1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * net/sched/sch_api.c	Packet scheduler API.
4  *
5  * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
6  *
7  * Fixes:
8  *
9  * Rani Assaf <rani@magic.metawire.com> :980802: JIFFIES and CPU clock sources are repaired.
10  * Eduardo J. Blanco <ejbs@netlabs.com.uy> :990222: kmod support
11  * Jamal Hadi Salim <hadi@nortelnetworks.com>: 990601: ingress support
12  */
13 
14 #include <linux/module.h>
15 #include <linux/types.h>
16 #include <linux/kernel.h>
17 #include <linux/string.h>
18 #include <linux/errno.h>
19 #include <linux/skbuff.h>
20 #include <linux/init.h>
21 #include <linux/proc_fs.h>
22 #include <linux/seq_file.h>
23 #include <linux/kmod.h>
24 #include <linux/list.h>
25 #include <linux/hrtimer.h>
26 #include <linux/slab.h>
27 #include <linux/hashtable.h>
28 #include <linux/bpf.h>
29 
30 #include <net/netdev_lock.h>
31 #include <net/net_namespace.h>
32 #include <net/sock.h>
33 #include <net/netlink.h>
34 #include <net/pkt_sched.h>
35 #include <net/pkt_cls.h>
36 #include <net/tc_wrapper.h>
37 
38 #include <trace/events/qdisc.h>
39 
40 /*
41 
42    Short review.
43    -------------
44 
45    This file consists of two interrelated parts:
46 
47    1. queueing disciplines manager frontend.
48    2. traffic classes manager frontend.
49 
50    Generally, queueing discipline ("qdisc") is a black box,
51    which is able to enqueue packets and to dequeue them (when
52    device is ready to send something) in order and at times
53    determined by algorithm hidden in it.
54 
55    qdisc's are divided to two categories:
56    - "queues", which have no internal structure visible from outside.
57    - "schedulers", which split all the packets to "traffic classes",
58      using "packet classifiers" (look at cls_api.c)
59 
60    In turn, classes may have child qdiscs (as rule, queues)
61    attached to them etc. etc. etc.
62 
63    The goal of the routines in this file is to translate
64    information supplied by user in the form of handles
65    to more intelligible for kernel form, to make some sanity
66    checks and part of work, which is common to all qdiscs
67    and to provide rtnetlink notifications.
68 
69    All real intelligent work is done inside qdisc modules.
70 
71 
72 
73    Every discipline has two major routines: enqueue and dequeue.
74 
75    ---dequeue
76 
77    dequeue usually returns a skb to send. It is allowed to return NULL,
78    but it does not mean that queue is empty, it just means that
79    discipline does not want to send anything this time.
80    Queue is really empty if q->q.qlen == 0.
81    For complicated disciplines with multiple queues q->q is not
82    real packet queue, but however q->q.qlen must be valid.
83 
84    ---enqueue
85 
86    enqueue returns 0, if packet was enqueued successfully.
87    If packet (this one or another one) was dropped, it returns
88    not zero error code.
89    NET_XMIT_DROP 	- this packet dropped
90      Expected action: do not backoff, but wait until queue will clear.
91    NET_XMIT_CN	 	- probably this packet enqueued, but another one dropped.
92      Expected action: backoff or ignore
93 
94    Auxiliary routines:
95 
96    ---peek
97 
98    like dequeue but without removing a packet from the queue
99 
100    ---reset
101 
102    returns qdisc to initial state: purge all buffers, clear all
103    timers, counters (except for statistics) etc.
104 
105    ---init
106 
107    initializes newly created qdisc.
108 
109    ---destroy
110 
111    destroys resources allocated by init and during lifetime of qdisc.
112 
113    ---change
114 
115    changes qdisc parameters.
116  */
117 
118 /* Protects list of registered TC modules. It is pure SMP lock. */
119 static DEFINE_RWLOCK(qdisc_mod_lock);
120 
121 
122 /************************************************
123  *	Queueing disciplines manipulation.	*
124  ************************************************/
125 
126 
127 /* The list of all installed queueing disciplines. */
128 
129 static struct Qdisc_ops *qdisc_base;
130 
131 /* Register/unregister queueing discipline */
132 
133 int register_qdisc(struct Qdisc_ops *qops)
134 {
135 	struct Qdisc_ops *q, **qp;
136 	int rc = -EEXIST;
137 
138 	write_lock(&qdisc_mod_lock);
139 	for (qp = &qdisc_base; (q = *qp) != NULL; qp = &q->next)
140 		if (!strcmp(qops->id, q->id))
141 			goto out;
142 
143 	if (qops->enqueue == NULL)
144 		qops->enqueue = noop_qdisc_ops.enqueue;
145 	if (qops->peek == NULL) {
146 		if (qops->dequeue == NULL)
147 			qops->peek = noop_qdisc_ops.peek;
148 		else
149 			goto out_einval;
150 	}
151 	if (qops->dequeue == NULL)
152 		qops->dequeue = noop_qdisc_ops.dequeue;
153 
154 	if (qops->cl_ops) {
155 		const struct Qdisc_class_ops *cops = qops->cl_ops;
156 
157 		if (!(cops->find && cops->walk && cops->leaf))
158 			goto out_einval;
159 
160 		if (cops->tcf_block && !(cops->bind_tcf && cops->unbind_tcf))
161 			goto out_einval;
162 	}
163 
164 	qops->next = NULL;
165 	*qp = qops;
166 	rc = 0;
167 out:
168 	write_unlock(&qdisc_mod_lock);
169 	return rc;
170 
171 out_einval:
172 	rc = -EINVAL;
173 	goto out;
174 }
175 EXPORT_SYMBOL(register_qdisc);
176 
177 void unregister_qdisc(struct Qdisc_ops *qops)
178 {
179 	struct Qdisc_ops *q, **qp;
180 	int err = -ENOENT;
181 
182 	write_lock(&qdisc_mod_lock);
183 	for (qp = &qdisc_base; (q = *qp) != NULL; qp = &q->next)
184 		if (q == qops)
185 			break;
186 	if (q) {
187 		*qp = q->next;
188 		q->next = NULL;
189 		err = 0;
190 	}
191 	write_unlock(&qdisc_mod_lock);
192 
193 	WARN(err, "unregister qdisc(%s) failed\n", qops->id);
194 }
195 EXPORT_SYMBOL(unregister_qdisc);
196 
197 /* Get default qdisc if not otherwise specified */
198 void qdisc_get_default(char *name, size_t len)
199 {
200 	read_lock(&qdisc_mod_lock);
201 	strscpy(name, default_qdisc_ops->id, len);
202 	read_unlock(&qdisc_mod_lock);
203 }
204 
205 static struct Qdisc_ops *qdisc_lookup_default(const char *name)
206 {
207 	struct Qdisc_ops *q = NULL;
208 
209 	for (q = qdisc_base; q; q = q->next) {
210 		if (!strcmp(name, q->id)) {
211 			if (!bpf_try_module_get(q, q->owner))
212 				q = NULL;
213 			break;
214 		}
215 	}
216 
217 	return q;
218 }
219 
220 /* Set new default qdisc to use */
221 int qdisc_set_default(const char *name)
222 {
223 	const struct Qdisc_ops *ops;
224 
225 	if (!capable(CAP_NET_ADMIN))
226 		return -EPERM;
227 
228 	write_lock(&qdisc_mod_lock);
229 	ops = qdisc_lookup_default(name);
230 	if (!ops) {
231 		/* Not found, drop lock and try to load module */
232 		write_unlock(&qdisc_mod_lock);
233 		request_module(NET_SCH_ALIAS_PREFIX "%s", name);
234 		write_lock(&qdisc_mod_lock);
235 
236 		ops = qdisc_lookup_default(name);
237 	}
238 
239 	if (ops) {
240 		/* Set new default */
241 		bpf_module_put(default_qdisc_ops, default_qdisc_ops->owner);
242 		default_qdisc_ops = ops;
243 	}
244 	write_unlock(&qdisc_mod_lock);
245 
246 	return ops ? 0 : -ENOENT;
247 }
248 
249 #ifdef CONFIG_NET_SCH_DEFAULT
250 /* Set default value from kernel config */
251 static int __init sch_default_qdisc(void)
252 {
253 	return qdisc_set_default(CONFIG_DEFAULT_NET_SCH);
254 }
255 late_initcall(sch_default_qdisc);
256 #endif
257 
258 /* We know handle. Find qdisc among all qdisc's attached to device
259  * (root qdisc, all its children, children of children etc.)
260  * Note: caller either uses rtnl or rcu_read_lock()
261  */
262 
263 static struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
264 {
265 	struct Qdisc *q;
266 
267 	if (!qdisc_dev(root))
268 		return (root->handle == handle ? root : NULL);
269 
270 	if (!(root->flags & TCQ_F_BUILTIN) &&
271 	    root->handle == handle)
272 		return root;
273 
274 	hash_for_each_possible_rcu(qdisc_dev(root)->qdisc_hash, q, hash, handle,
275 				   lockdep_rtnl_is_held()) {
276 		if (q->handle == handle)
277 			return q;
278 	}
279 	return NULL;
280 }
281 
282 void qdisc_hash_add(struct Qdisc *q, bool invisible)
283 {
284 	if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) {
285 		ASSERT_RTNL();
286 		hash_add_rcu(qdisc_dev(q)->qdisc_hash, &q->hash, q->handle);
287 		if (invisible)
288 			q->flags |= TCQ_F_INVISIBLE;
289 	}
290 }
291 EXPORT_SYMBOL(qdisc_hash_add);
292 
293 void qdisc_hash_del(struct Qdisc *q)
294 {
295 	if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) {
296 		ASSERT_RTNL();
297 		hash_del_rcu(&q->hash);
298 	}
299 }
300 EXPORT_SYMBOL(qdisc_hash_del);
301 
302 struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle)
303 {
304 	struct Qdisc *q;
305 
306 	if (!handle)
307 		return NULL;
308 	q = qdisc_match_from_root(rtnl_dereference(dev->qdisc), handle);
309 	if (q)
310 		goto out;
311 
312 	if (dev_ingress_queue(dev))
313 		q = qdisc_match_from_root(
314 			rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping),
315 			handle);
316 out:
317 	return q;
318 }
319 
320 struct Qdisc *qdisc_lookup_rcu(struct net_device *dev, u32 handle)
321 {
322 	struct netdev_queue *nq;
323 	struct Qdisc *q;
324 
325 	if (!handle)
326 		return NULL;
327 	q = qdisc_match_from_root(rcu_dereference(dev->qdisc), handle);
328 	if (q)
329 		goto out;
330 
331 	nq = dev_ingress_queue_rcu(dev);
332 	if (nq)
333 		q = qdisc_match_from_root(rcu_dereference(nq->qdisc_sleeping),
334 					  handle);
335 out:
336 	return q;
337 }
338 
339 static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid)
340 {
341 	unsigned long cl;
342 	const struct Qdisc_class_ops *cops = p->ops->cl_ops;
343 
344 	if (cops == NULL)
345 		return NULL;
346 	cl = cops->find(p, classid);
347 
348 	if (cl == 0)
349 		return NULL;
350 	return cops->leaf(p, cl);
351 }
352 
353 /* Find queueing discipline by name */
354 
355 static struct Qdisc_ops *qdisc_lookup_ops(struct nlattr *kind)
356 {
357 	struct Qdisc_ops *q = NULL;
358 
359 	if (kind) {
360 		read_lock(&qdisc_mod_lock);
361 		for (q = qdisc_base; q; q = q->next) {
362 			if (nla_strcmp(kind, q->id) == 0) {
363 				if (!bpf_try_module_get(q, q->owner))
364 					q = NULL;
365 				break;
366 			}
367 		}
368 		read_unlock(&qdisc_mod_lock);
369 	}
370 	return q;
371 }
372 
373 /* The linklayer setting were not transferred from iproute2, in older
374  * versions, and the rate tables lookup systems have been dropped in
375  * the kernel. To keep backward compatible with older iproute2 tc
376  * utils, we detect the linklayer setting by detecting if the rate
377  * table were modified.
378  *
379  * For linklayer ATM table entries, the rate table will be aligned to
380  * 48 bytes, thus some table entries will contain the same value.  The
381  * mpu (min packet unit) is also encoded into the old rate table, thus
382  * starting from the mpu, we find low and high table entries for
383  * mapping this cell.  If these entries contain the same value, when
384  * the rate tables have been modified for linklayer ATM.
