Back to home page

OSCL-LXR
 
 

     

0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /*
0003  * net/sched/act_police.c   Input police filter
0004  *
0005  * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
0006  *      J Hadi Salim (action changes)
0007  */
0008 
0009 #include <linux/module.h>
0010 #include <linux/types.h>
0011 #include <linux/kernel.h>
0012 #include <linux/string.h>
0013 #include <linux/errno.h>
0014 #include <linux/skbuff.h>
0015 #include <linux/rtnetlink.h>
0016 #include <linux/init.h>
0017 #include <linux/slab.h>
0018 #include <net/act_api.h>
0019 #include <net/netlink.h>
0020 #include <net/pkt_cls.h>
0021 #include <net/tc_act/tc_police.h>
0022 
0023 /* Each policer is serialized by its individual spinlock */
0024 
0025 static unsigned int police_net_id;
0026 static struct tc_action_ops act_police_ops;
0027 
0028 static int tcf_police_walker(struct net *net, struct sk_buff *skb,
0029                  struct netlink_callback *cb, int type,
0030                  const struct tc_action_ops *ops,
0031                  struct netlink_ext_ack *extack)
0032 {
0033     struct tc_action_net *tn = net_generic(net, police_net_id);
0034 
0035     return tcf_generic_walker(tn, skb, cb, type, ops, extack);
0036 }
0037 
0038 static const struct nla_policy police_policy[TCA_POLICE_MAX + 1] = {
0039     [TCA_POLICE_RATE]   = { .len = TC_RTAB_SIZE },
0040     [TCA_POLICE_PEAKRATE]   = { .len = TC_RTAB_SIZE },
0041     [TCA_POLICE_AVRATE] = { .type = NLA_U32 },
0042     [TCA_POLICE_RESULT] = { .type = NLA_U32 },
0043     [TCA_POLICE_RATE64]     = { .type = NLA_U64 },
0044     [TCA_POLICE_PEAKRATE64] = { .type = NLA_U64 },
0045     [TCA_POLICE_PKTRATE64]  = { .type = NLA_U64, .min = 1 },
0046     [TCA_POLICE_PKTBURST64] = { .type = NLA_U64, .min = 1 },
0047 };
0048 
0049 static int tcf_police_init(struct net *net, struct nlattr *nla,
0050                    struct nlattr *est, struct tc_action **a,
0051                    struct tcf_proto *tp, u32 flags,
0052                    struct netlink_ext_ack *extack)
0053 {
0054     int ret = 0, tcfp_result = TC_ACT_OK, err, size;
0055     bool bind = flags & TCA_ACT_FLAGS_BIND;
0056     struct nlattr *tb[TCA_POLICE_MAX + 1];
0057     struct tcf_chain *goto_ch = NULL;
0058     struct tc_police *parm;
0059     struct tcf_police *police;
0060     struct qdisc_rate_table *R_tab = NULL, *P_tab = NULL;
0061     struct tc_action_net *tn = net_generic(net, police_net_id);
0062     struct tcf_police_params *new;
0063     bool exists = false;
0064     u32 index;
0065     u64 rate64, prate64;
0066     u64 pps, ppsburst;
0067 
0068     if (nla == NULL)
0069         return -EINVAL;
0070 
0071     err = nla_parse_nested_deprecated(tb, TCA_POLICE_MAX, nla,
0072                       police_policy, NULL);
0073     if (err < 0)
0074         return err;
0075 
0076     if (tb[TCA_POLICE_TBF] == NULL)
0077         return -EINVAL;
0078     size = nla_len(tb[TCA_POLICE_TBF]);
0079     if (size != sizeof(*parm) && size != sizeof(struct tc_police_compat))
0080         return -EINVAL;
0081 
0082     parm = nla_data(tb[TCA_POLICE_TBF]);
0083     index = parm->index;
0084     err = tcf_idr_check_alloc(tn, &index, a, bind);
0085     if (err < 0)
0086         return err;
0087     exists = err;
0088     if (exists && bind)
0089         return 0;
0090 
0091     if (!exists) {
0092         ret = tcf_idr_create(tn, index, NULL, a,
