update(&police->tcf_bstats, skb); 212 tcf_lastuse_update(&police->tcf_tm); 213 214 if (police->tcfp_ewma_rate) { 215 struct gnet_stats_rate_est64 sample; 216 217 if (!gen_estimator_read(&police->tcf_rate_est, &sample) || 218 sample.bps >= police->tcfp_ewma_rate) { 219 police->tcf_qstats.overlimits++; 220 if (police->tcf_action == TC_ACT_SHOT) 221 police->tcf_qstats.drops++; 222 spin_unlock(&police->tcf_lock); 223 return police->tcf_action; 224 } 225 } 226 227 if (qdisc_pkt_len(skb) <= police->tcfp_mtu) { 228 if (!police->rate_present) { 229 spin_unlock(&police->tcf_lock); 230 return police->tcfp_result; 231 } 232 233 now = ktime_get_ns(); 234 toks = min_t(s64, now - police->tcfp_t_c, 235 police->tcfp_burst); 236 if (police->peak_present) { 237 ptoks = toks + police->tcfp_ptoks; 238 if (ptoks > police->tcfp_mtu_ptoks) 239 ptoks = police->tcfp_mtu_ptoks; 240 ptoks -= (s64) psched_l2t_ns(&police->peak, 241 qdisc_pkt_len(skb)); 242 } 243 toks += police->tcfp_toks; 244 if (toks > police->tcfp_burst) 245 toks = police->tcfp_burst; 246 toks -= (s64) psched_l2t_ns(&police->rate, qdisc_pkt_len(skb)); 247 if ((toks|ptoks) >= 0) { 248 police->tcfp_t_c = now; 249 police->tcfp_toks = toks; 250 police->tcfp_ptoks = ptoks; 251 if (police->tcfp_result == TC_ACT_SHOT) 252 police->tcf_qstats.drops++; 253 spin_unlock(&police->tcf_lock); 254 return police->tcfp_result; 255 } 256 } 257 258 police->tcf_qstats.overlimits++; 259 if (police->tcf_action == TC_ACT_SHOT) 260 police->tcf_qstats.drops++; 261 spin_unlock(&police->tcf_lock); 262 return police->tcf_action; 263 } 264 265 static int tcf_act_police_dump(struct sk_buff *skb, struct tc_action *a, 266 int bind, int ref) 267 { 268 unsigned char *b = skb_tail_pointer(skb); 269 struct tcf_police *police = to_police(a); 270 struct tc_police opt = { 271 .index = police->tcf_index, 272 .action = police->tcf_action, 273 .mtu = police->tcfp_mtu, 274 .burst = PSCHED_NS2TICKS(police->tcfp_burst), 275 .refcnt = police->tcf_refcnt - ref, 276 .bindcnt = police->tcf_bindcnt - bind, 277 }; 278 struct tcf_t t; 279 280 if (police->rate_present) 281 psched_ratecfg_getrate(&opt.rate, &police->rate); 282 if (police->peak_present) 283 psched_ratecfg_getrate(&opt.peakrate, &police->peak); 284 if (nla_put(skb, TCA_POLICE_TBF, sizeof(opt), &opt)) 285 goto nla_put_failure; 286 if (police->tcfp_result && 287 nla_put_u32(skb, TCA_POLICE_RESULT, police->tcfp_result)) 288 goto nla_put_failure; 289 if (police->tcfp_ewma_rate && 290 nla_put_u32(skb, TCA_POLICE_AVRATE, police->tcfp_ewma_rate)) 291 goto nla_put_failure; 292 293 t.install = jiffies_to_clock_t(jiffies - police->tcf_tm.install); 294 t.lastuse = jiffies_to_clock_t(jiffies - police->tcf_tm.lastuse); 295 t.firstuse = jiffies_to_clock_t(jiffies - police->tcf_tm.firstuse); 296 t.expires = jiffies_to_clock_t(police->tcf_tm.expires); 297 if (nla_put_64bit(skb, TCA_POLICE_TM, sizeof(t), &t, TCA_POLICE_PAD)) 298 goto nla_put_failure; 299 300 return skb->len; 301 302 nla_put_failure: 303 nlmsg_trim(skb, b); 304 return -1; 305 } 306 307 static int tcf_police_search(struct net *net, struct tc_action **a, u32 index) 308 { 309 struct tc_action_net *tn = net_generic(net, police_net_id); 310 311 return tcf_idr_search(tn, a, index); 312 } 313 314 MODULE_AUTHOR("Alexey Kuznetsov"); 315 MODULE_DESCRIPTION("Policing actions"); 316 MODULE_LICENSE("GPL"); 317 318 static struct tc_action_ops act_police_ops = { 319 .kind = "police", 320 .type = TCA_ID_POLICE, 321 .owner = THIS_MODULE, 322 .act = tcf_act_police, 323 .dump = tcf_act_police_dump, 324 .init = tcf_act_police_init, 325 .walk = tcf_act_police_walker, 326 .lookup = tcf_police_search, 327 .size = sizeof(struct tcf_police), 328 }; 329 330 static __net_init int police_init_net(struct net *net) 331 { 332 struct tc_action_net *tn = net_generic(net, police_net_id); 333 334 return tc_action_net_init(tn, &act_police_ops); 335 } 336 337 static void __net_exit police_exit_net(struct net *net) 338 { 339 struct tc_action_net *tn = net_generic(net, police_net_id); 340 341 tc_action_net_exit(tn); 342 } 343 344 static struct pernet_operations police_net_ops = { 345 .init = police_init_net, 346 .exit = police_exit_net, 347 .id = &police_net_id, 348 .size = sizeof(struct tc_action_net), 349 }; 350 351 static int __init police_init_module(void) 352 { 353 return tcf_register_action(&act_police_ops, &police_net_ops); 354 } 355 356 static void __exit police_cleanup_module(void) 357 { 358 tcf_unregister_action(&act_police_ops, &police_net_ops); 359 } 360 361 module_init(police_init_module); 362 module_exit(police_cleanup_module); 363