385  *
386  * This is done by rounding mpu to the nearest 48 bytes cell/entry,
387  * and then roundup to the next cell, calc the table entry one below,
388  * and compare.
389  */
390 static __u8 __detect_linklayer(struct tc_ratespec *r, __u32 *rtab)
391 {
392 	int low       = roundup(r->mpu, 48);
393 	int high      = roundup(low+1, 48);
394 	int cell_low  = low >> r->cell_log;
395 	int cell_high = (high >> r->cell_log) - 1;
396 
397 	/* rtab is too inaccurate at rates > 100Mbit/s */
398 	if ((r->rate > (100000000/8)) || (rtab[0] == 0)) {
399 		pr_debug("TC linklayer: Giving up ATM detection\n");
400 		return TC_LINKLAYER_ETHERNET;
401 	}
402 
403 	if ((cell_high > cell_low) && (cell_high < 256)
404 	    && (rtab[cell_low] == rtab[cell_high])) {
405 		pr_debug("TC linklayer: Detected ATM, low(%d)=high(%d)=%u\n",
406 			 cell_low, cell_high, rtab[cell_high]);
407 		return TC_LINKLAYER_ATM;
408 	}
409 	return TC_LINKLAYER_ETHERNET;
410 }
411 
412 static struct qdisc_rate_table *qdisc_rtab_list;
413 
414 struct qdisc_rate_table *qdisc_get_rtab(struct tc_ratespec *r,
415 					struct nlattr *tab,
416 					struct netlink_ext_ack *extack)
417 {
418 	struct qdisc_rate_table *rtab;
419 
420 	if (tab == NULL || r->rate == 0 ||
421 	    r->cell_log == 0 || r->cell_log >= 32 ||
422 	    nla_len(tab) != TC_RTAB_SIZE) {
423 		NL_SET_ERR_MSG(extack, "Invalid rate table parameters for searching");
424 		return NULL;
425 	}
426 
427 	for (rtab = qdisc_rtab_list; rtab; rtab = rtab->next) {
428 		if (!memcmp(&rtab->rate, r, sizeof(struct tc_ratespec)) &&
429 		    !memcmp(&rtab->data, nla_data(tab), 1024)) {
430 			rtab->refcnt++;
431 			return rtab;
432 		}
433 	}
434 
435 	rtab = kmalloc(sizeof(*rtab), GFP_KERNEL);
436 	if (rtab) {
437 		rtab->rate = *r;
438 		rtab->refcnt = 1;
439 		memcpy(rtab->data, nla_data(tab), 1024);
440 		if (r->linklayer == TC_LINKLAYER_UNAWARE)
441 			r->linklayer = __detect_linklayer(r, rtab->data);
442 		rtab->next = qdisc_rtab_list;
443 		qdisc_rtab_list = rtab;
444 	} else {
445 		NL_SET_ERR_MSG(extack, "Failed to allocate new qdisc rate table");
446 	}
447 	return rtab;
448 }
449 EXPORT_SYMBOL(qdisc_get_rtab);
450 
451 void qdisc_put_rtab(struct qdisc_rate_table *tab)
452 {
453 	struct qdisc_rate_table *rtab, **rtabp;
454 
455 	if (!tab || --tab->refcnt)
456 		return;
457 
458 	for (rtabp = &qdisc_rtab_list;
459 	     (rtab = *rtabp) != NULL;
460 	     rtabp = &rtab->next) {
461 		if (rtab == tab) {
462 			*rtabp = rtab->next;
463 			kfree(rtab);
464 			return;
465 		}
466 	}
467 }
468 EXPORT_SYMBOL(qdisc_put_rtab);
469 
470 static LIST_HEAD(qdisc_stab_list);
471 
472 static const struct nla_policy stab_policy[TCA_STAB_MAX + 1] = {
473 	[TCA_STAB_BASE]	= { .len = sizeof(struct tc_sizespec) },
474 	[TCA_STAB_DATA] = { .type = NLA_BINARY },
475 };
476 
477 static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt,
478 					       struct netlink_ext_ack *extack)
479 {
480 	struct nlattr *tb[TCA_STAB_MAX + 1];
481 	struct qdisc_size_table *stab;
482 	struct tc_sizespec *s;
483 	unsigned int tsize = 0;
484 	u16 *tab = NULL;
485 	int err;
486 
487 	err = nla_parse_nested_deprecated(tb, TCA_STAB_MAX, opt, stab_policy,
488 					  extack);
489 	if (err < 0)
490 		return ERR_PTR(err);
491 	if (!tb[TCA_STAB_BASE]) {
492 		NL_SET_ERR_MSG(extack, "Size table base attribute is missing");
493 		return ERR_PTR(-EINVAL);
494 	}
495 
496 	s = nla_data(tb[TCA_STAB_BASE]);
497 
498 	if (s->tsize > 0) {
499 		if (!tb[TCA_STAB_DATA]) {
500 			NL_SET_ERR_MSG(extack, "Size table data attribute is missing");
501 			return ERR_PTR(-EINVAL);
502 		}
503 		tab = nla_data(tb[TCA_STAB_DATA]);
504 		tsize = nla_len(tb[TCA_STAB_DATA]) / sizeof(u16);
505 	}
506 
507 	if (tsize != s->tsize || (!tab && tsize > 0)) {
508 		NL_SET_ERR_MSG(extack, "Invalid size of size table");
509 		return ERR_PTR(-EINVAL);
510 	}
511 
512 	list_for_each_entry(stab, &qdisc_stab_list, list) {
513 		if (memcmp(&stab->szopts, s, sizeof(*s)))
514 			continue;
515 		if (tsize > 0 &&
516 		    memcmp(stab->data, tab, flex_array_size(stab, data, tsize)))
517 			continue;
518 		stab->refcnt++;
519 		return stab;
520 	}
521 
522 	if (s->size_log > STAB_SIZE_LOG_MAX ||
523 	    s->cell_log > STAB_SIZE_LOG_MAX) {
524 		NL_SET_ERR_MSG(extack, "Invalid logarithmic size of size table");
525 		return ERR_PTR(-EINVAL);
526 	}
527 
528 	stab = kmalloc(struct_size(stab, data, tsize), GFP_KERNEL);
529 	if (!stab)
530 		return ERR_PTR(-ENOMEM);
531 
532 	stab->refcnt = 1;
533 	stab->szopts = *s;
534 	if (tsize > 0)
535 		memcpy(stab->data, tab, flex_array_size(stab, data, tsize));
536 
537 	list_add_tail(&stab->list, &qdisc_stab_list);
538 
539 	return stab;
540 }
541 
542 void qdisc_put_stab(struct qdisc_size_table *tab)
543 {
544 	if (!tab)
545 		return;
546 
547 	if (--tab->refcnt == 0) {
548 		list_del(&tab->list);
549 		kfree_rcu(tab, rcu);
550 	}
551 }
552 EXPORT_SYMBOL(qdisc_put_stab);
553 
554 static int qdisc_dump_stab(struct sk_buff *skb, struct qdisc_size_table *stab)
555 {
556 	struct nlattr *nest;
557 
558 	nest = nla_nest_start_noflag(skb, TCA_STAB);
559 	if (nest == NULL)
560 		goto nla_put_failure;
561 	if (nla_put(skb, TCA_STAB_BASE, sizeof(stab->szopts), &stab->szopts))
562 		goto nla_put_failure;
563 	nla_nest_end(skb, nest);
564 
565 	return skb->len;
566 
567 nla_put_failure:
568 	return -1;
569 }
570 
571 void __qdisc_calculate_pkt_len(struct sk_buff *skb,
572 			       const struct qdisc_size_table *stab)
573 {
574 	int pkt_len, slot;
575 
576 	pkt_len = skb->len + stab->szopts.overhead;
577 	if (unlikely(!stab->szopts.tsize))
578 		goto out;
579 
580 	slot = pkt_len + stab->szopts.cell_align;
581 	if (unlikely(slot < 0))
582 		slot = 0;
583 
584 	slot >>= stab->szopts.cell_log;
585 	if (likely(slot < stab->szopts.tsize))
586 		pkt_len = stab->data[slot];
587 	else
588 		pkt_len = stab->data[stab->szopts.tsize - 1] *
589 				(slot / stab->szopts.tsize) +
590 				stab->data[slot % stab->szopts.tsize];
591 
592 	pkt_len <<= stab->szopts.size_log;
593 out:
594 	if (unlikely(pkt_len < 1))
595 		pkt_len = 1;
596 	qdisc_skb_cb(skb)->pkt_len = pkt_len;
597 }
598 
599 void qdisc_warn_nonwc(const char *txt, struct Qdisc *qdisc)
600 {
601 	if (!(qdisc->flags & TCQ_F_WARN_NONWC)) {
602 		pr_warn("%s: %s qdisc %X: is non-work-conserving?\n",
603 			txt, qdisc->ops->id, qdisc->handle >> 16);
604 		qdisc->flags |= TCQ_F_WARN_NONWC;
605 	}
606 }
607 EXPORT_SYMBOL(qdisc_warn_nonwc);
608 
609 static enum hrtimer_restart qdisc_watchdog(struct hrtimer *timer)
610 {
611 	struct qdisc_watchdog *wd = container_of(timer, struct qdisc_watchdog,
612 						 timer);
613 
614 	rcu_read_lock();
615 	__netif_schedule(qdisc_root(wd->qdisc));
616 	rcu_read_unlock();
617 
618 	return HRTIMER_NORESTART;
619 }
620 
621 void qdisc_watchdog_init_clockid(struct qdisc_watchdog *wd, struct Qdisc *qdisc,
622 				 clockid_t clockid)
623 {
624 	hrtimer_setup(&wd->timer, qdisc_watchdog, clockid, HRTIMER_MODE_ABS_PINNED);
625 	wd->qdisc = qdisc;
626 }
627 EXPORT_SYMBOL(qdisc_watchdog_init_clockid);
628 
629 void qdisc_watchdog_init(struct qdisc_watchdog *wd, struct Qdisc *qdisc)
630 {
631 	qdisc_watchdog_init_clockid(wd, qdisc, CLOCK_MONOTONIC);
632 }
633 EXPORT_SYMBOL(qdisc_watchdog_init);
634 
635 void qdisc_watchdog_schedule_range_ns(struct qdisc_watchdog *wd, u64 expires,
636 				      u64 delta_ns)
637 {
638 	bool deactivated;
639 
640 	rcu_read_lock();
641 	deactivated = test_bit(__QDISC_STATE_DEACTIVATED,
642 			       &qdisc_root_sleeping(wd->qdisc)->state);
643 	rcu_read_unlock();
644 	if (deactivated)
645 		return;
646 
647 	if (hrtimer_is_queued(&wd->timer)) {
648 		u64 softexpires;
649 
650 		softexpires = ktime_to_ns(hrtimer_get_softexpires(&wd->timer));
651 		/* If timer is already set in [expires, expires + delta_ns],
652 		 * do not reprogram it.