0093                      &act_police_ops, bind, true, flags);
0094         if (ret) {
0095             tcf_idr_cleanup(tn, index);
0096             return ret;
0097         }
0098         ret = ACT_P_CREATED;
0099         spin_lock_init(&(to_police(*a)->tcfp_lock));
0100     } else if (!(flags & TCA_ACT_FLAGS_REPLACE)) {
0101         tcf_idr_release(*a, bind);
0102         return -EEXIST;
0103     }
0104     err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch, extack);
0105     if (err < 0)
0106         goto release_idr;
0107 
0108     police = to_police(*a);
0109     if (parm->rate.rate) {
0110         err = -ENOMEM;
0111         R_tab = qdisc_get_rtab(&parm->rate, tb[TCA_POLICE_RATE], NULL);
0112         if (R_tab == NULL)
0113             goto failure;
0114 
0115         if (parm->peakrate.rate) {
0116             P_tab = qdisc_get_rtab(&parm->peakrate,
0117                            tb[TCA_POLICE_PEAKRATE], NULL);
0118             if (P_tab == NULL)
0119                 goto failure;
0120         }
0121     }
0122 
0123     if (est) {
0124         err = gen_replace_estimator(&police->tcf_bstats,
0125                         police->common.cpu_bstats,
0126                         &police->tcf_rate_est,
0127                         &police->tcf_lock,
0128                         false, est);
0129         if (err)
0130             goto failure;
0131     } else if (tb[TCA_POLICE_AVRATE] &&
0132            (ret == ACT_P_CREATED ||
0133             !gen_estimator_active(&police->tcf_rate_est))) {
0134         err = -EINVAL;
0135         goto failure;
0136     }
0137 
0138     if (tb[TCA_POLICE_RESULT]) {
0139         tcfp_result = nla_get_u32(tb[TCA_POLICE_RESULT]);
0140         if (TC_ACT_EXT_CMP(tcfp_result, TC_ACT_GOTO_CHAIN)) {
0141             NL_SET_ERR_MSG(extack,
0142                        "goto chain not allowed on fallback");
0143             err = -EINVAL;
0144             goto failure;
0145         }
0146     }
0147 
0148     if ((tb[TCA_POLICE_PKTRATE64] && !tb[TCA_POLICE_PKTBURST64]) ||
0149         (!tb[TCA_POLICE_PKTRATE64] && tb[TCA_POLICE_PKTBURST64])) {
0150         NL_SET_ERR_MSG(extack,
0151                    "Both or neither packet-per-second burst and rate must be provided");
0152         err = -EINVAL;
0153         goto failure;
0154     }
0155 
0156     if (tb[TCA_POLICE_PKTRATE64] && R_tab) {
0157         NL_SET_ERR_MSG(extack,
0158                    "packet-per-second and byte-per-second rate limits not allowed in same action");
0159         err = -EINVAL;
0160         goto failure;
0161     }
0162 
0163     new = kzalloc(sizeof(*new), GFP_KERNEL);
0164     if (unlikely(!new)) {
0165         err = -ENOMEM;
0166         goto failure;
0167     }
0168 
0169     /* No failure allowed after this point */
0170     new->tcfp_result = tcfp_result;
0171     new->tcfp_mtu = parm->mtu;
0172     if (!new->tcfp_mtu) {
0173         new->tcfp_mtu = ~0;
0174         if (R_tab)
0175             new->tcfp_mtu = 255 << R_tab->rate.cell_log;
0176     }
0177     if (R_tab) {
0178         new->rate_present = true;
0179         rate64 = tb[TCA_POLICE_RATE64] ?
0180              nla_get_u64(tb[TCA_POLICE_RATE64]) : 0;
0181         psched_ratecfg_precompute(&new->rate, &R_tab->rate, rate64);
0182         qdisc_put_rtab(R_tab);
0183     } else {
0184         new->rate_present = false;
0185     }
0186     if (P_tab) {
0187         new->peak_present = true;
0188         prate64 = tb[TCA_POLICE_PEAKRATE64] ?
