add a pseudo pps limit to netback

This patch provides a new option to limit VMs maximum packets per second emission rate.
It follows the same credits logic used for throughput shaping. For the moment we have considered each "txreq" as a packet.
PPS limits is passed to VIF at connection time via xenstore. PPS credit uses the same usecond period used by rate shaping check.

known limitations:
- by using the same usecond period, PPS shaping depends on throughput shaping.
- it is not always true that a "txreq" correspond to a packet (fragmentation cases) but as this shaping is meant to avoid DDOS (small paquets) such an approximation should not impact the results.
- Some help on burst handling will be appreciated.

Signed-off-by Ahmed Amamou <[email protected]>

Signed-off-by William Dauchy <[email protected]>

Signed-off-by Kamel Haddadou <[email protected]>

---

Just wondering, why should this be done in the drivers ? Couldn't this also be achieved with netfilter and the recent/limit modules ? The limit module can already handle bursts.

Quoted 3 lines · Sander Eikelenboom

Just wondering, why should this be done in the drivers ? Couldn't this also be achieved with netfilter and the recent/limit modules ? The limit module can already handle bursts.

We indeed forgot to talk about it since we already got the question from Wei.
The first thing is that your comment is also true for bandwidth which is already present. Moreover PPS is linked to bandwidth.
By using netfilter, PPS shaping is done on backend level, once packet has left the VM; which means after using an additional memory transaction to copy packet from frontend. IMHO, at scale, shaping in this way should save some memory transactions comparing to netfilter.

Ok so the main usage scenario is not inbound traffic from the outside world that issues a (D)DOS, but rather a (malicious) guest that could issue a DOS on the host system by
draining the resources of the netback driver by sending many packets per second.
And that this scenario can't be circumvented with netfilter because it doesn't come into play yet (on the host).

Quoted 3 lines · Sander Eikelenboom

Just wondering, why should this be done in the drivers ? Couldn't this also be achieved with netfilter and the recent/limit modules ? The limit module can already handle bursts.

We indeed forgot to talk about it since we already got the question from Wei.
The first thing is that your comment is also true for bandwidth which is already present. Moreover PPS is linked to bandwidth.
By using netfilter, PPS shaping is done on backend level, once packet has left the VM; which means after using an additional memory transaction to copy packet from frontend. IMHO, at scale, shaping in this way should save some memory transactions comparing to netfilter.

Quoted 5 lines · William Dauchy

Quoted 3 lines · Sander Eikelenboom

Just wondering, why should this be done in the drivers ? Couldn't this also be achieved with netfilter and the recent/limit modules ? The limit module can already handle bursts.

Quoted 8 lines

We indeed forgot to talk about it since we already got the question from Wei.
The first thing is that your comment is also true for bandwidth which is already present. Moreover PPS is linked to bandwidth.
By using netfilter, PPS shaping is done on backend level, once packet has left the VM; which means after using an additional memory transaction to copy packet from frontend. IMHO, at scale, shaping in this way should save some memory transactions comparing to netfilter.

Have you tried the netfilter approach and found it to be insufficient in practice?

I'm not sure how netfilter recent/limit is implemented but if it queues rather than drops you would naturally find that you end up with back pressure onto the netback device where the ring would fill with in-progress requests and therefore netback would have to stop processing more packets.

Ian.

This patch provides a new option to limit VMs maximum packets per second emission rate.
It follows the same credits logic used for throughput shaping. For the moment we have considered each "txreq" as a packet.
PPS limits is passed to VIF at connection time via xenstore. PPS credit uses the same usecond period used by rate shaping check.

known limitations:
- by using the same usecond period, PPS shaping depends on throughput shaping.
- it is not always true that a "txreq" correspond to a packet (fragmentation cases) but as this shaping is meant to avoid DDOS (small paquets) such an approximation should not impact the results.

- Some help on burst handling will be appreciated.

Signed-off-by Ahmed Amamou <[email protected]>

Signed-off-by William Dauchy <[email protected]>

Signed-off-by Kamel Haddadou <[email protected]>

---
 drivers/net/xen-netback/common.h    |    2 ++
 drivers/net/xen-netback/interface.c |    1 +
 drivers/net/xen-netback/netback.c   |   46 +++++++++++++++++++++++++++++++++++
 drivers/net/xen-netback/xenbus.c    |   25 ++++++++++++++++---
 4 files changed, 70 insertions(+), 4 deletions(-)

drivers/net/xen-netback/common.h +2 -0

index 9d7f172..fefa79a 100644
@@ -85,8 +85,10 @@ struct xenvif {
 
 	/* Transmit shaping: allow 'credit_bytes' every 'credit_usec'. */
 	unsigned long   credit_bytes;
+	unsigned long   credit_packets;
 	unsigned long   credit_usec;
 	unsigned long   remaining_credit;
+	unsigned long   remaining_packets;
 	struct timer_list credit_timeout;
 