653 		 */
654 		if (softexpires - expires <= delta_ns)
655 			return;
656 	}
657 
658 	hrtimer_start_range_ns(&wd->timer,
659 			       ns_to_ktime(expires),
660 			       delta_ns,
661 			       HRTIMER_MODE_ABS_PINNED);
662 }
663 EXPORT_SYMBOL(qdisc_watchdog_schedule_range_ns);
664 
665 void qdisc_watchdog_cancel(struct qdisc_watchdog *wd)
666 {
667 	hrtimer_cancel(&wd->timer);
668 }
669 EXPORT_SYMBOL(qdisc_watchdog_cancel);
670 
671 static struct hlist_head *qdisc_class_hash_alloc(unsigned int n)
672 {
673 	struct hlist_head *h;
674 	unsigned int i;
675 
676 	h = kvmalloc_array(n, sizeof(struct hlist_head), GFP_KERNEL);
677 
678 	if (h != NULL) {
679 		for (i = 0; i < n; i++)
680 			INIT_HLIST_HEAD(&h[i]);
681 	}
682 	return h;
683 }
684 
685 void qdisc_class_hash_grow(struct Qdisc *sch, struct Qdisc_class_hash *clhash)
686 {
687 	struct Qdisc_class_common *cl;
688 	struct hlist_node *next;
689 	struct hlist_head *nhash, *ohash;
690 	unsigned int nsize, nmask, osize;
691 	unsigned int i, h;
692 
693 	/* Rehash when load factor exceeds 0.75 */
694 	if (clhash->hashelems * 4 <= clhash->hashsize * 3)
695 		return;
696 	nsize = clhash->hashsize * 2;
697 	nmask = nsize - 1;
698 	nhash = qdisc_class_hash_alloc(nsize);
699 	if (nhash == NULL)
700 		return;
701 
702 	ohash = clhash->hash;
703 	osize = clhash->hashsize;
704 
705 	sch_tree_lock(sch);
706 	for (i = 0; i < osize; i++) {
707 		hlist_for_each_entry_safe(cl, next, &ohash[i], hnode) {
708 			h = qdisc_class_hash(cl->classid, nmask);
709 			hlist_add_head(&cl->hnode, &nhash[h]);
710 		}
711 	}
712 	clhash->hash     = nhash;
713 	clhash->hashsize = nsize;
714 	clhash->hashmask = nmask;
715 	sch_tree_unlock(sch);
716 
717 	kvfree(ohash);
718 }
719 EXPORT_SYMBOL(qdisc_class_hash_grow);
720 
721 int qdisc_class_hash_init(struct Qdisc_class_hash *clhash)
722 {
723 	unsigned int size = 4;
724 
725 	clhash->hash = qdisc_class_hash_alloc(size);
726 	if (!clhash->hash)
727 		return -ENOMEM;
728 	clhash->hashsize  = size;
729 	clhash->hashmask  = size - 1;
730 	clhash->hashelems = 0;
731 	return 0;
732 }
733 EXPORT_SYMBOL(qdisc_class_hash_init);
734 
735 void qdisc_class_hash_destroy(struct Qdisc_class_hash *clhash)
736 {
737 	kvfree(clhash->hash);
738 }
739 EXPORT_SYMBOL(qdisc_class_hash_destroy);
740 
741 void qdisc_class_hash_insert(struct Qdisc_class_hash *clhash,
742 			     struct Qdisc_class_common *cl)
743 {
744 	unsigned int h;
745 
746 	INIT_HLIST_NODE(&cl->hnode);
747 	h = qdisc_class_hash(cl->classid, clhash->hashmask);
748 	hlist_add_head(&cl->hnode, &clhash->hash[h]);
749 	clhash->hashelems++;
750 }
751 EXPORT_SYMBOL(qdisc_class_hash_insert);
752 
753 void qdisc_class_hash_remove(struct Qdisc_class_hash *clhash,
754 			     struct Qdisc_class_common *cl)
755 {
756 	hlist_del(&cl->hnode);
757 	clhash->hashelems--;
758 }
759 EXPORT_SYMBOL(qdisc_class_hash_remove);
760 
761 /* Allocate an unique handle from space managed by kernel
762  * Possible range is [8000-FFFF]:0000 (0x8000 values)
763  */
764 static u32 qdisc_alloc_handle(struct net_device *dev)
765 {
766 	int i = 0x8000;
767 	static u32 autohandle = TC_H_MAKE(0x80000000U, 0);
768 
769 	do {
770 		autohandle += TC_H_MAKE(0x10000U, 0);
771 		if (autohandle == TC_H_MAKE(TC_H_ROOT, 0))
772 			autohandle = TC_H_MAKE(0x80000000U, 0);
773 		if (!qdisc_lookup(dev, autohandle))
774 			return autohandle;
775 		cond_resched();
776 	} while	(--i > 0);
777 
778 	return 0;
779 }
780 
781 void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len)
782 {
783 	bool qdisc_is_offloaded = sch->flags & TCQ_F_OFFLOADED;
784 	const struct Qdisc_class_ops *cops;
785 	unsigned long cl;
786 	u32 parentid;
787 	bool notify;
788 	int drops;
789 
790 	if (n == 0 && len == 0)
791 		return;
792 	drops = max_t(int, n, 0);
793 	rcu_read_lock();
794 	while ((parentid = sch->parent)) {
795 		if (parentid == TC_H_ROOT)
796 			break;
797 
798 		if (sch->flags & TCQ_F_NOPARENT)
799 			break;
800 		/* Notify parent qdisc only if child qdisc becomes empty.
801 		 *
802 		 * If child was empty even before update then backlog
803 		 * counter is screwed and we skip notification because
804 		 * parent class is already passive.
805 		 *
806 		 * If the original child was offloaded then it is allowed
807 		 * to be seem as empty, so the parent is notified anyway.
808 		 */
809 		notify = !sch->q.qlen && !WARN_ON_ONCE(!n &&
810 						       !qdisc_is_offloaded);
811 		/* TODO: perform the search on a per txq basis */
812 		sch = qdisc_lookup_rcu(qdisc_dev(sch), TC_H_MAJ(parentid));
813 		if (sch == NULL) {
814 			WARN_ON_ONCE(parentid != TC_H_ROOT);
815 			break;
816 		}
817 		cops = sch->ops->cl_ops;
818 		if (notify && cops->qlen_notify) {
819 			cl = cops->find(sch, parentid);
820 			cops->qlen_notify(sch, cl);
821 		}
822 		sch->q.qlen -= n;
823 		sch->qstats.backlog -= len;
824 		__qdisc_qstats_drop(sch, drops);
825 	}
826 	rcu_read_unlock();
827 }
828 EXPORT_SYMBOL(qdisc_tree_reduce_backlog);
829 
830 int qdisc_offload_dump_helper(struct Qdisc *sch, enum tc_setup_type type,
831 			      void *type_data)
832 {
833 	struct net_device *dev = qdisc_dev(sch);
834 	int err;
835 
836 	sch->flags &= ~TCQ_F_OFFLOADED;
837 	if (!tc_can_offload(dev) || !dev->netdev_ops->ndo_setup_tc)
838 		return 0;
839 
840 	err = dev->netdev_ops->ndo_setup_tc(dev, type, type_data);
841 	if (err == -EOPNOTSUPP)
842 		return 0;
843 
844 	if (!err)
845 		sch->flags |= TCQ_F_OFFLOADED;
846 
847 	return err;
848 }
849 EXPORT_SYMBOL(qdisc_offload_dump_helper);
850 
851 void qdisc_offload_graft_helper(struct net_device *dev, struct Qdisc *sch,
852 				struct Qdisc *new, struct Qdisc *old,
853 				enum tc_setup_type type, void *type_data,
854 				struct netlink_ext_ack *extack)
855 {
856 	bool any_qdisc_is_offloaded;
857 	int err;
858 
859 	if (!tc_can_offload(dev) || !dev->netdev_ops->ndo_setup_tc)
860 		return;
861 
862 	err = dev->netdev_ops->ndo_setup_tc(dev, type, type_data);
863 
864 	/* Don't report error if the graft is part of destroy operation. */
865 	if (!err || !new || new == &noop_qdisc)
866 		return;
867 
868 	/* Don't report error if the parent, the old child and the new
869 	 * one are not offloaded.
870 	 */
871 	any_qdisc_is_offloaded = new->flags & TCQ_F_OFFLOADED;
872 	any_qdisc_is_offloaded |= sch && sch->flags & TCQ_F_OFFLOADED;
873 	any_qdisc_is_offloaded |= old && old->flags & TCQ_F_OFFLOADED;
874 
875 	if (any_qdisc_is_offloaded)
876 		NL_SET_ERR_MSG(extack, "Offloading graft operation failed.");
877 }
878 EXPORT_SYMBOL(qdisc_offload_graft_helper);
879 
880 void qdisc_offload_query_caps(struct net_device *dev,
881 			      enum tc_setup_type type,
882 			      void *caps, size_t caps_len)
883 {
884 	const struct net_device_ops *ops = dev->netdev_ops;
885 	struct tc_query_caps_base base = {
886 		.type = type,
887 		.caps = caps,
888 	};
889 
890 	memset(caps, 0, caps_len);
891 
892 	if (ops->ndo_setup_tc)
893 		ops->ndo_setup_tc(dev, TC_QUERY_CAPS, &base);
894 }
895 EXPORT_SYMBOL(qdisc_offload_query_caps);
896 
897 static void qdisc_offload_graft_root(struct net_device *dev,
898 				     struct Qdisc *new, struct Qdisc *old,
899 				     struct netlink_ext_ack *extack)
900 {
901 	struct tc_root_qopt_offload graft_offload = {
902 		.command	= TC_ROOT_GRAFT,
903 		.handle		= new ? new->handle : 0,
904 		.ingress	= (new && new->flags & TCQ_F_INGRESS) ||
905 				  (old && old->flags & TCQ_F_INGRESS),
906 	};
907 
908 	qdisc_offload_graft_helper(dev, NULL, new, old,
909 				   TC_SETUP_ROOT_QDISC, &graft_offload, extack);
910 }
911 
912 static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid,
913 			 u32 portid, u32 seq, u16 flags, int event,
914 			 struct netlink_ext_ack *extack)
915 {
916 	struct gnet_stats_basic_sync __percpu *cpu_bstats = NULL;
917 	struct gnet_stats_queue __percpu *cpu_qstats = NULL;
918 	struct tcmsg *tcm;
919 	struct nlmsghdr  *nlh;
920 	unsigned char *b = skb_tail_pointer(skb);
921 	struct gnet_dump d;
922 	struct qdisc_size_table *stab;
923 	u32 block_index;
924 	__u32 qlen;
925 
926 	cond_resched();
927 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*tcm), flags);
928 	if (!nlh)
929 		goto out_nlmsg_trim;
930 	tcm = nlmsg_data(nlh);
931 	tcm->tcm_family = AF_UNSPEC;
932 	tcm->tcm__pad1 = 0;
933 	tcm->tcm__pad2 = 0;
934 	tcm->tcm_ifindex = qdisc_dev(q)->ifindex;
935 	tcm->tcm_parent = clid;
936 	tcm->tcm_handle = q->handle;
937 	tcm->tcm_info = refcount_read(&q->refcnt);
938 	if (nla_put_string(skb, TCA_KIND, q->ops->id))
939 		goto nla_put_failure;
940 	if (q->ops->ingress_block_get) {
941 		block_index = q->ops->ingress_block_get(q);
942 		if (block_index &&
943 		    nla_put_u32(skb, TCA_INGRESS_BLOCK, block_index))
944 			goto nla_put_failure;
945 	}
946 	if (q->ops->egress_block_get) {
947 		block_index = q->ops->egress_block_get(q);
948 		if (block_index &&
949 		    nla_put_u32(skb, TCA_EGRESS_BLOCK, block_index))
950 			goto nla_put_failure;
951 	}
952 	if (q->ops->dump && q->ops->dump(q, skb) < 0)
953 		goto nla_put_failure;
954 	if (nla_put_u8(skb, TCA_HW_OFFLOAD, !!(q->flags & TCQ_F_OFFLOADED)))
955 		goto nla_put_failure;
956 	qlen = qdisc_qlen_sum(q);
957 
958 	stab = rtnl_dereference(q->stab);
959 	if (stab && qdisc_dump_stab(skb, stab) < 0)
960 		goto nla_put_failure;
961 
962 	if (gnet_stats_start_copy_compat(skb, TCA_STATS2, TCA_STATS, TCA_XSTATS,
963 					 NULL, &d, TCA_PAD) < 0)
964 		goto nla_put_failure;
965 
966 	if (q->ops->dump_stats && q->ops->dump_stats(q, &d) < 0)
967 		goto nla_put_failure;
968 
969 	if (qdisc_is_percpu_stats(q)) {
970 		cpu_bstats = q->cpu_bstats;
971 		cpu_qstats = q->cpu_qstats;
972 	}
973 
974 	if (gnet_stats_copy_basic(&d, cpu_bstats, &q->bstats, true) < 0 ||
975 	    gnet_stats_copy_rate_est(&d, &q->rate_est) < 0 ||
976 	    gnet_stats_copy_queue(&d, cpu_qstats, &q->qstats, qlen) < 0)
977 		goto nla_put_failure;
978 
979 	if (gnet_stats_finish_copy(&d) < 0)