0189               nla_get_u64(tb[TCA_POLICE_PEAKRATE64]) : 0;
0190         psched_ratecfg_precompute(&new->peak, &P_tab->rate, prate64);
0191         qdisc_put_rtab(P_tab);
0192     } else {
0193         new->peak_present = false;
0194     }
0195 
0196     new->tcfp_burst = PSCHED_TICKS2NS(parm->burst);
0197     if (new->peak_present)
0198         new->tcfp_mtu_ptoks = (s64)psched_l2t_ns(&new->peak,
0199                              new->tcfp_mtu);
0200 
0201     if (tb[TCA_POLICE_AVRATE])
0202         new->tcfp_ewma_rate = nla_get_u32(tb[TCA_POLICE_AVRATE]);
0203 
0204     if (tb[TCA_POLICE_PKTRATE64]) {
0205         pps = nla_get_u64(tb[TCA_POLICE_PKTRATE64]);
0206         ppsburst = nla_get_u64(tb[TCA_POLICE_PKTBURST64]);
0207         new->pps_present = true;
0208         new->tcfp_pkt_burst = PSCHED_TICKS2NS(ppsburst);
0209         psched_ppscfg_precompute(&new->ppsrate, pps);
0210     }
0211 
0212     spin_lock_bh(&police->tcf_lock);
0213     spin_lock_bh(&police->tcfp_lock);
0214     police->tcfp_t_c = ktime_get_ns();
0215     police->tcfp_toks = new->tcfp_burst;
0216     if (new->peak_present)
0217         police->tcfp_ptoks = new->tcfp_mtu_ptoks;
0218     spin_unlock_bh(&police->tcfp_lock);
0219     goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
0220     new = rcu_replace_pointer(police->params,
0221                   new,
0222                   lockdep_is_held(&police->tcf_lock));
0223     spin_unlock_bh(&police->tcf_lock);
0224 
0225     if (goto_ch)
0226         tcf_chain_put_by_act(goto_ch);
0227     if (new)
0228         kfree_rcu(new, rcu);
0229 
0230     return ret;
0231 
0232 failure:
0233     qdisc_put_rtab(P_tab);
0234     qdisc_put_rtab(R_tab);
0235     if (goto_ch)
0236         tcf_chain_put_by_act(goto_ch);
0237 release_idr:
0238     tcf_idr_release(*a, bind);
0239     return err;
0240 }
0241 
0242 static bool tcf_police_mtu_check(struct sk_buff *skb, u32 limit)
0243 {
0244     u32 len;
0245 
0246     if (skb_is_gso(skb))
0247         return skb_gso_validate_mac_len(skb, limit);
0248 
0249     len = qdisc_pkt_len(skb);
0250     if (skb_at_tc_ingress(skb))
0251         len += skb->mac_len;
0252 
0253     return len <= limit;
0254 }
0255 
0256 static int tcf_police_act(struct sk_buff *skb, const struct tc_action *a,
0257               struct tcf_result *res)
0258 {
0259     struct tcf_police *police = to_police(a);
0260     s64 now, toks, ppstoks = 0, ptoks = 0;
0261     struct tcf_police_params *p;
0262     int ret;
0263 
0264     tcf_lastuse_update(&police->tcf_tm);
0265     bstats_update(this_cpu_ptr(police->common.cpu_bstats), skb);
0266 
0267     ret = READ_ONCE(police->tcf_action);
0268     p = rcu_dereference_bh(police->params);
0269 
0270     if (p->tcfp_ewma_rate) {
0271         struct gnet_stats_rate_est64 sample;
0272 
0273         if (!gen_estimator_read(&police->tcf_rate_est, &sample) ||
0274             sample.bps >= p->tcfp_ewma_rate)
0275             goto inc_overlimits;
0276     }
0277 
0278     if (tcf_police_mtu_check(skb, p->tcfp_mtu)) {
0279         if (!p->rate_present && !p->pps_present) {
0280             ret = p->tcfp_result;
0281             goto end;
0282         }
0283 
0284         now = ktime_get_ns();
0285         spin_lock_bh(&police->tcfp_lock);
0286         toks = min_t(s64, now - police->tcfp_t_c, p->tcfp_burst);
0287         if (p->peak_present) {
0288             ptoks = toks + police->tcfp_ptoks;
