1 /* 2 * net/sched/act_police.c Input police filter 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 7 * 2 of the License, or (at your option) any later version. 8 * 9 * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> 10 * J Hadi Salim (action changes) 11 */ 12 13 #include <linux/module.h> 14 #include <linux/types.h> 15 #include <linux/kernel.h> 16 #include <linux/string.h> 17 #include <linux/errno.h> 18 #include <linux/skbuff.h> 19 #include <linux/rtnetlink.h> 20 #include <linux/init.h> 21 #include <linux/slab.h> 22 #include <net/act_api.h> 23 #include <net/netlink.h> 24 25 struct tcf_police { 26 struct tc_action common; 27 int tcfp_result; 28 u32 tcfp_ewma_rate; 29 s64 tcfp_burst; 30 u32 tcfp_mtu; 31 s64 tcfp_toks; 32 s64 tcfp_ptoks; 33 s64 tcfp_mtu_ptoks; 34 s64 tcfp_t_c; 35 struct psched_ratecfg rate; 36 bool rate_present; 37 struct psched_ratecfg peak; 38 bool peak_present; 39 }; 40 41 #define to_police(pc) ((struct tcf_police *)pc) 42 43 /* old policer structure from before tc actions */ 44 struct tc_police_compat { 45 u32 index; 46 int action; 47 u32 limit; 48 u32 burst; 49 u32 mtu; 50 struct tc_ratespec rate; 51 struct tc_ratespec peakrate; 52 }; 53 54 /* Each policer is serialized by its individual spinlock */ 55 56 static unsigned int police_net_id; 57 static struct tc_action_ops act_police_ops; 58 59 static int tcf_police_walker(struct net *net, struct sk_buff *skb, 60 struct netlink_callback *cb, int type, 61 const struct tc_action_ops *ops, 62 struct netlink_ext_ack *extack) 63 { 64 struct tc_action_net *tn = net_generic(net, police_net_id); 65 66 return tcf_generic_walker(tn, skb, cb, type, ops, extack); 67 } 68 69 static const struct nla_policy police_policy[TCA_POLICE_MAX + 1] = { 70 [TCA_POLICE_RATE] = { .len = TC_RTAB_SIZE }, 71 [TCA_POLICE_PEAKRATE] = { .len = TC_RTAB_SIZE }, 72 [TCA_POLICE_AVRATE] = { .type = NLA_U32 }, 73 [TCA_POLICE_RESULT] = { .type = NLA_U32 }, 74 }; 75 76 static int tcf_police_init(struct net *net, struct nlattr *nla, 77 struct nlattr *est, struct tc_action **a, 78 int ovr, int bind, bool rtnl_held, 79 struct netlink_ext_ack *extack) 80 { 81 int ret = 0, err; 82 struct nlattr *tb[TCA_POLICE_MAX + 1]; 83 struct tc_police *parm; 84 struct tcf_police *police; 85 struct qdisc_rate_table *R_tab = NULL, *P_tab = NULL; 86 struct tc_action_net *tn = net_generic(net, police_net_id); 87 bool exists = false; 88 int size; 89 90 if (nla == NULL) 91 return -EINVAL; 92 93 err = nla_parse_nested(tb, TCA_POLICE_MAX, nla, police_policy, NULL); 94 if (err < 0) 95 return err; 96 97 if (tb[TCA_POLICE_TBF] == NULL) 98 return -EINVAL; 99 size = nla_len(tb[TCA_POLICE_TBF]); 100 if (size != sizeof(*parm) && size != sizeof(struct tc_police_compat)) 101 return -EINVAL; 102 103 parm = nla_data(tb[TCA_POLICE_TBF]); 104 err = tcf_idr_check_alloc(tn, &parm->index, a, bind); 105 if (err < 0) 106 return err; 107 exists = err; 108 if (exists && bind) 109 return 0; 110 111 if (!exists) { 112 ret = tcf_idr_create(tn, parm->index, NULL, a, 113 &act_police_ops, bind, false); 114 if (ret) { 115 tcf_idr_cleanup(tn, parm->index); 116 return ret; 117 } 118 ret = ACT_P_CREATED; 119 } else if (!ovr) { 120 tcf_idr_release(*a, bind); 121 return -EEXIST; 122 } 123 124 police = to_police(*a); 125 if (parm->rate.rate) { 126 err = -ENOMEM; 127 R_tab = qdisc_get_rtab(&parm->rate, tb[TCA_POLICE_RATE], NULL); 128 if (R_tab == NULL) 129 goto failure; 130 131 if (parm->peakrate.rate) { 132 P_tab = qdisc_get_rtab(&parm->peakrate, 133 tb[TCA_POLICE_PEAKRATE], NULL); 134 