980 		goto nla_put_failure;
981 
982 	if (extack && extack->_msg &&
983 	    nla_put_string(skb, TCA_EXT_WARN_MSG, extack->_msg))
984 		goto out_nlmsg_trim;
985 
986 	nlh->nlmsg_len = skb_tail_pointer(skb) - b;
987 
988 	return skb->len;
989 
990 out_nlmsg_trim:
991 nla_put_failure:
992 	nlmsg_trim(skb, b);
993 	return -1;
994 }
995 
996 static bool tc_qdisc_dump_ignore(struct Qdisc *q, bool dump_invisible)
997 {
998 	if (q->flags & TCQ_F_BUILTIN)
999 		return true;
1000 	if ((q->flags & TCQ_F_INVISIBLE) && !dump_invisible)
1001 		return true;
1002 
1003 	return false;
1004 }
1005 
1006 static int qdisc_get_notify(struct net *net, struct sk_buff *oskb,
1007 			    struct nlmsghdr *n, u32 clid, struct Qdisc *q,
1008 			    struct netlink_ext_ack *extack)
1009 {
1010 	struct sk_buff *skb;
1011 	u32 portid = oskb ? NETLINK_CB(oskb).portid : 0;
1012 
1013 	skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1014 	if (!skb)
1015 		return -ENOBUFS;
1016 
1017 	if (!tc_qdisc_dump_ignore(q, false)) {
1018 		if (tc_fill_qdisc(skb, q, clid, portid, n->nlmsg_seq, 0,
1019 				  RTM_NEWQDISC, extack) < 0)
1020 			goto err_out;
1021 	}
1022 
1023 	if (skb->len)
1024 		return rtnetlink_send(skb, net, portid, RTNLGRP_TC,
1025 				      n->nlmsg_flags & NLM_F_ECHO);
1026 
1027 err_out:
1028 	kfree_skb(skb);
1029 	return -EINVAL;
1030 }
1031 
1032 static int qdisc_notify(struct net *net, struct sk_buff *oskb,
1033 			struct nlmsghdr *n, u32 clid,
1034 			struct Qdisc *old, struct Qdisc *new,
1035 			struct netlink_ext_ack *extack)
1036 {
1037 	struct sk_buff *skb;
1038 	u32 portid = oskb ? NETLINK_CB(oskb).portid : 0;
1039 
1040 	if (!rtnl_notify_needed(net, n->nlmsg_flags, RTNLGRP_TC))
1041 		return 0;
1042 
1043 	skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
1044 	if (!skb)
1045 		return -ENOBUFS;
1046 
1047 	if (old && !tc_qdisc_dump_ignore(old, false)) {
1048 		if (tc_fill_qdisc(skb, old, clid, portid, n->nlmsg_seq,
1049 				  0, RTM_DELQDISC, extack) < 0)
1050 			goto err_out;
1051 	}
1052 	if (new && !tc_qdisc_dump_ignore(new, false)) {
1053 		if (tc_fill_qdisc(skb, new, clid, portid, n->nlmsg_seq,
1054 				  old ? NLM_F_REPLACE : 0, RTM_NEWQDISC, extack) < 0)
1055 			goto err_out;
1056 	}
1057 
1058 	if (skb->len)
1059 		return rtnetlink_send(skb, net, portid, RTNLGRP_TC,
1060 				      n->nlmsg_flags & NLM_F_ECHO);
1061 
1062 err_out:
1063 	kfree_skb(skb);
1064 	return -EINVAL;
1065 }
1066 
1067 static void notify_and_destroy(struct net *net, struct sk_buff *skb,
1068 			       struct nlmsghdr *n, u32 clid,
1069 			       struct Qdisc *old, struct Qdisc *new,
1070 			       struct netlink_ext_ack *extack)
1071 {
1072 	if (new || old)
1073 		qdisc_notify(net, skb, n, clid, old, new, extack);
1074 
1075 	if (old)
1076 		qdisc_put(old);
1077 }
1078 
1079 static void qdisc_clear_nolock(struct Qdisc *sch)
1080 {
1081 	sch->flags &= ~TCQ_F_NOLOCK;
1082 	if (!(sch->flags & TCQ_F_CPUSTATS))
1083 		return;
1084 
1085 	free_percpu(sch->cpu_bstats);
1086 	free_percpu(sch->cpu_qstats);
1087 	sch->cpu_bstats = NULL;
1088 	sch->cpu_qstats = NULL;
1089 	sch->flags &= ~TCQ_F_CPUSTATS;
1090 }
1091 
1092 /* Graft qdisc "new" to class "classid" of qdisc "parent" or
1093  * to device "dev".
1094  *
1095  * When appropriate send a netlink notification using 'skb'
1096  * and "n".
1097  *
1098  * On success, destroy old qdisc.
1099  */
1100 
1101 static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
1102 		       struct sk_buff *skb, struct nlmsghdr *n, u32 classid,
1103 		       struct Qdisc *new, struct Qdisc *old,
1104 		       struct netlink_ext_ack *extack)
1105 {
1106 	struct Qdisc *q = old;
1107 	struct net *net = dev_net(dev);
1108 
1109 	if (parent == NULL) {
1110 		unsigned int i, num_q, ingress;
1111 		struct netdev_queue *dev_queue;
1112 
1113 		ingress = 0;
1114 		num_q = dev->num_tx_queues;
1115 		if ((q && q->flags & TCQ_F_INGRESS) ||
1116 		    (new && new->flags & TCQ_F_INGRESS)) {
1117 			ingress = 1;
1118 			dev_queue = dev_ingress_queue(dev);
1119 			if (!dev_queue) {
1120 				NL_SET_ERR_MSG(extack, "Device does not have an ingress queue");
1121 				return -ENOENT;
1122 			}
1123 
1124 			q = rtnl_dereference(dev_queue->qdisc_sleeping);
1125 
1126 			/* This is the counterpart of that qdisc_refcount_inc_nz() call in
1127 			 * __tcf_qdisc_find() for filter requests.
1128 			 */
1129 			if (!qdisc_refcount_dec_if_one(q)) {
1130 				NL_SET_ERR_MSG(extack,
1131 					       "Current ingress or clsact Qdisc has ongoing filter requests");
1132 				return -EBUSY;
1133 			}
1134 		}
1135 
1136 		if (dev->flags & IFF_UP)
1137 			dev_deactivate(dev);
1138 
1139 		qdisc_offload_graft_root(dev, new, old, extack);
1140 
1141 		if (new && new->ops->attach && !ingress)
1142 			goto skip;
1143 
1144 		if (!ingress) {
1145 			for (i = 0; i < num_q; i++) {
1146 				dev_queue = netdev_get_tx_queue(dev, i);
1147 				old = dev_graft_qdisc(dev_queue, new);
1148 
1149 				if (new && i > 0)
1150 					qdisc_refcount_inc(new);
1151 				qdisc_put(old);
1152 			}
1153 		} else {
1154 			old = dev_graft_qdisc(dev_queue, NULL);
1155 
1156 			/* {ingress,clsact}_destroy() @old before grafting @new to avoid
1157 			 * unprotected concurrent accesses to net_device::miniq_{in,e}gress
1158 			 * pointer(s) in mini_qdisc_pair_swap().
1159 			 */
1160 			qdisc_notify(net, skb, n, classid, old, new, extack);
1161 			qdisc_destroy(old);
1162 
1163 			dev_graft_qdisc(dev_queue, new);
1164 		}
1165 
1166 skip:
1167 		if (!ingress) {
1168 			old = rtnl_dereference(dev->qdisc);
1169 			if (new && !new->ops->attach)
1170 				qdisc_refcount_inc(new);
1171 			rcu_assign_pointer(dev->qdisc, new ? : &noop_qdisc);
1172 
1173 			notify_and_destroy(net, skb, n, classid, old, new, extack);
1174 
1175 			if (new && new->ops->attach)
1176 				new->ops->attach(new);
1177 		}
1178 
1179 		if (dev->flags & IFF_UP)
1180 			dev_activate(dev);
1181 	} else {
1182 		const struct Qdisc_class_ops *cops = parent->ops->cl_ops;
1183 		unsigned long cl;
1184 		int err;
1185 
1186 		/* Only support running class lockless if parent is lockless */
1187 		if (new && (new->flags & TCQ_F_NOLOCK) && !(parent->flags & TCQ_F_NOLOCK))
1188 			qdisc_clear_nolock(new);
1189 
1190 		if (!cops || !cops->graft)
1191 			return -EOPNOTSUPP;
1192 
1193 		cl = cops->find(parent, classid);
1194 		if (!cl) {
1195 			NL_SET_ERR_MSG(extack, "Specified class not found");
1196 			return -ENOENT;
1197 		}
1198 
1199 		if (new && new->ops == &noqueue_qdisc_ops) {
1200 			NL_SET_ERR_MSG(extack, "Cannot assign noqueue to a class");
1201 			return -EINVAL;
1202 		}
1203 
1204 		if (new &&
1205 		    !(parent->flags & TCQ_F_MQROOT) &&
1206 		    rcu_access_pointer(new->stab)) {
1207 			NL_SET_ERR_MSG(extack, "STAB not supported on a non root");
1208 			return -EINVAL;
1209 		}
1210 		err = cops->graft(parent, cl, new, &old, extack);
1211 		if (err)
1212 			return err;
1213 		notify_and_destroy(net, skb, n, classid, old, new, extack);
1214 	}
1215 	return 0;
1216 }
1217 
1218 static int qdisc_block_indexes_set(struct Qdisc *sch, struct nlattr **tca,
1219 				   struct netlink_ext_ack *extack)
1220 {
1221 	u32 block_index;
1222 
1223 	if (tca[TCA_INGRESS_BLOCK]) {
1224 		block_index = nla_get_u32(tca[TCA_INGRESS_BLOCK]);
1225 
1226 		if (!block_index) {
1227 			NL_SET_ERR_MSG(extack, "Ingress block index cannot be 0");
1228 			return -EINVAL;
1229 		}
1230 		if (!sch->ops->ingress_block_set) {
1231 			NL_SET_ERR_MSG(extack, "Ingress block sharing is not supported");
1232 			return -EOPNOTSUPP;
1233 		}
1234 		sch->ops->ingress_block_set(sch, block_index);
1235 	}
1236 	if (tca[TCA_EGRESS_BLOCK]) {
1237 		block_index = nla_get_u32(tca[TCA_EGRESS_BLOCK]);
1238 
1239 		if (!block_index) {
1240 			NL_SET_ERR_MSG(extack, "Egress block index cannot be 0");
1241 			return -EINVAL;
1242 		}
1243 		if (!sch->ops->egress_block_set) {
1244 			NL_SET_ERR_MSG(extack, "Egress block sharing is not supported");
1245 			return -EOPNOTSUPP;
1246 		}
1247 		sch->ops->egress_block_set(sch, block_index);
1248 	}
1249 	return 0;
1250 }
1251 
1252 /*
1253    Allocate and initialize new qdisc.
1254 
1255    Parameters are passed via opt.
1256  */
1257 
1258 static struct Qdisc *qdisc_create(struct net_device *dev,
1259 				  struct netdev_queue *dev_queue,
1260 				  u32 parent, u32 handle,
1261 				  struct nlattr **tca, int *errp,
1262 				  struct netlink_ext_ack *extack)
1263 {
1264 	int err;
1265 	struct nlattr *kind = tca[TCA_KIND];
1266 	struct Qdisc *sch;
1267 	struct Qdisc_ops *ops;
1268 	struct qdisc_size_table *stab;
1269 
1270 	ops = qdisc_lookup_ops(kind);
1271 	if (!ops) {
1272 		err = -ENOENT;
1273 		NL_SET_ERR_MSG(extack, "Specified qdisc kind is unknown");
1274 		goto err_out;
1275 	}
1276 
1277 	sch = qdisc_alloc(dev_queue, ops, extack);
1278 	if (IS_ERR(sch)) {
1279 		err = PTR_ERR(sch);
1280 		goto err_out2;
1281 	}
1282 
1283 	sch->parent = parent;
1284 
1285 	if (handle == TC_H_INGRESS) {
1286 		if (!(sch->flags & TCQ_F_INGRESS)) {
1287 			NL_SET_ERR_MSG(extack,
1288 				       "Specified parent ID is reserved for ingress and clsact Qdiscs");
1289 			err = -EINVAL;
1290 			goto err_out3;
1291 		}
1292 		handle = TC_H_MAKE(TC_H_INGRESS, 0);
1293 	} else {
1294 		if (handle == 0) {
1295 			handle = qdisc_alloc_handle(dev);
1296 			if (handle == 0) {
1297 				NL_SET_ERR_MSG(extack, "Maximum number of qdisc handles was exceeded");
1298 				err = -ENOSPC;
1299 				goto err_out3;
1300 			}
1301 		}
1302 		if (!netif_is_multiqueue(dev))
1303 			sch->flags |= TCQ_F_ONETXQUEUE;
1304 	}
1305 
1306 	sch->handle = handle;
1307 
1308 	/* This exist to keep backward compatible with a userspace
1309 	 * loophole, what allowed userspace to get IFF_NO_QUEUE
1310 	 * facility on older kernels by setting tx_queue_len=0 (prior
1311 	 * to qdisc init), and then forgot to reinit tx_queue_len
1312 	 * before again attaching a qdisc.