0289             if (ptoks > p->tcfp_mtu_ptoks)
0290                 ptoks = p->tcfp_mtu_ptoks;
0291             ptoks -= (s64)psched_l2t_ns(&p->peak,
0292                             qdisc_pkt_len(skb));
0293         }
0294         if (p->rate_present) {
0295             toks += police->tcfp_toks;
0296             if (toks > p->tcfp_burst)
0297                 toks = p->tcfp_burst;
0298             toks -= (s64)psched_l2t_ns(&p->rate, qdisc_pkt_len(skb));
0299         } else if (p->pps_present) {
0300             ppstoks = min_t(s64, now - police->tcfp_t_c, p->tcfp_pkt_burst);
0301             ppstoks += police->tcfp_pkttoks;
0302             if (ppstoks > p->tcfp_pkt_burst)
0303                 ppstoks = p->tcfp_pkt_burst;
0304             ppstoks -= (s64)psched_pkt2t_ns(&p->ppsrate, 1);
0305         }
0306         if ((toks | ptoks | ppstoks) >= 0) {
0307             police->tcfp_t_c = now;
0308             police->tcfp_toks = toks;
0309             police->tcfp_ptoks = ptoks;
0310             police->tcfp_pkttoks = ppstoks;
0311             spin_unlock_bh(&police->tcfp_lock);
0312             ret = p->tcfp_result;
0313             goto inc_drops;
0314         }
0315         spin_unlock_bh(&police->tcfp_lock);
0316     }
0317 
0318 inc_overlimits:
0319     qstats_overlimit_inc(this_cpu_ptr(police->common.cpu_qstats));
0320 inc_drops:
0321     if (ret == TC_ACT_SHOT)
0322         qstats_drop_inc(this_cpu_ptr(police->common.cpu_qstats));
0323 end:
0324     return ret;
0325 }
0326 
0327 static void tcf_police_cleanup(struct tc_action *a)
0328 {
0329     struct tcf_police *police = to_police(a);
0330     struct tcf_police_params *p;
0331 
0332     p = rcu_dereference_protected(police->params, 1);
0333     if (p)
0334         kfree_rcu(p, rcu);
0335 }
0336 
0337 static void tcf_police_stats_update(struct tc_action *a,
0338                     u64 bytes, u64 packets, u64 drops,
0339                     u64 lastuse, bool hw)
0340 {
0341     struct tcf_police *police = to_police(a);
0342     struct tcf_t *tm = &police->tcf_tm;
0343 
0344     tcf_action_update_stats(a, bytes, packets, drops, hw);
0345     tm->lastuse = max_t(u64, tm->lastuse, lastuse);
0346 }
0347 
0348 static int tcf_police_dump(struct sk_buff *skb, struct tc_action *a,
0349                    int bind, int ref)
0350 {
0351     unsigned char *b = skb_tail_pointer(skb);
0352     struct tcf_police *police = to_police(a);
0353     struct tcf_police_params *p;
0354     struct tc_police opt = {
0355         .index = police->tcf_index,
0356         .refcnt = refcount_read(&police->tcf_refcnt) - ref,
0357         .bindcnt = atomic_read(&police->tcf_bindcnt) - bind,
0358     };
0359     struct tcf_t t;
0360 
0361     spin_lock_bh(&police->tcf_lock);
0362     opt.action = police->tcf_action;
0363     p = rcu_dereference_protected(police->params,
0364                       lockdep_is_held(&police->tcf_lock));
0365     opt.mtu = p->tcfp_mtu;
0366     opt.burst = PSCHED_NS2TICKS(p->tcfp_burst);
0367     if (p->rate_present) {
0368         psched_ratecfg_getrate(&opt.rate, &p->rate);
0369         if ((police->params->rate.rate_bytes_ps >= (1ULL << 32)) &&
0370             nla_put_u64_64bit(skb, TCA_POLICE_RATE64,
0371                       police->params->rate.rate_bytes_ps,
0372                       TCA_POLICE_PAD))
0373             goto nla_put_failure;
0374     }
0375     if (p->peak_present) {
0376         psched_ratecfg_getrate(&opt.peakrate, &p->peak);
