1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * net/sched/act_police.c Input police filter
4 *
5 * Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
6 * J Hadi Salim (action changes)
7 */
8
9 #include <linux/module.h>
10 #include <linux/types.h>
11 #include <linux/kernel.h>
12 #include <linux/string.h>
13 #include <linux/errno.h>
14 #include <linux/skbuff.h>
15 #include <linux/rtnetlink.h>
16 #include <linux/init.h>
17 #include <linux/slab.h>
18 #include <net/act_api.h>
19 #include <net/netlink.h>
20 #include <net/pkt_cls.h>
21 #include <net/tc_act/tc_police.h>
22
23 /* Each policer is serialized by its individual spinlock */
24
25 static unsigned int police_net_id;
26 static struct tc_action_ops act_police_ops;
27
tcf_police_walker(struct net * net,struct sk_buff * skb,struct netlink_callback * cb,int type,const struct tc_action_ops * ops,struct netlink_ext_ack * extack)28 static int tcf_police_walker(struct net *net, struct sk_buff *skb,
29 struct netlink_callback *cb, int type,
30 const struct tc_action_ops *ops,
31 struct netlink_ext_ack *extack)
32 {
33 struct tc_action_net *tn = net_generic(net, police_net_id);
34
35 return tcf_generic_walker(tn, skb, cb, type, ops, extack);
36 }
37
38 static const struct nla_policy police_policy[TCA_POLICE_MAX + 1] = {
39 [TCA_POLICE_RATE] = { .len = TC_RTAB_SIZE },
40 [TCA_POLICE_PEAKRATE] = { .len = TC_RTAB_SIZE },
41 [TCA_POLICE_AVRATE] = { .type = NLA_U32 },
42 [TCA_POLICE_RESULT] = { .type = NLA_U32 },
43 [TCA_POLICE_RATE64] = { .type = NLA_U64 },
44 [TCA_POLICE_PEAKRATE64] = { .type = NLA_U64 },
45 [TCA_POLICE_PKTRATE64] = { .type = NLA_U64, .min = 1 },
46 [TCA_POLICE_PKTBURST64] = { .type = NLA_U64, .min = 1 },
47 };
48
tcf_police_init(struct net * net,struct nlattr * nla,struct nlattr * est,struct tc_action ** a,struct tcf_proto * tp,u32 flags,struct netlink_ext_ack * extack)49 static int tcf_police_init(struct net *net, struct nlattr *nla,
50 struct nlattr *est, struct tc_action **a,
51 struct tcf_proto *tp, u32 flags,
52 struct netlink_ext_ack *extack)
53 {
54 int ret = 0, tcfp_result = TC_ACT_OK, err, size;
55 bool bind = flags & TCA_ACT_FLAGS_BIND;
56 struct nlattr *tb[TCA_POLICE_MAX + 1];
57 struct tcf_chain *goto_ch = NULL;
58 struct tc_police *parm;
59 struct tcf_police *police;
60 struct qdisc_rate_table *R_tab = NULL, *P_tab = NULL;
61 struct tc_action_net *tn = net_generic(net, police_net_id);
62 struct tcf_police_params *new;
63 bool exists = false;
64 u32 index;
65 u64 rate64, prate64;
66 u64 pps, ppsburst;
67
68 if (nla == NULL)
69 return -EINVAL;
70
71 err = nla_parse_nested_deprecated(tb, TCA_POLICE_MAX, nla,
72 police_policy, NULL);
73 if (err < 0)
74 return err;
75
76 if (tb[TCA_POLICE_TBF] == NULL)
77 return -EINVAL;
78 size = nla_len(tb[TCA_POLICE_TBF]);
79 if (size != sizeof(*parm) && size != sizeof(struct tc_police_compat))