if (P_tab == NULL) 135 goto failure; 136 } 137 } 138 139 if (est) { 140 err = gen_replace_estimator(&police->tcf_bstats, NULL, 141 &police->tcf_rate_est, 142 &police->tcf_lock, 143 NULL, est); 144 if (err) 145 goto failure; 146 } else if (tb[TCA_POLICE_AVRATE] && 147 (ret == ACT_P_CREATED || 148 !gen_estimator_active(&police->tcf_rate_est))) { 149 err = -EINVAL; 150 goto failure; 151 } 152 153 spin_lock_bh(&police->tcf_lock); 154 /* No failure allowed after this point */ 155 police->tcfp_mtu = parm->mtu; 156 if (police->tcfp_mtu == 0) { 157 police->tcfp_mtu = ~0; 158 if (R_tab) 159 police->tcfp_mtu = 255 << R_tab->rate.cell_log; 160 } 161 if (R_tab) { 162 police->rate_present = true; 163 psched_ratecfg_precompute(&police->rate, &R_tab->rate, 0); 164 qdisc_put_rtab(R_tab); 165 } else { 166 police->rate_present = false; 167 } 168 if (P_tab) { 169 police->peak_present = true; 170 psched_ratecfg_precompute(&police->peak, &P_tab->rate, 0); 171 qdisc_put_rtab(P_tab); 172 } else { 173 police->peak_present = false; 174 } 175 176 if (tb[TCA_POLICE_RESULT]) 177 police->tcfp_result = nla_get_u32(tb[TCA_POLICE_RESULT]); 178 police->tcfp_burst = PSCHED_TICKS2NS(parm->burst); 179 police->tcfp_toks = police->tcfp_burst; 180 if (police->peak_present) { 181 police->tcfp_mtu_ptoks = (s64) psched_l2t_ns(&police->peak, 182 police->tcfp_mtu); 183 police->tcfp_ptoks = police->tcfp_mtu_ptoks; 184 } 185 police->tcf_action = parm->action; 186 187 if (tb[TCA_POLICE_AVRATE]) 188 police->tcfp_ewma_rate = nla_get_u32(tb[TCA_POLICE_AVRATE]); 189 190 spin_unlock_bh(&police->tcf_lock); 191 if (ret != ACT_P_CREATED) 192 return ret; 193 194 police->tcfp_t_c = ktime_get_ns(); 195 tcf_idr_insert(tn, *a); 196 197 return ret; 198 199 failure: 200 qdisc_put_rtab(P_tab); 201 qdisc_put_rtab(R_tab); 202 tcf_idr_release(*a, bind); 203 return err; 204 } 205 206 static int tcf_police_act(struct sk_buff *skb, const struct tc_action *a, 207 struct tcf_result *res) 208 { 209 struct tcf_police *police = to_police(a); 210 s64 now; 211 s64 toks; 212 s64 ptoks = 0; 213 214 spin_lock(&police->tcf_lock); 215 216 bstats_update(&police->tcf_bstats, skb); 217 tcf_lastuse_update(&police->tcf_tm); 218 219 if (police->tcfp_ewma_rate) { 220 struct gnet_stats_rate_est64 sample; 221 222 if (!gen_estimator_read(&police->tcf_rate_est, &sample) || 223 sample.bps >= police->tcfp_ewma_rate) { 224 police->tcf_qstats.overlimits++; 225 if (police->tcf_action == TC_ACT_SHOT) 226 police->tcf_qstats.drops++; 227 spin_unlock(&police->tcf_lock); 228 return police->tcf_action; 229 } 230 } 231 232 if (qdisc_pkt_len(skb) <= police->tcfp_mtu) { 233 if (!police->rate_present) { 234 spin_unlock(&police->tcf_lock); 235 return police->tcfp_result; 236 } 237 238 now = ktime_get_ns(); 239 toks = min_t(s64, now - police->tcfp_t_c, 240 police->tcfp_burst); 241 if (police->peak_present) { 242 ptoks = toks + police->tcfp_ptoks; 243 if (ptoks > police->tcfp_mtu_ptoks) 244 ptoks = police->tcfp_mtu_ptoks; 245 ptoks -= (s64) psched_l2t_ns(&police->peak, 246 qdisc_pkt_len(skb)); 247 } 248 toks += police->tcfp_toks; 249 if (toks > police->tcfp_burst) 250 toks = police->tcfp_burst; 251 toks -= (s64) psched_l2t_ns(&police->rate, qdisc_pkt_len(skb)); 252 if ((toks|ptoks) >= 0) { 253 police->tcfp_t_c = now; 254 police->tcfp_toks = toks; 255 police->tcfp_ptoks = ptoks; 256 if (police->tcfp_result == TC_ACT_SHOT) 257 police->tcf_qstats.drops++; 258 spin_unlock(&police->tcf_lock); 259 return police->tcfp_result; 260 } 261 } 262 263 police->tcf_qstats.overlimits++; 264 