1313 	 */
1314 	if ((dev->priv_flags & IFF_NO_QUEUE) && (dev->tx_queue_len == 0)) {
1315 		WRITE_ONCE(dev->tx_queue_len, DEFAULT_TX_QUEUE_LEN);
1316 		netdev_info(dev, "Caught tx_queue_len zero misconfig\n");
1317 	}
1318 
1319 	err = qdisc_block_indexes_set(sch, tca, extack);
1320 	if (err)
1321 		goto err_out3;
1322 
1323 	if (tca[TCA_STAB]) {
1324 		stab = qdisc_get_stab(tca[TCA_STAB], extack);
1325 		if (IS_ERR(stab)) {
1326 			err = PTR_ERR(stab);
1327 			goto err_out3;
1328 		}
1329 		rcu_assign_pointer(sch->stab, stab);
1330 	}
1331 
1332 	if (ops->init) {
1333 		err = ops->init(sch, tca[TCA_OPTIONS], extack);
1334 		if (err != 0)
1335 			goto err_out4;
1336 	}
1337 
1338 	if (tca[TCA_RATE]) {
1339 		err = -EOPNOTSUPP;
1340 		if (sch->flags & TCQ_F_MQROOT) {
1341 			NL_SET_ERR_MSG(extack, "Cannot attach rate estimator to a multi-queue root qdisc");
1342 			goto err_out4;
1343 		}
1344 
1345 		err = gen_new_estimator(&sch->bstats,
1346 					sch->cpu_bstats,
1347 					&sch->rate_est,
1348 					NULL,
1349 					true,
1350 					tca[TCA_RATE]);
1351 		if (err) {
1352 			NL_SET_ERR_MSG(extack, "Failed to generate new estimator");
1353 			goto err_out4;
1354 		}
1355 	}
1356 
1357 	qdisc_hash_add(sch, false);
1358 	trace_qdisc_create(ops, dev, parent);
1359 
1360 	return sch;
1361 
1362 err_out4:
1363 	/* Even if ops->init() failed, we call ops->destroy()
1364 	 * like qdisc_create_dflt().
1365 	 */
1366 	if (ops->destroy)
1367 		ops->destroy(sch);
1368 	qdisc_put_stab(rtnl_dereference(sch->stab));
1369 err_out3:
1370 	lockdep_unregister_key(&sch->root_lock_key);
1371 	netdev_put(dev, &sch->dev_tracker);
1372 	qdisc_free(sch);
1373 err_out2:
1374 	bpf_module_put(ops, ops->owner);
1375 err_out:
1376 	*errp = err;
1377 	return NULL;
1378 }
1379 
1380 static int qdisc_change(struct Qdisc *sch, struct nlattr **tca,
1381 			struct netlink_ext_ack *extack)
1382 {
1383 	struct qdisc_size_table *ostab, *stab = NULL;
1384 	int err = 0;
1385 
1386 	if (tca[TCA_OPTIONS]) {
1387 		if (!sch->ops->change) {
1388 			NL_SET_ERR_MSG(extack, "Change operation not supported by specified qdisc");
1389 			return -EINVAL;
1390 		}
1391 		if (tca[TCA_INGRESS_BLOCK] || tca[TCA_EGRESS_BLOCK]) {
1392 			NL_SET_ERR_MSG(extack, "Change of blocks is not supported");
1393 			return -EOPNOTSUPP;
1394 		}
1395 		err = sch->ops->change(sch, tca[TCA_OPTIONS], extack);
1396 		if (err)
1397 			return err;
1398 	}
1399 
1400 	if (tca[TCA_STAB]) {
1401 		stab = qdisc_get_stab(tca[TCA_STAB], extack);
1402 		if (IS_ERR(stab))
1403 			return PTR_ERR(stab);
1404 	}
1405 
1406 	ostab = rtnl_dereference(sch->stab);
1407 	rcu_assign_pointer(sch->stab, stab);
1408 	qdisc_put_stab(ostab);
1409 
1410 	if (tca[TCA_RATE]) {
1411 		/* NB: ignores errors from replace_estimator
1412 		   because change can't be undone. */
1413 		if (sch->flags & TCQ_F_MQROOT)
1414 			goto out;
1415 		gen_replace_estimator(&sch->bstats,
1416 				      sch->cpu_bstats,
1417 				      &sch->rate_est,
1418 				      NULL,
1419 				      true,
1420 				      tca[TCA_RATE]);
1421 	}
1422 out:
1423 	return 0;
1424 }
1425 
1426 struct check_loop_arg {
1427 	struct qdisc_walker	w;
1428 	struct Qdisc		*p;
1429 	int			depth;
1430 };
1431 
1432 static int check_loop_fn(struct Qdisc *q, unsigned long cl,
1433 			 struct qdisc_walker *w);
1434 
1435 static int check_loop(struct Qdisc *q, struct Qdisc *p, int depth)
1436 {
1437 	struct check_loop_arg	arg;
1438 
1439 	if (q->ops->cl_ops == NULL)
1440 		return 0;
1441 
1442 	arg.w.stop = arg.w.skip = arg.w.count = 0;
1443 	arg.w.fn = check_loop_fn;
1444 	arg.depth = depth;
1445 	arg.p = p;
1446 	q->ops->cl_ops->walk(q, &arg.w);
1447 	return arg.w.stop ? -ELOOP : 0;
1448 }
1449 
1450 static int
1451 check_loop_fn(struct Qdisc *q, unsigned long cl, struct qdisc_walker *w)
1452 {
1453 	struct Qdisc *leaf;
1454 	const struct Qdisc_class_ops *cops = q->ops->cl_ops;
1455 	struct check_loop_arg *arg = (struct check_loop_arg *)w;
1456 
1457 	leaf = cops->leaf(q, cl);
1458 	if (leaf) {
1459 		if (leaf == arg->p || arg->depth > 7)
1460 			return -ELOOP;
1461 		return check_loop(leaf, arg->p, arg->depth + 1);
1462 	}
1463 	return 0;
1464 }
1465 
1466 const struct nla_policy rtm_tca_policy[TCA_MAX + 1] = {
1467 	[TCA_KIND]		= { .type = NLA_STRING },
1468 	[TCA_RATE]		= { .type = NLA_BINARY,
1469 				    .len = sizeof(struct tc_estimator) },
1470 	[TCA_STAB]		= { .type = NLA_NESTED },
1471 	[TCA_DUMP_INVISIBLE]	= { .type = NLA_FLAG },
1472 	[TCA_CHAIN]		= { .type = NLA_U32 },
1473 	[TCA_INGRESS_BLOCK]	= { .type = NLA_U32 },
1474 	[TCA_EGRESS_BLOCK]	= { .type = NLA_U32 },
1475 };
1476 
1477 /*
1478  * Delete/get qdisc.
1479  */
1480 
1481 static int __tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
1482 			  struct netlink_ext_ack *extack,
1483 			  struct net_device *dev,
1484 			  struct nlattr *tca[TCA_MAX + 1],
1485 			  struct tcmsg *tcm)
1486 {
1487 	struct net *net = sock_net(skb->sk);
1488 	struct Qdisc *q = NULL;
1489 	struct Qdisc *p = NULL;
1490 	u32 clid;
1491 	int err;
1492 
1493 	clid = tcm->tcm_parent;
1494 	if (clid) {
1495 		if (clid != TC_H_ROOT) {
1496 			if (TC_H_MAJ(clid) != TC_H_MAJ(TC_H_INGRESS)) {
1497 				p = qdisc_lookup(dev, TC_H_MAJ(clid));
1498 				if (!p) {
1499 					NL_SET_ERR_MSG(extack, "Failed to find qdisc with specified classid");
1500 					return -ENOENT;
1501 				}
1502 				q = qdisc_leaf(p, clid);
1503 			} else if (dev_ingress_queue(dev)) {
1504 				q = rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping);
1505 			}
1506 		} else {
1507 			q = rtnl_dereference(dev->qdisc);
1508 		}
1509 		if (!q) {
1510 			NL_SET_ERR_MSG(extack, "Cannot find specified qdisc on specified device");
1511 			return -ENOENT;
1512 		}
1513 
1514 		if (tcm->tcm_handle && q->handle != tcm->tcm_handle) {
1515 			NL_SET_ERR_MSG(extack, "Invalid handle");
1516 			return -EINVAL;
1517 		}
1518 	} else {
1519 		q = qdisc_lookup(dev, tcm->tcm_handle);
1520 		if (!q) {
1521 			NL_SET_ERR_MSG(extack, "Failed to find qdisc with specified handle");
1522 			return -ENOENT;
1523 		}
1524 	}
1525 
1526 	if (tca[TCA_KIND] && nla_strcmp(tca[TCA_KIND], q->ops->id)) {
1527 		NL_SET_ERR_MSG(extack, "Invalid qdisc name: must match existing qdisc");
1528 		return -EINVAL;
1529 	}
1530 
1531 	if (n->nlmsg_type == RTM_DELQDISC) {
1532 		if (!clid) {
1533 			NL_SET_ERR_MSG(extack, "Classid cannot be zero");
1534 			return -EINVAL;
1535 		}
1536 		if (q->handle == 0) {
1537 			NL_SET_ERR_MSG(extack, "Cannot delete qdisc with handle of zero");
1538 			return -ENOENT;
1539 		}
1540 		err = qdisc_graft(dev, p, skb, n, clid, NULL, q, extack);
1541 		if (err != 0)
1542 			return err;
1543 	} else {
1544 		qdisc_get_notify(net, skb, n, clid, q, NULL);
1545 	}
1546 	return 0;
1547 }
1548 
1549 static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
1550 			struct netlink_ext_ack *extack)
1551 {
1552 	struct net *net = sock_net(skb->sk);
1553 	struct tcmsg *tcm = nlmsg_data(n);
1554 	struct nlattr *tca[TCA_MAX + 1];
1555 	struct net_device *dev;
1556 	int err;
1557 
1558 	err = nlmsg_parse_deprecated(n, sizeof(*tcm), tca, TCA_MAX,
1559 				     rtm_tca_policy, extack);
1560 	if (err < 0)
1561 		return err;
1562 
1563 	dev = __dev_get_by_index(net, tcm->tcm_ifindex);
1564 	if (!dev)
1565 		return -ENODEV;
1566 
1567 	netdev_lock_ops(dev);
1568 	err = __tc_get_qdisc(skb, n, extack, dev, tca, tcm);
1569 	netdev_unlock_ops(dev);
1570 
1571 	return err;
1572 }
1573 
1574 static bool req_create_or_replace(struct nlmsghdr *n)
1575 {
1576 	return (n->nlmsg_flags & NLM_F_CREATE &&
1577 		n->nlmsg_flags & NLM_F_REPLACE);
1578 }
1579 
1580 static bool req_create_exclusive(struct nlmsghdr *n)
1581 {
1582 	return (n->nlmsg_flags & NLM_F_CREATE &&
1583 		n->nlmsg_flags & NLM_F_EXCL);
1584 }
1585 
1586 static bool req_change(struct nlmsghdr *n)
1587 {
1588 	return (!(n->nlmsg_flags & NLM_F_CREATE) &&
1589 		!(n->nlmsg_flags & NLM_F_REPLACE) &&
1590 		!(n->nlmsg_flags & NLM_F_EXCL));
1591 }
1592 
1593 static int __tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
1594 			     struct netlink_ext_ack *extack,
1595 			     struct net_device *dev,
1596 			     struct nlattr *tca[TCA_MAX + 1],
1597 			     struct tcmsg *tcm)
1598 {
1599 	struct Qdisc *q = NULL;
1600 	struct Qdisc *p = NULL;
1601 	u32 clid;
1602 	int err;
1603 
1604 	clid = tcm->tcm_parent;
1605 
1606 	if (clid) {
1607 		if (clid != TC_H_ROOT) {
1608 			if (clid != TC_H_INGRESS) {
1609 				p = qdisc_lookup(dev, TC_H_MAJ(clid));
1610 				if (!p) {
1611 					NL_SET_ERR_MSG(extack, "Failed to find specified qdisc");
1612 					return -ENOENT;
1613 				}
1614 				q = qdisc_leaf(p, clid);
1615 			} else if (dev_ingress_queue_create(dev)) {
1616 				q = rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping);
1617 			}
1618 		} else {
1619 			q = rtnl_dereference(dev->qdisc);
1620 		}
1621 
1622 		/* It may be default qdisc, ignore it */
1623 		if (q && q->handle == 0)
1624 			q = NULL;
1625 
1626 		if (!q || !tcm->tcm_handle || q->handle != tcm->tcm_handle) {
1627 			if (tcm->tcm_handle) {
1628 				if (q && !(n->nlmsg_flags & NLM_F_REPLACE)) {
1629 					NL_SET_ERR_MSG(extack, "NLM_F_REPLACE needed to override");
1630 					return -EEXIST;
1631 				}
1632 				if (TC_H_MIN(tcm->tcm_handle)) {
1633 					NL_SET_ERR_MSG(extack, "Invalid minor handle");
1634 					return -EINVAL;
1635 				}
1636 				q = qdisc_lookup(dev, tcm->tcm_handle);
1637 				if (!q)
1638 					goto create_n_graft;
1639 				if (q->parent != tcm->tcm_parent) {
1640 					NL_SET_ERR_MSG(extack, "Cannot move an existing qdisc to a different parent");
1641 					return -EINVAL;
1642 				}
1643 				if (n->nlmsg_flags & NLM_F_EXCL) {
1644 					NL_SET_ERR_MSG(extack, "Exclusivity flag on, cannot override");
1645 					return -EEXIST;
1646 				}
1647 				if (tca[TCA_KIND] &&
1648 				    nla_strcmp(tca[TCA_KIND], q->ops->id)) {
1649 					NL_SET_ERR_MSG(extack, "Invalid qdisc name: must match existing qdisc");
1650 					return -EINVAL;
1651 				}
1652 				if (q->flags & TCQ_F_INGRESS) {
1653 					NL_SET_ERR_MSG(extack,
1654 						       "Cannot regraft ingress or clsact Qdiscs");
1655 					return -EINVAL;
1656 				}
1657 				if (q == p ||
1658 				    (p && check_loop(q, p, 0))) {
1659 					NL_SET_ERR_MSG(extack, "Qdisc parent/child loop detected");
1660 					return -ELOOP;
1661 				}
1662 				if (clid == TC_H_INGRESS) {
1663 					NL_SET_ERR_MSG(extack, "Ingress cannot graft directly");
1664 					return -EINVAL;
1665 				}
1666 				qdisc_refcount_inc(q);
1667 				goto graft;
1668 			} else {
1669 				if (!q)
1670 					goto create_n_graft;
1671 
1672 				/* This magic test requires explanation.