80 return -EINVAL;
81
82 parm = nla_data(tb[TCA_POLICE_TBF]);
83 index = parm->index;
84 err = tcf_idr_check_alloc(tn, &index, a, bind);
85 if (err < 0)
86 return err;
87 exists = err;
88 if (exists && bind)
89 return 0;
90
91 if (!exists) {
92 ret = tcf_idr_create(tn, index, NULL, a,
93 &act_police_ops, bind, true, 0);
94 if (ret) {
95 tcf_idr_cleanup(tn, index);
96 return ret;
97 }
98 ret = ACT_P_CREATED;
99 spin_lock_init(&(to_police(*a)->tcfp_lock));
100 } else if (!(flags & TCA_ACT_FLAGS_REPLACE)) {
101 tcf_idr_release(*a, bind);
102 return -EEXIST;
103 }
104 err = tcf_action_check_ctrlact(parm->action, tp, &goto_ch, extack);
105 if (err < 0)
106 goto release_idr;
107
108 police = to_police(*a);
109 if (parm->rate.rate) {
110 err = -ENOMEM;
111 R_tab = qdisc_get_rtab(&parm->rate, tb[TCA_POLICE_RATE], NULL);
112 if (R_tab == NULL)
113 goto failure;
114
115 if (parm->peakrate.rate) {
116 P_tab = qdisc_get_rtab(&parm->peakrate,
117 tb[TCA_POLICE_PEAKRATE], NULL);
118 if (P_tab == NULL)
119 goto failure;
120 }
121 }
122
123 if (est) {
124 err = gen_replace_estimator(&police->tcf_bstats,
125 police->common.cpu_bstats,
126 &police->tcf_rate_est,
127 &police->tcf_lock,
128 NULL, est);
129 if (err)
130 goto failure;
131 } else if (tb[TCA_POLICE_AVRATE] &&
132 (ret == ACT_P_CREATED ||
133 !gen_estimator_active(&police->tcf_rate_est))) {
134 err = -EINVAL;
135 goto failure;
136 }
137
138 if (tb[TCA_POLICE_RESULT]) {
139 tcfp_result = nla_get_u32(tb[TCA_POLICE_RESULT]);
140 if (TC_ACT_EXT_CMP(tcfp_result, TC_ACT_GOTO_CHAIN)) {
141 NL_SET_ERR_MSG(extack,
142 "goto chain not allowed on fallback");
143 err = -EINVAL;
144 goto failure;
145 }
146 }
147
148 if ((tb[TCA_POLICE_PKTRATE64] && !tb[TCA_POLICE_PKTBURST64]) ||
149 (!tb[TCA_POLICE_PKTRATE64] && tb[TCA_POLICE_PKTBURST64])) {
150 NL_SET_ERR_MSG(extack,
151 "Both or neither packet-per-second burst and rate must be provided");
152 err = -EINVAL;
153 goto failure;
154 }
155
156 if (tb[TCA_POLICE_PKTRATE64] && R_tab) {
157 NL_SET_ERR_MSG(extack,
158 "packet-per-second and byte-per-second rate limits not allowed in same action");
159 err = -EINVAL;
160 goto failure;
161 }
162
163 new = kzalloc(sizeof(*new), GFP_KERNEL);
164 if (unlikely(!new)) {
165 err = -ENOMEM;
166 goto failure;
167 }
168
169 /* No failure allowed after this point */
170 new->tcfp_result = tcfp_result;
171 new->tcfp_mtu = parm->mtu;
172 if (!new->tcfp_mtu) {
173 new->tcfp_mtu = ~0;
174 if (R_tab)
175 new->tcfp_mtu = 255 << R_tab->rate.cell_log;
176 }
177 if (R_tab) {
178 new->rate_present = true;
179 rate64 = tb[TCA_POLICE_RATE64] ?
180 nla_get_u64(tb[TCA_POLICE_RATE64]) : 0;
181 psched_ratecfg_precompute(&new->rate, &R_tab->rate, rate64);
182 qdisc_put_rtab(R_tab);
183 } else {
184 new->rate_present = false;
185 }
186 if (P_tab) {
187 new->peak_present = true;
188 prate64 = tb[TCA_POLICE_PEAKRATE64] ?