if (police->tcf_action == TC_ACT_SHOT) 265 police->tcf_qstats.drops++; 266 spin_unlock(&police->tcf_lock); 267 return police->tcf_action; 268 } 269 270 static int tcf_police_dump(struct sk_buff *skb, struct tc_action *a, 271 int bind, int ref) 272 { 273 unsigned char *b = skb_tail_pointer(skb); 274 struct tcf_police *police = to_police(a); 275 struct tc_police opt = { 276 .index = police->tcf_index, 277 .refcnt = refcount_read(&police->tcf_refcnt) - ref, 278 .bindcnt = atomic_read(&police->tcf_bindcnt) - bind, 279 }; 280 struct tcf_t t; 281 282 spin_lock_bh(&police->tcf_lock); 283 opt.action = police->tcf_action; 284 opt.mtu = police->tcfp_mtu; 285 opt.burst = PSCHED_NS2TICKS(police->tcfp_burst); 286 if (police->rate_present) 287 psched_ratecfg_getrate(&opt.rate, &police->rate); 288 if (police->peak_present) 289 psched_ratecfg_getrate(&opt.peakrate, &police->peak); 290 if (nla_put(skb, TCA_POLICE_TBF, sizeof(opt), &opt)) 291 goto nla_put_failure; 292 if (police->tcfp_result && 293 nla_put_u32(skb, TCA_POLICE_RESULT, police->tcfp_result)) 294 goto nla_put_failure; 295 if (police->tcfp_ewma_rate && 296 nla_put_u32(skb, TCA_POLICE_AVRATE, police->tcfp_ewma_rate)) 297 goto nla_put_failure; 298 299 t.install = jiffies_to_clock_t(jiffies - police->tcf_tm.install); 300 t.lastuse = jiffies_to_clock_t(jiffies - police->tcf_tm.lastuse); 301 t.firstuse = jiffies_to_clock_t(jiffies - police->tcf_tm.firstuse); 302 t.expires = jiffies_to_clock_t(police->tcf_tm.expires); 303 if (nla_put_64bit(skb, TCA_POLICE_TM, sizeof(t), &t, TCA_POLICE_PAD)) 304 goto nla_put_failure; 305 spin_unlock_bh(&police->tcf_lock); 306 307 return skb->len; 308 309 nla_put_failure: 310 spin_unlock_bh(&police->tcf_lock); 311 nlmsg_trim(skb, b); 312 return -1; 313 } 314 315 static int tcf_police_search(struct net *net, struct tc_action **a, u32 index, 316 struct netlink_ext_ack *extack) 317 { 318 struct tc_action_net *tn = net_generic(net, police_net_id); 319 320 return tcf_idr_search(tn, a, index); 321 } 322 323 static int tcf_police_delete(struct net *net, u32 index) 324 { 325 struct tc_action_net *tn = net_generic(net, police_net_id); 326 327 return tcf_idr_delete_index(tn, index); 328 } 329 330 MODULE_AUTHOR("Alexey Kuznetsov"); 331 MODULE_DESCRIPTION("Policing actions"); 332 MODULE_LICENSE("GPL"); 333 334 static struct tc_action_ops act_police_ops = { 335 .kind = "police", 336 .type = TCA_ID_POLICE, 337 .owner = THIS_MODULE, 338 .act = tcf_police_act, 339 .dump = tcf_police_dump, 340 .init = tcf_police_init, 341 .walk = tcf_police_walker, 342 .lookup = tcf_police_search, 343 .delete = tcf_police_delete, 344 .size = sizeof(struct tcf_police), 345 }; 346 347 static __net_init int police_init_net(struct net *net) 348 { 349 struct tc_action_net *tn = net_generic(net, police_net_id); 350 351 return tc_action_net_init(tn, &act_police_ops); 352 } 353 354 static void __net_exit police_exit_net(struct list_head *net_list) 355 { 356 tc_action_net_exit(net_list, police_net_id); 357 } 358 359 static struct pernet_operations police_net_ops = { 360 .init = police_init_net, 361 .exit_batch = police_exit_net, 362 .id = &police_net_id, 363 .size = sizeof(struct tc_action_net), 364 }; 365 366 static int __init police_init_module(void) 367 { 368 return tcf_register_action(&act_police_ops, &police_net_ops); 369 } 370 371 static void __exit police_cleanup_module(void) 372 { 373 tcf_unregister_action(&act_police_ops, &police_net_ops); 374 } 375 376 module_init(police_init_module); 377 module_exit(police_cleanup_module); 378