1 /* 2 * net/sched/act_police.c Input police filter 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 7 * 2 of the License, or (at your option) any later version. 8 * 9 * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> 10 * J Hadi Salim (action changes) 11 */ 12 13 #include <linux/module.h> 14 #include <linux/types.h> 15 #include <linux/kernel.h> 16 #include <linux/string.h> 17 #include <linux/errno.h> 18 #include <linux/skbuff.h> 19 #include <linux/rtnetlink.h> 20 #include <linux/init.h> 21 #include <linux/slab.h> 22 #include <net/act_api.h> 23 #include <net/netlink.h> 24 25 struct tcf_police { 26 struct tc_action common; 27 int tcfp_result; 28 u32 tcfp_ewma_rate; 29 s64 tcfp_burst; 30 u32 tcfp_mtu; 31 s64 tcfp_toks; 32 s64 tcfp_ptoks; 33 s64 tcfp_mtu_ptoks; 34 s64 tcfp_t_c; 35 struct psched_ratecfg rate; 36 bool rate_present; 37 struct psched_ratecfg peak; 38 bool peak_present; 39 }; 40 41 #define to_police(pc) ((struct tcf_police *)pc) 42 43 #define POL_TAB_MASK 15 44 45 /* old policer structure from before tc actions */ 46 struct tc_police_compat { 47 u32 index; 48 int action; 49 u32 limit; 50 u32 burst; 51 u32 mtu; 52 struct tc_ratespec rate; 53 struct tc_ratespec peakrate; 54 }; 55 56 /* Each policer is serialized by its individual spinlock */ 57 58 static unsigned int police_net_id; 59 static struct tc_action_ops act_police_ops; 60 61 static int tcf_act_police_walker(struct net *net, struct sk_buff *skb, 62 struct netlink_callback *cb, int type, 63 const struct tc_action_ops *ops) 64 { 65 struct tc_action_net *tn = net_generic(net, police_net_id); 66 67 return tcf_generic_walker(tn, skb, cb, type, ops); 68 } 69 70 static const struct nla_policy police_policy[TCA_POLICE_MAX + 1] = { 71 [TCA_POLICE_RATE] = { .len = TC_RTAB_SIZE }, 72 [TCA_POLICE_PEAKRATE] = { .len = TC_RTAB_SIZE }, 73 [TCA_POLICE_AVRATE] = { .type = NLA_U32 }, 74 [TCA_POLICE_RESULT] = { .type = NLA_U32 }, 75 }; 76 77 static int tcf_act_police_init(struct net *net, struct nlattr *nla, 78 struct nlattr *est, struct tc_action **a, 79 int ovr, int bind) 80 { 81 int ret = 0, err; 82 struct nlattr *tb[TCA_POLICE_MAX + 1]; 83 struct tc_police *parm; 84 struct tcf_police *police; 85 struct qdisc_rate_table *R_tab = NULL, *P_tab = NULL; 86 struct tc_action_net *tn = net_generic(net, police_net_id); 87 bool exists = false; 88 int size; 89 90 if (nla == NULL) 91 return -EINVAL; 92 93 err = nla_parse_nested(tb, TCA_POLICE_MAX, nla, police_policy); 94 if (err < 0) 95 return err; 96 97 if (tb[TCA_POLICE_TBF] == NULL) 98 return -EINVAL; 99 size = nla_len(tb[TCA_POLICE_TBF]); 100 if (size != sizeof(*parm) && size != sizeof(struct tc_police_compat)) 101 return -EINVAL; 102 103 parm = nla_data(tb[TCA_POLICE_TBF]); 104 exists = tcf_hash_check(tn, parm->index, a, bind); 105 if (exists && bind) 106 return 0; 107 108 if (!exists) { 109 ret = tcf_hash_create(tn, parm->index, NULL, a, 110 &act_police_ops, bind, false); 111 if (ret) 112 return ret; 113 ret = ACT_P_CREATED; 114 } else { 115 tcf_hash_release(*a, bind); 116 if (!ovr) 117 return -EEXIST; 118 } 119 120 police = to_police(*a); 121 if (parm->rate.rate) { 122 err = -ENOMEM; 123 R_tab = qdisc_get_rtab(&parm->rate, tb[TCA_POLICE_RATE]); 124 if (R_tab == NULL) 125 goto failure; 126 127 if (parm->peakrate.rate) { 128 P_tab = qdisc_get_rtab(&parm->peakrate, 129 tb[TCA_POLICE_PEAKRATE]); 130 if (P_tab == NULL) 131 goto