1673 				 *
1674 				 *   We know, that some child q is already
1675 				 *   attached to this parent and have choice:
1676 				 *   1) change it or 2) create/graft new one.
1677 				 *   If the requested qdisc kind is different
1678 				 *   than the existing one, then we choose graft.
1679 				 *   If they are the same then this is "change"
1680 				 *   operation - just let it fallthrough..
1681 				 *
1682 				 *   1. We are allowed to create/graft only
1683 				 *   if the request is explicitly stating
1684 				 *   "please create if it doesn't exist".
1685 				 *
1686 				 *   2. If the request is to exclusive create
1687 				 *   then the qdisc tcm_handle is not expected
1688 				 *   to exist, so that we choose create/graft too.
1689 				 *
1690 				 *   3. The last case is when no flags are set.
1691 				 *   This will happen when for example tc
1692 				 *   utility issues a "change" command.
1693 				 *   Alas, it is sort of hole in API, we
1694 				 *   cannot decide what to do unambiguously.
1695 				 *   For now we select create/graft.
1696 				 */
1697 				if (tca[TCA_KIND] &&
1698 				    nla_strcmp(tca[TCA_KIND], q->ops->id)) {
1699 					if (req_create_or_replace(n) ||
1700 					    req_create_exclusive(n))
1701 						goto create_n_graft;
1702 					else if (req_change(n))
1703 						goto create_n_graft2;
1704 				}
1705 			}
1706 		}
1707 	} else {
1708 		if (!tcm->tcm_handle) {
1709 			NL_SET_ERR_MSG(extack, "Handle cannot be zero");
1710 			return -EINVAL;
1711 		}
1712 		q = qdisc_lookup(dev, tcm->tcm_handle);
1713 	}
1714 
1715 	/* Change qdisc parameters */
1716 	if (!q) {
1717 		NL_SET_ERR_MSG(extack, "Specified qdisc not found");
1718 		return -ENOENT;
1719 	}
1720 	if (n->nlmsg_flags & NLM_F_EXCL) {
1721 		NL_SET_ERR_MSG(extack, "Exclusivity flag on, cannot modify");
1722 		return -EEXIST;
1723 	}
1724 	if (tca[TCA_KIND] && nla_strcmp(tca[TCA_KIND], q->ops->id)) {
1725 		NL_SET_ERR_MSG(extack, "Invalid qdisc name: must match existing qdisc");
1726 		return -EINVAL;
1727 	}
1728 	err = qdisc_change(q, tca, extack);
1729 	if (err == 0)
1730 		qdisc_notify(sock_net(skb->sk), skb, n, clid, NULL, q, extack);
1731 	return err;
1732 
1733 create_n_graft:
1734 	if (!(n->nlmsg_flags & NLM_F_CREATE)) {
1735 		NL_SET_ERR_MSG(extack, "Qdisc not found. To create specify NLM_F_CREATE flag");
1736 		return -ENOENT;
1737 	}
1738 create_n_graft2:
1739 	if (clid == TC_H_INGRESS) {
1740 		if (dev_ingress_queue(dev)) {
1741 			q = qdisc_create(dev, dev_ingress_queue(dev),
1742 					 tcm->tcm_parent, tcm->tcm_parent,
1743 					 tca, &err, extack);
1744 		} else {
1745 			NL_SET_ERR_MSG(extack, "Cannot find ingress queue for specified device");
1746 			err = -ENOENT;
1747 		}
1748 	} else {
1749 		struct netdev_queue *dev_queue;
1750 
1751 		if (p && p->ops->cl_ops && p->ops->cl_ops->select_queue)
1752 			dev_queue = p->ops->cl_ops->select_queue(p, tcm);
1753 		else if (p)
1754 			dev_queue = p->dev_queue;
1755 		else
1756 			dev_queue = netdev_get_tx_queue(dev, 0);
1757 
1758 		q = qdisc_create(dev, dev_queue,
1759 				 tcm->tcm_parent, tcm->tcm_handle,
1760 				 tca, &err, extack);
1761 	}
1762 	if (!q)
1763 		return err;
1764 
1765 graft:
1766 	err = qdisc_graft(dev, p, skb, n, clid, q, NULL, extack);
1767 	if (err) {
1768 		if (q)
1769 			qdisc_put(q);
1770 		return err;
1771 	}
1772 
1773 	return 0;
1774 }
1775 
1776 static void request_qdisc_module(struct nlattr *kind)
1777 {
1778 	struct Qdisc_ops *ops;
1779 	char name[IFNAMSIZ];
1780 
1781 	if (!kind)
1782 		return;
1783 
1784 	ops = qdisc_lookup_ops(kind);
1785 	if (ops) {
1786 		bpf_module_put(ops, ops->owner);
1787 		return;
1788 	}
1789 
1790 	if (nla_strscpy(name, kind, IFNAMSIZ) >= 0) {
1791 		rtnl_unlock();
1792 		request_module(NET_SCH_ALIAS_PREFIX "%s", name);
1793 		rtnl_lock();
1794 	}
1795 }
1796 
1797 /*
1798  * Create/change qdisc.
1799  */
1800 static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
1801 			   struct netlink_ext_ack *extack)
1802 {
1803 	struct net *net = sock_net(skb->sk);
1804 	struct nlattr *tca[TCA_MAX + 1];
1805 	struct net_device *dev;
1806 	struct tcmsg *tcm;
1807 	int err;
1808 
1809 	err = nlmsg_parse_deprecated(n, sizeof(*tcm), tca, TCA_MAX,
1810 				     rtm_tca_policy, extack);
1811 	if (err < 0)
1812 		return err;
1813 
1814 	request_qdisc_module(tca[TCA_KIND]);
1815 
1816 	tcm = nlmsg_data(n);
1817 	dev = __dev_get_by_index(net, tcm->tcm_ifindex);
1818 	if (!dev)
1819 		return -ENODEV;
1820 
1821 	netdev_lock_ops(dev);
1822 	err = __tc_modify_qdisc(skb, n, extack, dev, tca, tcm);
1823 	netdev_unlock_ops(dev);
1824 
1825 	return err;
1826 }
1827 
1828 static int tc_dump_qdisc_root(struct Qdisc *root, struct sk_buff *skb,
1829 			      struct netlink_callback *cb,
1830 			      int *q_idx_p, int s_q_idx, bool recur,
1831 			      bool dump_invisible)
1832 {
1833 	int ret = 0, q_idx = *q_idx_p;
1834 	struct Qdisc *q;
1835 	int b;
1836 
1837 	if (!root)
1838 		return 0;
1839 
1840 	q = root;
1841 	if (q_idx < s_q_idx) {
1842 		q_idx++;
1843 	} else {
1844 		if (!tc_qdisc_dump_ignore(q, dump_invisible) &&
1845 		    tc_fill_qdisc(skb, q, q->parent, NETLINK_CB(cb->skb).portid,
1846 				  cb->nlh->nlmsg_seq, NLM_F_MULTI,
1847 				  RTM_NEWQDISC, NULL) <= 0)
1848 			goto done;
1849 		q_idx++;
1850 	}
1851 
1852 	/* If dumping singletons, there is no qdisc_dev(root) and the singleton
1853 	 * itself has already been dumped.