0377         if ((police->params->peak.rate_bytes_ps >= (1ULL << 32)) &&
0378             nla_put_u64_64bit(skb, TCA_POLICE_PEAKRATE64,
0379                       police->params->peak.rate_bytes_ps,
0380                       TCA_POLICE_PAD))
0381             goto nla_put_failure;
0382     }
0383     if (p->pps_present) {
0384         if (nla_put_u64_64bit(skb, TCA_POLICE_PKTRATE64,
0385                       police->params->ppsrate.rate_pkts_ps,
0386                       TCA_POLICE_PAD))
0387             goto nla_put_failure;
0388         if (nla_put_u64_64bit(skb, TCA_POLICE_PKTBURST64,
0389                       PSCHED_NS2TICKS(p->tcfp_pkt_burst),
0390                       TCA_POLICE_PAD))
0391             goto nla_put_failure;
0392     }
0393     if (nla_put(skb, TCA_POLICE_TBF, sizeof(opt), &opt))
0394         goto nla_put_failure;
0395     if (p->tcfp_result &&
0396         nla_put_u32(skb, TCA_POLICE_RESULT, p->tcfp_result))
0397         goto nla_put_failure;
0398     if (p->tcfp_ewma_rate &&
0399         nla_put_u32(skb, TCA_POLICE_AVRATE, p->tcfp_ewma_rate))
0400         goto nla_put_failure;
0401 
0402     tcf_tm_dump(&t, &police->tcf_tm);
0403     if (nla_put_64bit(skb, TCA_POLICE_TM, sizeof(t), &t, TCA_POLICE_PAD))
0404         goto nla_put_failure;
0405     spin_unlock_bh(&police->tcf_lock);
0406 
0407     return skb->len;
0408 
0409 nla_put_failure:
0410     spin_unlock_bh(&police->tcf_lock);
0411     nlmsg_trim(skb, b);
0412     return -1;
0413 }
0414 
0415 static int tcf_police_search(struct net *net, struct tc_action **a, u32 index)
0416 {
0417     struct tc_action_net *tn = net_generic(net, police_net_id);
0418 
0419     return tcf_idr_search(tn, a, index);
0420 }
0421 
0422 static int tcf_police_act_to_flow_act(int tc_act, u32 *extval,
0423                       struct netlink_ext_ack *extack)
0424 {
0425     int act_id = -EOPNOTSUPP;
0426 
0427     if (!TC_ACT_EXT_OPCODE(tc_act)) {
0428         if (tc_act == TC_ACT_OK)
0429             act_id = FLOW_ACTION_ACCEPT;
0430         else if (tc_act ==  TC_ACT_SHOT)
0431             act_id = FLOW_ACTION_DROP;
0432         else if (tc_act == TC_ACT_PIPE)
0433             act_id = FLOW_ACTION_PIPE;
0434         else if (tc_act == TC_ACT_RECLASSIFY)
0435             NL_SET_ERR_MSG_MOD(extack, "Offload not supported when conform/exceed action is \"reclassify\"");
0436         else
0437             NL_SET_ERR_MSG_MOD(extack, "Unsupported conform/exceed action offload");
0438     } else if (TC_ACT_EXT_CMP(tc_act, TC_ACT_GOTO_CHAIN)) {
0439         act_id = FLOW_ACTION_GOTO;
0440         *extval = tc_act & TC_ACT_EXT_VAL_MASK;
0441     } else if (TC_ACT_EXT_CMP(tc_act, TC_ACT_JUMP)) {
0442         act_id = FLOW_ACTION_JUMP;
0443         *extval = tc_act & TC_ACT_EXT_VAL_MASK;
0444     } else if (tc_act == TC_ACT_UNSPEC) {
0445         act_id = FLOW_ACTION_CONTINUE;
0446     } else {
0447         NL_SET_ERR_MSG_MOD(extack, "Unsupported conform/exceed action offload");
0448     }
0449 
0450     return act_id;
0451 }
0452 
0453 static int tcf_police_offload_act_setup(struct tc_action *act, void *entry_data,
0454                     u32 *index_inc, bool bind,
0455                     struct netlink_ext_ack *extack)
0456 {
0457     if (bind) {
0458         struct flow_action_entry *entry = entry_data;
0459         struct tcf_police *police = to_police(act);
0460         struct tcf_police_params *p;
0461         int act_id;