 	/* Statistics */

drivers/net/xen-netback/interface.c +1 -0

index d984141..06257dd 100644
@@ -273,6 +273,7 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
 	INIT_LIST_HEAD(&vif->notify_list);
 
 	vif->credit_bytes = vif->remaining_credit = ~0UL;
+	vif->credit_packets = vif->remaining_packets = ~0UL;
 	vif->credit_usec  = 0UL;
 	init_timer(&vif->credit_timeout);
 	/* Initialize 'expires' now: it's used to track the credit window. */

drivers/net/xen-netback/netback.c +22 -0

index 8c20935..172a6de 100644
@@ -905,10 +905,16 @@ static void tx_add_credit(struct xenvif *vif)
 	vif->remaining_credit = min(max_credit, max_burst);
 }
 
+static void tx_add_packets(struct xenvif *vif)
+{
+	vif->remaining_packets = vif->credit_packets;
+}
+
 static void tx_credit_callback(unsigned long data)
 {
 	struct xenvif *vif = (struct xenvif *)data;
 	tx_add_credit(vif);
+	tx_add_packets(vif);
 	xen_netbk_check_rx_xenvif(vif);
 }
 

@@ -1419,6 +1425,38 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
 	return false;
 }
 
+static bool tx_packets_exceeded(struct xenvif *vif)
+{
+	unsigned long now = jiffies;
+	unsigned long next_credit =
+		vif->credit_timeout.expires +
+		msecs_to_jiffies(vif->credit_usec / 1000);
+
+	/* Timer could already be pending in rare cases. */
+	if (timer_pending(&vif->credit_timeout))
+		return true;
+
+	/* Passed the point where we can replenish credit? */
+	if (time_after_eq(now, next_credit)) {
+		vif->credit_timeout.expires = now;
+		tx_add_packets(vif);
+	}

drivers/net/xen-netback/netback.c +6 -0

+		return true;
+	}
+
+	return false;
+}
+
 static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
 {
 	struct gnttab_copy *gop = netbk->tx_copy_ops, *request_gop;

drivers/net/xen-netback/netback.c +5 -0

+			xenvif_put(vif);
+			continue;
+		}
+
 		/* Credit-based scheduling. */
 		if (txreq.size > vif->remaining_credit &&
 		    tx_credit_exceeded(vif, txreq.size)) {

@@ -1478,6 +1523,7 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
 		}
 
 		vif->remaining_credit -= txreq.size;
+		vif->remaining_packets--;
 
 		work_to_do--;
 		vif->tx.req_cons = ++idx;

drivers/net/xen-netback/xenbus.c +0 -0

index 410018c..7c55bed 100644

drivers/net/xen-netback/xenbus.c +4 -2

+			      unsigned long *usec)
 {
 	char *s, *e;
-	unsigned long b, u;
-	char *ratestr;
+	unsigned long b, u, pps;
+	char *ratestr, *ppsstr;
 
 	/* Default to unlimited bandwidth. */
 	*bytes = ~0UL;
 	*usec = 0;
+	*packet = ~0UL;
 
 	ratestr = xenbus_read(XBT_NIL, dev->nodename, "rate", NULL);
 	if (IS_ERR(ratestr))

drivers/net/xen-netback/xenbus.c +2 -1

 }
 
 static int xen_net_read_mac(struct xenbus_device *dev, u8 mac[])

@@ -370,8 +386,9 @@ static void connect(struct backend_info *be)
 	}
 
 	xen_net_read_rate(dev, &be->vif->credit_bytes,
-			  &be->vif->credit_usec);
+			  &be->vif->credit_packets, &be->vif->credit_usec);
 	be->vif->remaining_credit = be->vif->credit_bytes;
+	be->vif->remaining_packets = be->vif->credit_packets;
 
 	unregister_hotplug_status_watch(be);
 	err = xenbus_watch_pathfmt(dev, &be->hotplug_status_watch,

Signature · 1 line

1.7.9.5

adapt libxl to handle pps limit parameter
the new pps limit can be defined using a '&' symbol after the rate limit for example:
YYMb/s&XXKpps@ZZms
or
YYMb/s@ZZms&XXKpps
or
YYMb/s&XXKpps in such case default 50ms interval will be used