1854 	 *
1855 	 * If we've already dumped the top-level (ingress) qdisc above and the global
1856 	 * qdisc hashtable, we don't want to hit it again
1857 	 */
1858 	if (!qdisc_dev(root) || !recur)
1859 		goto out;
1860 
1861 	hash_for_each(qdisc_dev(root)->qdisc_hash, b, q, hash) {
1862 		if (q_idx < s_q_idx) {
1863 			q_idx++;
1864 			continue;
1865 		}
1866 		if (!tc_qdisc_dump_ignore(q, dump_invisible) &&
1867 		    tc_fill_qdisc(skb, q, q->parent, NETLINK_CB(cb->skb).portid,
1868 				  cb->nlh->nlmsg_seq, NLM_F_MULTI,
1869 				  RTM_NEWQDISC, NULL) <= 0)
1870 			goto done;
1871 		q_idx++;
1872 	}
1873 
1874 out:
1875 	*q_idx_p = q_idx;
1876 	return ret;
1877 done:
1878 	ret = -1;
1879 	goto out;
1880 }
1881 
1882 static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
1883 {
1884 	struct net *net = sock_net(skb->sk);
1885 	int idx, q_idx;
1886 	int s_idx, s_q_idx;
1887 	struct net_device *dev;
1888 	const struct nlmsghdr *nlh = cb->nlh;
1889 	struct nlattr *tca[TCA_MAX + 1];
1890 	int err;
1891 
1892 	s_idx = cb->args[0];
1893 	s_q_idx = q_idx = cb->args[1];
1894 
1895 	idx = 0;
1896 	ASSERT_RTNL();
1897 
1898 	err = nlmsg_parse_deprecated(nlh, sizeof(struct tcmsg), tca, TCA_MAX,
1899 				     rtm_tca_policy, cb->extack);
1900 	if (err < 0)
1901 		return err;
1902 
1903 	for_each_netdev(net, dev) {
1904 		struct netdev_queue *dev_queue;
1905 
1906 		if (idx < s_idx)
1907 			goto cont;
1908 		if (idx > s_idx)
1909 			s_q_idx = 0;
1910 		q_idx = 0;
1911 
1912 		netdev_lock_ops(dev);
1913 		if (tc_dump_qdisc_root(rtnl_dereference(dev->qdisc),
1914 				       skb, cb, &q_idx, s_q_idx,
1915 				       true, tca[TCA_DUMP_INVISIBLE]) < 0) {
1916 			netdev_unlock_ops(dev);
1917 			goto done;
1918 		}
1919 
1920 		dev_queue = dev_ingress_queue(dev);
1921 		if (dev_queue &&
1922 		    tc_dump_qdisc_root(rtnl_dereference(dev_queue->qdisc_sleeping),
1923 				       skb, cb, &q_idx, s_q_idx, false,
1924 				       tca[TCA_DUMP_INVISIBLE]) < 0) {
1925 			netdev_unlock_ops(dev);
1926 			goto done;
1927 		}
1928 		netdev_unlock_ops(dev);
1929 
1930 cont:
1931 		idx++;
1932 	}
1933 
1934 done:
1935 	cb->args[0] = idx;
1936 	cb->args[1] = q_idx;
1937 
1938 	return skb->len;
1939 }
1940 
1941 
1942 
1943 /************************************************
1944  *	Traffic classes manipulation.		*
1945  ************************************************/
1946 
1947 static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q,
1948 			  unsigned long cl, u32 portid, u32 seq, u16 flags,
1949 			  int event, struct netlink_ext_ack *extack)
1950 {
1951 	struct tcmsg *tcm;
1952 	struct nlmsghdr  *nlh;
1953 	unsigned char *b = skb_tail_pointer(skb);
1954 	struct gnet_dump d;
1955 	const struct Qdisc_class_ops *cl_ops = q->ops->cl_ops;
1956 
1957 	cond_resched();
1958 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*tcm), flags);
1959 	if (!nlh)
1960 		goto out_nlmsg_trim;
1961 	tcm = nlmsg_data(nlh);
1962 	tcm->tcm_family = AF_UNSPEC;
1963 	tcm->tcm__pad1 = 0;
1964 	tcm->tcm__pad2 = 0;
1965 	tcm->tcm_ifindex = qdisc_dev(q)->ifindex;
1966 	tcm->tcm_parent = q->handle;
1967 	tcm->tcm_handle = q->handle;
1968 	tcm->tcm_info = 0;
1969 	if (nla_put_string(skb, TCA_KIND, q->ops->id))
1970 		goto nla_put_failure;
1971 	if (cl_ops->dump && cl_ops->dump(q, cl, skb, tcm) < 0)
1972 		goto nla_put_failure;
1973 
1974 	if (gnet_stats_start_copy_compat(skb, TCA_STATS2, TCA_STATS, TCA_XSTATS,
1975 					 NULL, &d, TCA_PAD) < 0)
1976 		goto nla_put_failure;
1977 
1978 	if (cl_ops->dump_stats && cl_ops->dump_stats(q, cl, &d) < 0)
1979 		goto nla_put_failure;
1980 
1981 	if (gnet_stats_finish_copy(&d) < 0)
1982 		goto nla_put_failure;
1983 
1984 	if (extack && extack->_msg &&
1985 	    nla_put_string(skb, TCA_EXT_WARN_MSG, extack->_msg))
1986 		goto out_nlmsg_trim;
1987 
1988 	nlh->nlmsg_len = skb_tail_pointer(skb) - b;
1989 
1990 	return skb->len;
1991 
1992 out_nlmsg_trim:
1993 nla_put_failure:
1994 	nlmsg_trim(skb, b);
1995 	return -1;
1996 }
1997 
1998 static int tclass_notify(struct net *net, struct sk_buff *oskb,
1999 			 struct nlmsghdr *n, struct Qdisc *q,
2000 			 unsigned long cl, int event, struct netlink_ext_ack *extack)
2001 {
2002 	struct sk_buff *skb;
2003 	u32 portid = oskb ? NETLINK_CB(oskb).portid : 0;
2004 
2005 	if (!rtnl_notify_needed(net, n->nlmsg_flags, RTNLGRP_TC))
2006 		return 0;
2007 
2008 	skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2009 	if (!skb)
2010 		return -ENOBUFS;
2011 
2012 	if (tc_fill_tclass(skb, q, cl, portid, n->nlmsg_seq, 0, event, extack) < 0) {
2013 		kfree_skb(skb);
2014 		return -EINVAL;
2015 	}
2016 
2017 	return rtnetlink_send(skb, net, portid, RTNLGRP_TC,
2018 			      n->nlmsg_flags & NLM_F_ECHO);
2019 }
2020 
2021 static int tclass_get_notify(struct net *net, struct sk_buff *oskb,
2022 			     struct nlmsghdr *n, struct Qdisc *q,
2023 			     unsigned long cl, struct netlink_ext_ack *extack)
2024 {
2025 	struct sk_buff *skb;
2026 	u32 portid = oskb ? NETLINK_CB(oskb).portid : 0;
2027 
2028 	skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2029 	if (!skb)
2030 		return -ENOBUFS;
2031 
2032 	if (tc_fill_tclass(skb, q, cl, portid, n->nlmsg_seq, 0, RTM_NEWTCLASS,
2033 			   extack) < 0) {
2034 		kfree_skb(skb);
2035 		return -EINVAL;
2036 	}
2037 
2038 	return rtnetlink_send(skb, net, portid, RTNLGRP_TC,
2039 			      n->nlmsg_flags & NLM_F_ECHO);
2040 }
2041 
2042 static int tclass_del_notify(struct net *net,
2043 			     const struct Qdisc_class_ops *cops,
2044 			     struct sk_buff *oskb, struct nlmsghdr *n,
2045 			     struct Qdisc *q, unsigned long cl,
2046 			     struct netlink_ext_ack *extack)
2047 {
2048 	u32 portid = oskb ? NETLINK_CB(oskb).portid : 0;
2049 	struct sk_buff *skb;
2050 	int err = 0;
2051 
2052 	if (!cops->delete)
2053 		return -EOPNOTSUPP;
2054 
2055 	if (rtnl_notify_needed(net, n->nlmsg_flags, RTNLGRP_TC)) {
2056 		skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2057 		if (!skb)
2058 			return -ENOBUFS;
2059 
2060 		if (tc_fill_tclass(skb, q, cl, portid, n->nlmsg_seq, 0,
2061 				   RTM_DELTCLASS, extack) < 0) {
2062 			kfree_skb(skb);
2063 			return -EINVAL;
2064 		}
2065 	} else {
2066 		skb = NULL;
2067 	}
2068 
2069 	err = cops->delete(q, cl, extack);
2070 	if (err) {
2071 		kfree_skb(skb);
2072 		return err;
2073 	}
2074 
2075 	err = rtnetlink_maybe_send(skb, net, portid, RTNLGRP_TC,
2076 				   n->nlmsg_flags & NLM_F_ECHO);
2077 	return err;
2078 }
2079 
2080 #ifdef CONFIG_NET_CLS
2081 
2082 struct tcf_bind_args {
2083 	struct tcf_walker w;
2084 	unsigned long base;
2085 	unsigned long cl;
2086 	u32 classid;
2087 };
2088 
2089 static int tcf_node_bind(struct tcf_proto *tp, void *n, struct tcf_walker *arg)
2090 {
2091 	struct tcf_bind_args *a = (void *)arg;
2092 
2093 	if (n && tp->ops->bind_class) {
2094 		struct Qdisc *q = tcf_block_q(tp->chain->block);
2095 
2096 		sch_tree_lock(q);
2097 		tp->ops->bind_class(n, a->classid, a->cl, q, a->base);
2098 		sch_tree_unlock(q);
2099 	}
2100 	return 0;
2101 }
2102 
2103 struct tc_bind_class_args {
2104 	struct qdisc_walker w;
2105 	unsigned long new_cl;
2106 	u32 portid;
2107 	u32 clid;
2108 };
2109 
2110 static int tc_bind_class_walker(struct Qdisc *q, unsigned long cl,
2111 				struct qdisc_walker *w)
2112 {
2113 	struct tc_bind_class_args *a = (struct tc_bind_class_args *)w;
2114 	const struct Qdisc_class_ops *cops = q->ops->cl_ops;
2115 	struct tcf_block *block;
2116 	struct tcf_chain *chain;
2117 
2118 	block = cops->tcf_block(q, cl, NULL);
2119 	if (!block)
2120 		return 0;
2121 	for (chain = tcf_get_next_chain(block, NULL);
2122 	     chain;
2123 	     chain = tcf_get_next_chain(block, chain)) {
2124 		struct tcf_proto *tp;
2125 
2126 		for (tp = tcf_get_next_proto(chain, NULL);
2127 		     tp; tp = tcf_get_next_proto(chain, tp)) {
2128 			struct tcf_bind_args arg = {};
2129 
2130 			arg.w.fn = tcf_node_bind;
2131 			arg.classid = a->clid;
2132 			arg.base = cl;
2133 			arg.cl = a->new_cl;
2134 			tp->ops->walk(tp, &arg.w, true);
2135 		}
2136 	}
2137 
2138 	return 0;
2139 }
2140 
2141 static void tc_bind_tclass(struct Qdisc *q, u32 portid, u32 clid,
2142 			   unsigned long new_cl)
2143 {
2144 	const struct Qdisc_class_ops *cops = q->ops->cl_ops;
2145 	struct tc_bind_class_args args = {};
2146 
2147 	if (!cops->tcf_block)
2148 		return;
2149 	args.portid = portid;
2150 	args.clid = clid;
2151 	args.new_cl = new_cl;
2152 	args.w.fn = tc_bind_class_walker;
2153 	q->ops->cl_ops->walk(q, &args.w);
2154 }
2155 
2156 #else
2157 
2158 static void tc_bind_tclass(struct Qdisc *q, u32 portid, u32 clid,
2159 			   unsigned long new_cl)
2160 {
2161 }
2162 
2163 #endif
2164 
2165 static int __tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n,
2166 			   struct netlink_ext_ack *extack,
2167 			   struct net_device *dev,
2168 			   struct nlattr *tca[TCA_MAX + 1],
2169 			   struct tcmsg *tcm)
2170 {
2171 	struct net *net = sock_net(skb->sk);
2172 	const struct Qdisc_class_ops *cops;
2173 	struct Qdisc *q = NULL;
2174 	unsigned long cl = 0;
2175 	unsigned long new_cl;
2176 	u32 portid;
2177 	u32 clid;
2178 	u32 qid;
2179 	int err;
2180 
2181 	/*
2182 	   parent == TC_H_UNSPEC - unspecified parent.
2183 	   parent == TC_H_ROOT   - class is root, which has no parent.
2184 	   parent == X:0	 - parent is root class.
2185 	   parent == X:Y	 - parent is a node in hierarchy.
2186 	   parent == 0:Y	 - parent is X:Y, where X:0 is qdisc.
2187 
2188 	   handle == 0:0	 - generate handle from kernel pool.
2189 	   handle == 0:Y	 - class is X:Y, where X:0 is qdisc.
2190 	   handle == X:Y	 - clear.
2191 	   handle == X:0	 - root class.
2192 	 */
2193 
2194 	/* Step 1. Determine qdisc handle X:0 */
2195 
2196 	portid = tcm->tcm_parent;
2197 	clid = tcm->tcm_handle;
2198 	qid = TC_H_MAJ(clid);
2199 
2200 	if (portid != TC_H_ROOT) {
2201 		u32 qid1 = TC_H_MAJ(portid);
2202 
2203 		if (qid && qid1) {
2204 			/* If both majors are known, they must be identical. */
2205 			if (qid != qid1)
2206 				return -EINVAL;
2207 		} else if (qid1) {
2208 			qid = qid1;
2209 		} else if (qid == 0)
2210 			qid = rtnl_dereference(dev->qdisc)->handle;
2211 
2212 		/* Now qid is genuine qdisc handle consistent
2213 		 * both with parent and child.