189 nla_get_u64(tb[TCA_POLICE_PEAKRATE64]) : 0;
190 psched_ratecfg_precompute(&new->peak, &P_tab->rate, prate64);
191 qdisc_put_rtab(P_tab);
192 } else {
193 new->peak_present = false;
194 }
195
196 new->tcfp_burst = PSCHED_TICKS2NS(parm->burst);
197 if (new->peak_present)
198 new->tcfp_mtu_ptoks = (s64)psched_l2t_ns(&new->peak,
199 new->tcfp_mtu);
200
201 if (tb[TCA_POLICE_AVRATE])
202 new->tcfp_ewma_rate = nla_get_u32(tb[TCA_POLICE_AVRATE]);
203
204 if (tb[TCA_POLICE_PKTRATE64]) {
205 pps = nla_get_u64(tb[TCA_POLICE_PKTRATE64]);
206 ppsburst = nla_get_u64(tb[TCA_POLICE_PKTBURST64]);
207 new->pps_present = true;
208 new->tcfp_pkt_burst = PSCHED_TICKS2NS(ppsburst);
209 psched_ppscfg_precompute(&new->ppsrate, pps);
210 }
211
212 spin_lock_bh(&police->tcf_lock);
213 spin_lock_bh(&police->tcfp_lock);
214 police->tcfp_t_c = ktime_get_ns();
215 police->tcfp_toks = new->tcfp_burst;
216 if (new->peak_present)
217 police->tcfp_ptoks = new->tcfp_mtu_ptoks;
218 spin_unlock_bh(&police->tcfp_lock);
219 goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
220 new = rcu_replace_pointer(police->params,
221 new,
222 lockdep_is_held(&police->tcf_lock));
223 spin_unlock_bh(&police->tcf_lock);
224
225 if (goto_ch)
226 tcf_chain_put_by_act(goto_ch);
227 if (new)
228 kfree_rcu(new, rcu);
229
230 return ret;
231
232 failure:
233 qdisc_put_rtab(P_tab);
234 qdisc_put_rtab(R_tab);
235 if (goto_ch)
236 tcf_chain_put_by_act(goto_ch);
237 release_idr:
238 tcf_idr_release(*a, bind);
239 return err;
240 }
241
tcf_police_act(struct sk_buff * skb,const struct tc_action * a,struct tcf_result * res)242 static int tcf_police_act(struct sk_buff *skb, const struct tc_action *a,
243 struct tcf_result *res)
244 {
245 struct tcf_police *police = to_police(a);
246 s64 now, toks, ppstoks = 0, ptoks = 0;
247 struct tcf_police_params *p;
248 int ret;
249
250 tcf_lastuse_update(&police->tcf_tm);
251 bstats_cpu_update(this_cpu_ptr(police->common.cpu_bstats), skb);
252
253 ret = READ_ONCE(police->tcf_action);
254 p = rcu_dereference_bh(police->params);
255
256 if (p->tcfp_ewma_rate) {
257 struct gnet_stats_rate_est64 sample;
258
259 if (!gen_estimator_read(&police->tcf_rate_est, &sample) ||
260 sample.bps >= p->tcfp_ewma_rate)
261 goto inc_overlimits;
262 }
263
264 if (qdisc_pkt_len(skb) <= p->tcfp_mtu) {
265 if (!p->rate_present && !p->pps_present) {
266 ret = p->tcfp_result;
267 goto end;
268 }
269
270 now = ktime_get_ns();
271 spin_lock_bh(&police->tcfp_lock);
272 toks = min_t(s64, now - police->tcfp_t_c, p->tcfp_burst);
273 if (p->peak_present) {
274 ptoks = toks + police->tcfp_ptoks;
275 if (ptoks > p->tcfp_mtu_ptoks)
276 ptoks = p->tcfp_mtu_ptoks;
277 ptoks -= (s64)psched_l2t_ns(&p->peak,
278 qdisc_pkt_len(skb));
279 }
280 if (p->rate_present) {
281 toks += police->tcfp_toks;
282 if (toks > p->tcfp_burst)