0462 
0463         p = rcu_dereference_protected(police->params,
0464                           lockdep_is_held(&police->tcf_lock));
0465 
0466         entry->id = FLOW_ACTION_POLICE;
0467         entry->police.burst = tcf_police_burst(act);
0468         entry->police.rate_bytes_ps =
0469             tcf_police_rate_bytes_ps(act);
0470         entry->police.peakrate_bytes_ps = tcf_police_peakrate_bytes_ps(act);
0471         entry->police.avrate = tcf_police_tcfp_ewma_rate(act);
0472         entry->police.overhead = tcf_police_rate_overhead(act);
0473         entry->police.burst_pkt = tcf_police_burst_pkt(act);
0474         entry->police.rate_pkt_ps =
0475             tcf_police_rate_pkt_ps(act);
0476         entry->police.mtu = tcf_police_tcfp_mtu(act);
0477 
0478         act_id = tcf_police_act_to_flow_act(police->tcf_action,
0479                             &entry->police.exceed.extval,
0480                             extack);
0481         if (act_id < 0)
0482             return act_id;
0483 
0484         entry->police.exceed.act_id = act_id;
0485 
0486         act_id = tcf_police_act_to_flow_act(p->tcfp_result,
0487                             &entry->police.notexceed.extval,
0488                             extack);
0489         if (act_id < 0)
0490             return act_id;
0491 
0492         entry->police.notexceed.act_id = act_id;
0493 
0494         *index_inc = 1;
0495     } else {
0496         struct flow_offload_action *fl_action = entry_data;
0497 
0498         fl_action->id = FLOW_ACTION_POLICE;
0499     }
0500 
0501     return 0;
0502 }
0503 
0504 MODULE_AUTHOR("Alexey Kuznetsov");
0505 MODULE_DESCRIPTION("Policing actions");
0506 MODULE_LICENSE("GPL");
0507 
0508 static struct tc_action_ops act_police_ops = {
0509     .kind       =   "police",
0510     .id     =   TCA_ID_POLICE,
0511     .owner      =   THIS_MODULE,
0512     .stats_update   =   tcf_police_stats_update,
0513     .act        =   tcf_police_act,
0514     .dump       =   tcf_police_dump,
0515     .init       =   tcf_police_init,
0516     .walk       =   tcf_police_walker,
0517     .lookup     =   tcf_police_search,
0518     .cleanup    =   tcf_police_cleanup,
0519     .offload_act_setup =    tcf_police_offload_act_setup,
0520     .size       =   sizeof(struct tcf_police),
0521 };
0522 
0523 static __net_init int police_init_net(struct net *net)
0524 {
0525     struct tc_action_net *tn = net_generic(net, police_net_id);
0526 
0527     return tc_action_net_init(net, tn, &act_police_ops);
0528 }
0529 
0530 static void __net_exit police_exit_net(struct list_head *net_list)
0531 {
0532     tc_action_net_exit(net_list, police_net_id);
0533 }
0534 
0535 static struct pernet_operations police_net_ops = {
0536     .init = police_init_net,
0537     .exit_batch = police_exit_net,
0538     .id   = &police_net_id,
0539     .size = sizeof(struct tc_action_net),
0540 };
0541 
0542 static int __init police_init_module(void)
0543 {
0544     return tcf_register_action(&act_police_ops, &police_net_ops);
0545 }
0546 
0547 static void __exit police_cleanup_module(void)
0548 {
0549     tcf_unregister_action(&act_police_ops, &police_net_ops);
0550 }
0551 
0552 module_init(police_init_module);
0553 module_exit(police_cleanup_module);
[ Source navigation ] [ Diff markup ] [ Identifier search ] [ general search ]

This page was automatically generated by the 2.1.0 LXR engine.

The LXR team
Valid CSS 2.1! Valid HTML 4.01!