2214 		 *
2215 		 * TC_H_MAJ(portid) still may be unspecified, complete it now.
2216 		 */
2217 		if (portid)
2218 			portid = TC_H_MAKE(qid, portid);
2219 	} else {
2220 		if (qid == 0)
2221 			qid = rtnl_dereference(dev->qdisc)->handle;
2222 	}
2223 
2224 	/* OK. Locate qdisc */
2225 	q = qdisc_lookup(dev, qid);
2226 	if (!q)
2227 		return -ENOENT;
2228 
2229 	/* An check that it supports classes */
2230 	cops = q->ops->cl_ops;
2231 	if (cops == NULL)
2232 		return -EINVAL;
2233 
2234 	/* Now try to get class */
2235 	if (clid == 0) {
2236 		if (portid == TC_H_ROOT)
2237 			clid = qid;
2238 	} else
2239 		clid = TC_H_MAKE(qid, clid);
2240 
2241 	if (clid)
2242 		cl = cops->find(q, clid);
2243 
2244 	if (cl == 0) {
2245 		err = -ENOENT;
2246 		if (n->nlmsg_type != RTM_NEWTCLASS ||
2247 		    !(n->nlmsg_flags & NLM_F_CREATE))
2248 			goto out;
2249 	} else {
2250 		switch (n->nlmsg_type) {
2251 		case RTM_NEWTCLASS:
2252 			err = -EEXIST;
2253 			if (n->nlmsg_flags & NLM_F_EXCL)
2254 				goto out;
2255 			break;
2256 		case RTM_DELTCLASS:
2257 			err = tclass_del_notify(net, cops, skb, n, q, cl, extack);
2258 			/* Unbind the class with flilters with 0 */
2259 			tc_bind_tclass(q, portid, clid, 0);
2260 			goto out;
2261 		case RTM_GETTCLASS:
2262 			err = tclass_get_notify(net, skb, n, q, cl, extack);
2263 			goto out;
2264 		default:
2265 			err = -EINVAL;
2266 			goto out;
2267 		}
2268 	}
2269 
2270 	if (tca[TCA_INGRESS_BLOCK] || tca[TCA_EGRESS_BLOCK]) {
2271 		NL_SET_ERR_MSG(extack, "Shared blocks are not supported for classes");
2272 		return -EOPNOTSUPP;
2273 	}
2274 
2275 	/* Prevent creation of traffic classes with classid TC_H_ROOT */
2276 	if (clid == TC_H_ROOT) {
2277 		NL_SET_ERR_MSG(extack, "Cannot create traffic class with classid TC_H_ROOT");
2278 		return -EINVAL;
2279 	}
2280 
2281 	new_cl = cl;
2282 	err = -EOPNOTSUPP;
2283 	if (cops->change)
2284 		err = cops->change(q, clid, portid, tca, &new_cl, extack);
2285 	if (err == 0) {
2286 		tclass_notify(net, skb, n, q, new_cl, RTM_NEWTCLASS, extack);
2287 		/* We just create a new class, need to do reverse binding. */
2288 		if (cl != new_cl)
2289 			tc_bind_tclass(q, portid, clid, new_cl);
2290 	}
2291 out:
2292 	return err;
2293 }
2294 
2295 static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n,
2296 			 struct netlink_ext_ack *extack)
2297 {
2298 	struct net *net = sock_net(skb->sk);
2299 	struct tcmsg *tcm = nlmsg_data(n);
2300 	struct nlattr *tca[TCA_MAX + 1];
2301 	struct net_device *dev;
2302 	int err;
2303 
2304 	err = nlmsg_parse_deprecated(n, sizeof(*tcm), tca, TCA_MAX,
2305 				     rtm_tca_policy, extack);
2306 	if (err < 0)
2307 		return err;
2308 
2309 	dev = __dev_get_by_index(net, tcm->tcm_ifindex);
2310 	if (!dev)
2311 		return -ENODEV;
2312 
2313 	netdev_lock_ops(dev);
2314 	err = __tc_ctl_tclass(skb, n, extack, dev, tca, tcm);
2315 	netdev_unlock_ops(dev);
2316 
2317 	return err;
2318 }
2319 
2320 struct qdisc_dump_args {
2321 	struct qdisc_walker	w;
2322 	struct sk_buff		*skb;
2323 	struct netlink_callback	*cb;
2324 };
2325 
2326 static int qdisc_class_dump(struct Qdisc *q, unsigned long cl,
2327 			    struct qdisc_walker *arg)
2328 {
2329 	struct qdisc_dump_args *a = (struct qdisc_dump_args *)arg;
2330 
2331 	return tc_fill_tclass(a->skb, q, cl, NETLINK_CB(a->cb->skb).portid,
2332 			      a->cb->nlh->nlmsg_seq, NLM_F_MULTI,
2333 			      RTM_NEWTCLASS, NULL);
2334 }
2335 
2336 static int tc_dump_tclass_qdisc(struct Qdisc *q, struct sk_buff *skb,
2337 				struct tcmsg *tcm, struct netlink_callback *cb,
2338 				int *t_p, int s_t)
2339 {
2340 	struct qdisc_dump_args arg;
2341 
2342 	if (tc_qdisc_dump_ignore(q, false) ||
2343 	    *t_p < s_t || !q->ops->cl_ops ||
2344 	    (tcm->tcm_parent &&
2345 	     TC_H_MAJ(tcm->tcm_parent) != q->handle)) {
2346 		(*t_p)++;
2347 		return 0;
2348 	}
2349 	if (*t_p > s_t)
2350 		memset(&cb->args[1], 0, sizeof(cb->args)-sizeof(cb->args[0]));
2351 	arg.w.fn = qdisc_class_dump;
2352 	arg.skb = skb;
2353 	arg.cb = cb;
2354 	arg.w.stop  = 0;
2355 	arg.w.skip = cb->args[1];
2356 	arg.w.count = 0;
2357 	q->ops->cl_ops->walk(q, &arg.w);
2358 	cb->args[1] = arg.w.count;
2359 	if (arg.w.stop)
2360 		return -1;
2361 	(*t_p)++;
2362 	return 0;
2363 }
2364 
2365 static int tc_dump_tclass_root(struct Qdisc *root, struct sk_buff *skb,
2366 			       struct tcmsg *tcm, struct netlink_callback *cb,
2367 			       int *t_p, int s_t, bool recur)
2368 {
2369 	struct Qdisc *q;
2370 	int b;
2371 
2372 	if (!root)
2373 		return 0;
2374 
2375 	if (tc_dump_tclass_qdisc(root, skb, tcm, cb, t_p, s_t) < 0)
2376 		return -1;
2377 
2378 	if (!qdisc_dev(root) || !recur)
2379 		return 0;
2380 
2381 	if (tcm->tcm_parent) {
2382 		q = qdisc_match_from_root(root, TC_H_MAJ(tcm->tcm_parent));
2383 		if (q && q != root &&
2384 		    tc_dump_tclass_qdisc(q, skb, tcm, cb, t_p, s_t) < 0)
2385 			return -1;
2386 		return 0;
2387 	}
2388 	hash_for_each(qdisc_dev(root)->qdisc_hash, b, q, hash) {
2389 		if (tc_dump_tclass_qdisc(q, skb, tcm, cb, t_p, s_t) < 0)
2390 			return -1;
2391 	}
2392 
2393 	return 0;
2394 }
2395 
2396 static int __tc_dump_tclass(struct sk_buff *skb, struct netlink_callback *cb,
2397 			    struct tcmsg *tcm, struct net_device *dev)
2398 {
2399 	struct netdev_queue *dev_queue;
2400 	int t, s_t;
2401 
2402 	s_t = cb->args[0];
2403 	t = 0;
2404 
2405 	if (tc_dump_tclass_root(rtnl_dereference(dev->qdisc),
2406 				skb, tcm, cb, &t, s_t, true) < 0)
2407 		goto done;
2408 
2409 	dev_queue = dev_ingress_queue(dev);
2410 	if (dev_queue &&
2411 	    tc_dump_tclass_root(rtnl_dereference(dev_queue->qdisc_sleeping),
2412 				skb, tcm, cb, &t, s_t, false) < 0)
2413 		goto done;
2414 
2415 done:
2416 	cb->args[0] = t;
2417 
2418 	return skb->len;
2419 }
2420 
2421 static int tc_dump_tclass(struct sk_buff *skb, struct netlink_callback *cb)
2422 {
2423 	struct tcmsg *tcm = nlmsg_data(cb->nlh);
2424 	struct net *net = sock_net(skb->sk);
2425 	struct net_device *dev;
2426 	int err;
2427 
2428 	if (nlmsg_len(cb->nlh) < sizeof(*tcm))
2429 		return 0;
2430 
2431 	dev = dev_get_by_index(net, tcm->tcm_ifindex);
2432 	if (!dev)
2433 		return 0;
2434 
2435 	netdev_lock_ops(dev);
2436 	err = __tc_dump_tclass(skb, cb, tcm, dev);
2437 	netdev_unlock_ops(dev);
2438 
2439 	dev_put(dev);
2440 
2441 	return err;
2442 }
2443 
2444 #ifdef CONFIG_PROC_FS
2445 static int psched_show(struct seq_file *seq, void *v)
2446 {
2447 	seq_printf(seq, "%08x %08x %08x %08x\n",
2448 		   (u32)NSEC_PER_USEC, (u32)PSCHED_TICKS2NS(1),
2449 		   1000000,
2450 		   (u32)NSEC_PER_SEC / hrtimer_resolution);
2451 
2452 	return 0;
2453 }
2454 
2455 static int __net_init psched_net_init(struct net *net)
2456 {
2457 	struct proc_dir_entry *e;
2458 
2459 	e = proc_create_single("psched", 0, net->proc_net, psched_show);
2460 	if (e == NULL)
2461 		return -ENOMEM;
2462 
2463 	return 0;
2464 }
2465 
2466 static void __net_exit psched_net_exit(struct net *net)
2467 {
2468 	remove_proc_entry("psched", net->proc_net);
2469 }
2470 #else
2471 static int __net_init psched_net_init(struct net *net)
2472 {
2473 	return 0;
2474 }
2475 
2476 static void __net_exit psched_net_exit(struct net *net)
2477 {
2478 }
2479 #endif
2480 
2481 static struct pernet_operations psched_net_ops = {
2482 	.init = psched_net_init,
2483 	.exit = psched_net_exit,
2484 };
2485 
2486 #if IS_ENABLED(CONFIG_MITIGATION_RETPOLINE)
2487 DEFINE_STATIC_KEY_FALSE(tc_skip_wrapper);
2488 #endif
2489 
2490 static const struct rtnl_msg_handler psched_rtnl_msg_handlers[] __initconst = {
2491 	{.msgtype = RTM_NEWQDISC, .doit = tc_modify_qdisc},
2492 	{.msgtype = RTM_DELQDISC, .doit = tc_get_qdisc},
2493 	{.msgtype = RTM_GETQDISC, .doit = tc_get_qdisc,
2494 	 .dumpit = tc_dump_qdisc},
2495 	{.msgtype = RTM_NEWTCLASS, .doit = tc_ctl_tclass},
2496 	{.msgtype = RTM_DELTCLASS, .doit = tc_ctl_tclass},
2497 	{.msgtype = RTM_GETTCLASS, .doit = tc_ctl_tclass,
2498 	 .dumpit = tc_dump_tclass},
2499 };
2500 
2501 static int __init pktsched_init(void)
2502 {
2503 	int err;
2504 
2505 	err = register_pernet_subsys(&psched_net_ops);
2506 	if (err) {
2507 		pr_err("pktsched_init: "
2508 		       "cannot initialize per netns operations\n");
2509 		return err;
2510 	}
2511 
2512 	register_qdisc(&pfifo_fast_ops);
2513 	register_qdisc(&pfifo_qdisc_ops);
2514 	register_qdisc(&bfifo_qdisc_ops);
2515 	register_qdisc(&pfifo_head_drop_qdisc_ops);
2516 	register_qdisc(&mq_qdisc_ops);
2517 	register_qdisc(&noqueue_qdisc_ops);
2518 
2519 	rtnl_register_many(psched_rtnl_msg_handlers);
2520 
2521 	tc_wrapper_init();
2522 
2523 	return 0;
2524 }
2525 
2526 subsys_initcall(pktsched_init);
2527