283 toks = p->tcfp_burst;
284 toks -= (s64)psched_l2t_ns(&p->rate, qdisc_pkt_len(skb));
285 } else if (p->pps_present) {
286 ppstoks = min_t(s64, now - police->tcfp_t_c, p->tcfp_pkt_burst);
287 ppstoks += police->tcfp_pkttoks;
288 if (ppstoks > p->tcfp_pkt_burst)
289 ppstoks = p->tcfp_pkt_burst;
290 ppstoks -= (s64)psched_pkt2t_ns(&p->ppsrate, 1);
291 }
292 if ((toks | ptoks | ppstoks) >= 0) {
293 police->tcfp_t_c = now;
294 police->tcfp_toks = toks;
295 police->tcfp_ptoks = ptoks;
296 police->tcfp_pkttoks = ppstoks;
297 spin_unlock_bh(&police->tcfp_lock);
298 ret = p->tcfp_result;
299 goto inc_drops;
300 }
301 spin_unlock_bh(&police->tcfp_lock);
302 }
303
304 inc_overlimits:
305 qstats_overlimit_inc(this_cpu_ptr(police->common.cpu_qstats));
306 inc_drops:
307 if (ret == TC_ACT_SHOT)
308 qstats_drop_inc(this_cpu_ptr(police->common.cpu_qstats));
309 end:
310 return ret;
311 }
312
tcf_police_cleanup(struct tc_action * a)313 static void tcf_police_cleanup(struct tc_action *a)
314 {
315 struct tcf_police *police = to_police(a);
316 struct tcf_police_params *p;
317
318 p = rcu_dereference_protected(police->params, 1);
319 if (p)
320 kfree_rcu(p, rcu);
321 }
322
tcf_police_stats_update(struct tc_action * a,u64 bytes,u64 packets,u64 drops,u64 lastuse,bool hw)323 static void tcf_police_stats_update(struct tc_action *a,
324 u64 bytes, u64 packets, u64 drops,
325 u64 lastuse, bool hw)
326 {
327 struct tcf_police *police = to_police(a);
328 struct tcf_t *tm = &police->tcf_tm;
329
330 tcf_action_update_stats(a, bytes, packets, drops, hw);
331 tm->lastuse = max_t(u64, tm->lastuse, lastuse);
332 }
333
tcf_police_dump(struct sk_buff * skb,struct tc_action * a,int bind,int ref)334 static int tcf_police_dump(struct sk_buff *skb, struct tc_action *a,
335 int bind, int ref)
336 {
337 unsigned char *b = skb_tail_pointer(skb);
338 struct tcf_police *police = to_police(a);
339 struct tcf_police_params *p;
340 struct tc_police opt = {
341 .index = police->tcf_index,
342 .refcnt = refcount_read(&police->tcf_refcnt) - ref,
343 .bindcnt = atomic_read(&police->tcf_bindcnt) - bind,
344 };
345 struct tcf_t t;
346
347 spin_lock_bh(&police->tcf_lock);
348 opt.action = police->tcf_action;
349 p = rcu_dereference_protected(police->params,
350 lockdep_is_held(&police->tcf_lock));
351 opt.mtu = p->tcfp_mtu;
352 opt.burst = PSCHED_NS2TICKS(p->tcfp_burst);
353 if (p->rate_present) {
354 psched_ratecfg_getrate(&opt.rate, &p->rate);
355 if ((police->params->rate.rate_bytes_ps >= (1ULL << 32)) &&
356 nla_put_u64_64bit(skb, TCA_POLICE_RATE64,
357 police->params->rate.rate_bytes_ps,
358 TCA_POLICE_PAD))
359 goto nla_put_failure;
360 }
361 if (p->peak_present) {
362 psched_ratecfg_getrate(&opt.peakrate, &p->peak);
363 if ((police->params->peak.rate_bytes_ps >= (1ULL << 32)) &&
364 nla_put_u64_64bit(skb, TCA_POLICE_PEAKRATE64,