failure; 132 } 133 } 134 135 spin_lock_bh(&police->tcf_lock); 136 if (est) { 137 err = gen_replace_estimator(&police->tcf_bstats, NULL, 138 &police->tcf_rate_est, 139 &police->tcf_lock, 140 NULL, est); 141 if (err) 142 goto failure_unlock; 143 } else if (tb[TCA_POLICE_AVRATE] && 144 (ret == ACT_P_CREATED || 145 !gen_estimator_active(&police->tcf_rate_est))) { 146 err = -EINVAL; 147 goto failure_unlock; 148 } 149 150 /* No failure allowed after this point */ 151 police->tcfp_mtu = parm->mtu; 152 if (police->tcfp_mtu == 0) { 153 police->tcfp_mtu = ~0; 154 if (R_tab) 155 police->tcfp_mtu = 255 << R_tab->rate.cell_log; 156 } 157 if (R_tab) { 158 police->rate_present = true; 159 psched_ratecfg_precompute(&police->rate, &R_tab->rate, 0); 160 qdisc_put_rtab(R_tab); 161 } else { 162 police->rate_present = false; 163 } 164 if (P_tab) { 165 police->peak_present = true; 166 psched_ratecfg_precompute(&police->peak, &P_tab->rate, 0); 167 qdisc_put_rtab(P_tab); 168 } else { 169 police->peak_present = false; 170 } 171 172 if (tb[TCA_POLICE_RESULT]) 173 police->tcfp_result = nla_get_u32(tb[TCA_POLICE_RESULT]); 174 police->tcfp_burst = PSCHED_TICKS2NS(parm->burst); 175 police->tcfp_toks = police->tcfp_burst; 176 if (police->peak_present) { 177 police->tcfp_mtu_ptoks = (s64) psched_l2t_ns(&police->peak, 178 police->tcfp_mtu); 179 police->tcfp_ptoks = police->tcfp_mtu_ptoks; 180 } 181 police->tcf_action = parm->action; 182 183 if (tb[TCA_POLICE_AVRATE]) 184 police->tcfp_ewma_rate = nla_get_u32(tb[TCA_POLICE_AVRATE]); 185 186 spin_unlock_bh(&police->tcf_lock); 187 if (ret != ACT_P_CREATED) 188 return ret; 189 190 police->tcfp_t_c = ktime_get_ns(); 191 tcf_hash_insert(tn, *a); 192 193 return ret; 194 195 failure_unlock: 196 spin_unlock_bh(&police->tcf_lock); 197 failure: 198 qdisc_put_rtab(P_tab); 199 qdisc_put_rtab(R_tab); 200 if (ret == ACT_P_CREATED) 201 tcf_hash_cleanup(*a, est); 202 return err; 203 } 204 205 static int tcf_act_police(struct sk_buff *skb, const struct tc_action *a, 206 struct tcf_result *res) 207 { 208 struct tcf_police *police = to_police(a); 209 s64 now; 210 s64 toks; 211 s64 ptoks = 0; 212 213 spin_lock(&police->tcf_lock); 214 215 bstats_update(&police->tcf_bstats, skb); 216 tcf_lastuse_update(&police->tcf_tm); 217 218 if (police->tcfp_ewma_rate) { 219 struct gnet_stats_rate_est64 sample; 220 221 if (!gen_estimator_read(&police->tcf_rate_est, &sample) || 222 sample.bps >= police->tcfp_ewma_rate) { 223 police->tcf_qstats.overlimits++; 224 if (police->tcf_action == TC_ACT_SHOT) 225 police->tcf_qstats.drops++; 226 spin_unlock(&police->tcf_lock); 227 return police->tcf_action; 228 } 229 } 230 231 if (qdisc_pkt_len(skb) <= police->tcfp_mtu) { 232 if (!police->rate_present) { 233 spin_unlock(&police->tcf_lock); 234 return police->tcfp_result; 235 } 236 237 now = ktime_get_ns(); 238 toks = min_t(s64, now - police->tcfp_t_c, 239 police->tcfp_burst); 240 if (police->peak_present) { 241 ptoks = toks + police->tcfp_ptoks; 242 if (ptoks > police->tcfp_mtu_ptoks) 243 ptoks = police->tcfp_mtu_ptoks; 244 ptoks -= (s64) psched_l2t_ns(&police->peak, 245 qdisc_pkt_len(skb)); 246 } 247 toks += police->tcfp_toks; 248 if (toks > police->tcfp_burst) 249 toks = police->tcfp_burst; 250 toks -= (s64) psched_l2t_ns(&police->rate, qdisc_pkt_len(skb)); 251 if ((toks|ptoks) >= 0) { 252 police->tcfp_t_c = now; 253 police->tcfp_toks = toks; 254 police->tcfp_ptoks = ptoks; 255 if (police->tcfp_result == TC_ACT_SHOT) 256 police->tcf_qstats.drops++; 257 spin_unlock(&police->tcf_lock); 258 return police->tcfp_result; 259 } 260 } 261 262 police->tcf_qstats.overlimits++; 263 if (police->tcf_action == TC_ACT_SHOT) 264 police->tcf_qstats.drops++; 265 spin_unlock(&police->tcf_lock); 266 return police->tcf_action; 267 } 268 269 static int tcf_act_police_dump(struct sk_buff *skb, struct tc_action *a, 270 int bind, int ref) 271 { 272 unsigned char *b = skb_tail_pointer(skb); 273 struct tcf_police *police = to_police(a); 274 struct tc_police opt = { 275 .index = police->tcf_index, 276 .action = police->tcf_action, 277 .mtu = police->tcfp_mtu, 278 .burst = PSCHED_NS2TICKS(police->tcfp_burst), 279 .refcnt = police->tcf_refcnt - ref, 280 .bindcnt = police->tcf_bindcnt - bind, 281 }; 282 struct tcf_t t; 283 284 if (police->rate_present) 285 psched_ratecfg_getrate(&opt.rate, &police->rate); 286 if (police->peak_present) 287 psched_ratecfg_getrate(&opt.peakrate, &police->peak); 288 if (nla_put(skb, TCA_POLICE_TBF, sizeof(opt), &opt)) 289 goto nla_put_failure; 290 if (police->tcfp_result && 291 nla_put_u32(skb, TCA_POLICE_RESULT, police->tcfp_result)) 292 goto nla_put_failure; 293 if (police->tcfp_ewma_rate && 294 nla_put_u32(skb, TCA_POLICE_AVRATE, police->tcfp_ewma_rate)) 295 goto nla_put_failure; 296 297 t.install = jiffies_to_clock_t(jiffies - police->tcf_tm.install); 298 t.lastuse = jiffies_to_clock_t(jiffies - police->tcf_tm.lastuse); 299 t.firstuse = jiffies_to_clock_t(jiffies - police->tcf_tm.firstuse); 300 t.expires = jiffies_to_clock_t(police->tcf_tm.expires); 301 if (nla_put_64bit(skb, TCA_POLICE_TM, sizeof(t), &t, TCA_POLICE_PAD)) 302 goto nla_put_failure; 303 304 return skb->len; 305 306 nla_put_failure: 307 nlmsg_trim(skb, b); 308 return -1; 309 } 310 311 static int tcf_police_search(struct net *net, struct tc_action **a, u32 index) 312 { 313 struct tc_action_net *tn = net_generic(net, police_net_id); 314 315 return tcf_hash_search(tn, a, index); 316 } 317 318 MODULE_AUTHOR("Alexey Kuznetsov"); 319 MODULE_DESCRIPTION("Policing actions"); 320 MODULE_LICENSE("GPL"); 321 322 static struct tc_action_ops act_police_ops = { 323 .kind = "police", 324 .type = TCA_ID_POLICE, 325 .owner = THIS_MODULE, 326 .act = tcf_act_police, 327 .dump = tcf_act_police_dump, 328 .init = tcf_act_police_init, 329 .walk = tcf_act_police_walker, 330 .lookup = tcf_police_search, 331 .size = sizeof(struct tcf_police), 332 }; 333 334 static __net_init int police_init_net(struct net *net) 335 { 336 struct tc_action_net *tn = net_generic(net, police_net_id); 337 338 return tc_action_net_init(tn, &act_police_ops, POL_TAB_MASK); 339 } 340 341 static void __net_exit police_exit_net(struct net *net) 342 { 343 struct tc_action_net *tn = net_generic(net, police_net_id); 344 345 tc_action_net_exit(tn); 346 } 347 348 static struct pernet_operations police_net_ops = { 349 .init = police_init_net, 350 .exit = police_exit_net, 351 .id = &police_net_id, 352 .size = sizeof(struct tc_action_net), 353 }; 354 355 static int __init police_init_module(void) 356 { 357 return tcf_register_action(&act_police_ops, &police_net_ops); 358 } 359 360 static void __exit police_cleanup_module(void) 361 { 362 tcf_unregister_action(&act_police_ops, &police_net_ops); 363 } 364 365 module_init(police_init_module); 366 module_exit(police_cleanup_module); 367