Signed-off-by Ahmed Amamou <[email protected]>

Signed-off-by William Dauchy <[email protected]>

Signed-off-by Kamel Haddadou <[email protected]>

---
 tools/libxl/libxl.c         |    3 ++
 tools/libxl/libxl_types.idl |    1 +
 tools/libxl/libxlu_vif.c    |   68 +++++++++++++++++++++++++++++++++++++++++--
 3 files changed, 69 insertions(+), 3 deletions(-)

tools/libxl/libxl.c +3 -0

index 3236aa9..7cbbd5b 100644
@@ -2920,6 +2920,9 @@ void libxl__device_nic_add(libxl__egc *egc, uint32_t domid,
         flexarray_append(back, libxl__sprintf(gc, "%"PRIu64",%"PRIu32"",
                             nic->rate_bytes_per_interval,
                             nic->rate_interval_usecs));
+        flexarray_append(back, "pps");
+        flexarray_append(back, libxl__sprintf(gc, "%"PRIu64"",
+                            nic->rate_packet_per_interval));
     }
 
     flexarray_append(back, "bridge");

tools/libxl/libxl_types.idl +0 -0

index d218a2d..a397a91 100644

tools/libxl/libxlu_vif.c +61 -3

 static void xlu__vif_err(XLU_Config *cfg, const char *msg, const char *rate) {
     fprintf(cfg->report,

@@ -49,6 +50,43 @@ out:
     return rc;
 }
 
+static int vif_parse_rate_packet_per_sec(XLU_Config *cfg, const char *packet,
+                                        uint64_t *packet_per_sec)
+{
+    regex_t rec;
+    uint64_t tmp = 0;
+    const char *p;
+    int rc = 0;
+
+    regcomp(&rec, vif_packet_per_sec_re, REG_EXTENDED|REG_NOSUB);
+    if (regexec(&rec, packet, 0, NULL, 0)) {
+        xlu__vif_err(cfg, "invalid pps", packet);
+        rc = EINVAL;
+        goto out;
+    }
+
+    p = packet;
+    tmp = strtoull(p, (char**)&p, 0);
+    if (tmp == 0 || tmp > UINT32_MAX || errno == ERANGE) {
+        xlu__vif_err(cfg, "pps overflow", packet);
+        rc = EOVERFLOW;
+        goto out;
+    }
+
+    if (*p == 'G')
+       tmp *= 1000 * 1000 * 1000;
+    else if (*p == 'M')
+       tmp *= 1000 * 1000;
+    else if (*p == 'K')
+       tmp *= 1000;
+
+    *packet_per_sec = tmp;
+
+out:
+    regfree(&rec);
+    return rc;
+}
+
 static int vif_parse_rate_interval_usecs(XLU_Config *cfg, const char *interval,
                                          uint32_t *interval_usecs)
 {

@@ -94,22 +132,35 @@ int xlu_vif_parse_rate(XLU_Config *cfg, const char *rate, libxl_device_nic *nic)
 {
     uint64_t bytes_per_sec = 0;
     uint64_t bytes_per_interval = 0;
+    uint64_t packet_per_sec = 0;
+    uint64_t packet_per_interval = 0;
     uint32_t interval_usecs = 50000UL; /* Default to 50ms */
-    char *ratetok, *tmprate;
+    char *ratetok, *tmprate, *tmp_pps, *tmpint;
     int rc = 0;
 
+    /* rate string need to be duplicated because strtok may change it */
     tmprate = strdup(rate);
+    tmp_pps = strdup(rate);
+    tmpint = strdup(rate);
+
     if (!strcmp(tmprate,"")) {
         xlu__vif_err(cfg, "no rate specified", rate);
         rc = EINVAL;
         goto out;
     }
 
-    ratetok = strtok(tmprate, "@");
+    /* accepted rate string are as follow:
+     * rate&pps@interval or rate@interval&pps
+     */
+
+    /* ratetok contains the first token */
+    ratetok = strtok(tmprate, "@&");
     rc = vif_parse_rate_bytes_per_sec(cfg, ratetok, &bytes_per_sec);
     if (rc) goto out;
 
-    ratetok = strtok(NULL, "@");
+    ratetok = strtok(tmpint, "@");
+    ratetok = strtok(NULL, "@&");
+    /* ratetok contains the first token following the '@' */
     if (ratetok != NULL) {
         rc = vif_parse_rate_interval_usecs(cfg, ratetok, &interval_usecs);
         if (rc) goto out;

@@ -121,11 +172,22 @@ int xlu_vif_parse_rate(XLU_Config *cfg, const char *rate, libxl_device_nic *nic)
         goto out;
     }
 
+    ratetok = strtok(tmp_pps, "&");
+    ratetok = strtok(NULL, "&@");
+    /* ratetok contains the first token following the '&' */
+    if (ratetok != NULL) {
+        rc = vif_parse_rate_packet_per_sec(cfg, ratetok, &packet_per_sec);
+        if (rc) goto out;
+    }
+
     bytes_per_interval =

Signature · 1 line

1.7.9.5