365 police->params->peak.rate_bytes_ps,
366 TCA_POLICE_PAD))
367 goto nla_put_failure;
368 }
369 if (p->pps_present) {
370 if (nla_put_u64_64bit(skb, TCA_POLICE_PKTRATE64,
371 police->params->ppsrate.rate_pkts_ps,
372 TCA_POLICE_PAD))
373 goto nla_put_failure;
374 if (nla_put_u64_64bit(skb, TCA_POLICE_PKTBURST64,
375 PSCHED_NS2TICKS(p->tcfp_pkt_burst),
376 TCA_POLICE_PAD))
377 goto nla_put_failure;
378 }
379 if (nla_put(skb, TCA_POLICE_TBF, sizeof(opt), &opt))
380 goto nla_put_failure;
381 if (p->tcfp_result &&
382 nla_put_u32(skb, TCA_POLICE_RESULT, p->tcfp_result))
383 goto nla_put_failure;
384 if (p->tcfp_ewma_rate &&
385 nla_put_u32(skb, TCA_POLICE_AVRATE, p->tcfp_ewma_rate))
386 goto nla_put_failure;
387
388 tcf_tm_dump(&t, &police->tcf_tm);
389 if (nla_put_64bit(skb, TCA_POLICE_TM, sizeof(t), &t, TCA_POLICE_PAD))
390 goto nla_put_failure;
391 spin_unlock_bh(&police->tcf_lock);
392
393 return skb->len;
394
395 nla_put_failure:
396 spin_unlock_bh(&police->tcf_lock);
397 nlmsg_trim(skb, b);
398 return -1;
399 }
400
tcf_police_search(struct net * net,struct tc_action ** a,u32 index)401 static int tcf_police_search(struct net *net, struct tc_action **a, u32 index)
402 {
403 struct tc_action_net *tn = net_generic(net, police_net_id);
404
405 return tcf_idr_search(tn, a, index);
406 }
407
408 MODULE_AUTHOR("Alexey Kuznetsov");
409 MODULE_DESCRIPTION("Policing actions");
410 MODULE_LICENSE("GPL");
411
412 static struct tc_action_ops act_police_ops = {
413 .kind = "police",
414 .id = TCA_ID_POLICE,
415 .owner = THIS_MODULE,
416 .stats_update = tcf_police_stats_update,
417 .act = tcf_police_act,
418 .dump = tcf_police_dump,
419 .init = tcf_police_init,
420 .walk = tcf_police_walker,
421 .lookup = tcf_police_search,
422 .cleanup = tcf_police_cleanup,
423 .size = sizeof(struct tcf_police),
424 };
425
police_init_net(struct net * net)426 static __net_init int police_init_net(struct net *net)
427 {
428 struct tc_action_net *tn = net_generic(net, police_net_id);
429
430 return tc_action_net_init(net, tn, &act_police_ops);
431 }
432
police_exit_net(struct list_head * net_list)433 static void __net_exit police_exit_net(struct list_head *net_list)
434 {
435 tc_action_net_exit(net_list, police_net_id);
436 }
437
438 static struct pernet_operations police_net_ops = {
439 .init = police_init_net,
440 .exit_batch = police_exit_net,
441 .id = &police_net_id,
442 .size = sizeof(struct tc_action_net),
443 };
444
police_init_module(void)445 static int __init police_init_module(void)
446 {
447 return tcf_register_action(&act_police_ops, &police_net_ops);
448 }
449
police_cleanup_module(void)450 static void __exit police_cleanup_module(void)
451 {
452 tcf_unregister_action(&act_police_ops, &police_net_ops);
453 }
454
455 module_init(police_init_module);
456 module_exit(police_cleanup_module);
457
