From 9371b229a1ced41ab6372f8a2fc33fe6af21efe9 Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Sat, 9 May 2026 10:03:22 -0700 Subject: [PATCH 1/5] net/sched: netem: reorder struct netem_sched_data The current layout of struct netem_sched_data can be improved by optimizing cache locality, compacting data types (use u8 for enum) and eliminating unused elements. Reorganize the struct as follows: - Cacheline 0 holds the tfifo state (t_root/t_head/t_tail/t_len), counter, and the unconditional enqueue scalars latency/jitter/rate/gap/loss. - Cacheline 1 holds the remaining zero-check scalars (duplicate/reorder/corrupt/ecn), all five crndstate correlation structures, and loss_model. - Cacheline 2 holds prng, delay_dist, the slot dequeue state, slot_dist, and the inner classful qdisc pointer. - Rate-shaping fields, q->limit (config-only; the fast path reads sch->limit), and the CLG Markov state move to the warm tail. - tc_netem_slot slot_config and qdisc_watchdog (only consulted on slot reschedule and watchdog wake) move to the cold tail. Also reorder struct clgstate to place the u8 state member after the u32 transition probabilities. This removes the 3-byte interior hole without changing the struct's size. Should have no functional change. Signed-off-by: Stephen Hemminger Link: https://patch.msgid.link/20260509171123.307549-2-stephen@networkplumber.org Signed-off-by: Paolo Abeni --- net/sched/sch_netem.c | 125 +++++++++++++++++++++--------------------- 1 file changed, 64 insertions(+), 61 deletions(-) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index ddbfea9dd32a..5623610186bd 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -71,89 +71,92 @@ struct disttable { s16 table[] __counted_by(size); }; +/* Loss models */ +enum { + CLG_RANDOM, + CLG_4_STATES, + CLG_GILB_ELL, +}; + +/* States in GE model */ +enum { + GOOD_STATE = 1, + BAD_STATE, +}; + +/* States in 4 state model */ +enum { + TX_IN_GAP_PERIOD = 1, + TX_IN_BURST_PERIOD, + LOST_IN_GAP_PERIOD, + LOST_IN_BURST_PERIOD, +}; + struct netem_sched_data { - /* internal t(ime)fifo qdisc uses t_root and sch->limit */ - struct rb_root t_root; - - /* a linear queue; reduces rbtree rebalancing when jitter is low */ - struct sk_buff *t_head; - struct sk_buff *t_tail; - - u32 t_len; - - /* optional qdisc for classful handling (NULL at netem init) */ - struct Qdisc *qdisc; - - struct qdisc_watchdog watchdog; - - s64 latency; - s64 jitter; - - u32 loss; - u32 ecn; - u32 limit; - u32 counter; - u32 gap; - u32 duplicate; - u32 reorder; - u32 corrupt; - u64 rate; - s32 packet_overhead; - u32 cell_size; - struct reciprocal_value cell_size_reciprocal; - s32 cell_overhead; + /* Cacheline 0: tfifo state and per-packet enqueue/dequeue scalars. */ + struct rb_root t_root; + struct sk_buff *t_head; + struct sk_buff *t_tail; + u32 t_len; + u32 counter; + s64 latency; + s64 jitter; + u64 rate; + u32 gap; + u32 loss; + /* Cacheline 1: zero-check scalars and correlation states. */ + u32 duplicate; + u32 reorder; + u32 corrupt; + u32 ecn; struct crndstate { u32 last; u32 rho; } delay_cor, loss_cor, dup_cor, reorder_cor, corrupt_cor; + u8 loss_model; - struct prng { + /* Cacheline 2: PRNG, distribution tables, slot dequeue state etc. */ + struct prng { u64 seed; struct rnd_state prng_state; } prng; + struct disttable *delay_dist; + struct slotstate { + u64 slot_next; + s32 packets_left; + s32 bytes_left; + } slot; + struct disttable *slot_dist; + struct Qdisc *qdisc; - struct disttable *delay_dist; - - enum { - CLG_RANDOM, - CLG_4_STATES, - CLG_GILB_ELL, - } loss_model; - - enum { - TX_IN_GAP_PERIOD = 1, - TX_IN_BURST_PERIOD, - LOST_IN_GAP_PERIOD, - LOST_IN_BURST_PERIOD, - } _4_state_model; - - enum { - GOOD_STATE = 1, - BAD_STATE, - } GE_state_model; + /* + * Warm: rate-shaping parameters (only read when rate != 0) and + * configuration-only fields. The fast path reads sch->limit, not + * q->limit. + */ + s32 packet_overhead; + u32 cell_size; + struct reciprocal_value cell_size_reciprocal; + s32 cell_overhead; + u32 limit; /* Correlated Loss Generation models */ struct clgstate { - /* state of the Markov chain */ - u8 state; - /* 4-states and Gilbert-Elliot models */ u32 a1; /* p13 for 4-states or p for GE */ u32 a2; /* p31 for 4-states or r for GE */ u32 a3; /* p32 for 4-states or h for GE */ u32 a4; /* p14 for 4-states or 1-k for GE */ u32 a5; /* p23 used only in 4-states */ + + /* state of the Markov chain */ + u8 state; } clg; - struct tc_netem_slot slot_config; - struct slotstate { - u64 slot_next; - s32 packets_left; - s32 bytes_left; - } slot; - - struct disttable *slot_dist; + /* Cold tail: slot reschedule config and the watchdog timer. */ + struct tc_netem_slot slot_config; + struct qdisc_watchdog watchdog; }; /* Time stamp put into socket buffer control block From 4398429a5ff4bc8b38c6c57e78debc565a089672 Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Sat, 9 May 2026 10:03:23 -0700 Subject: [PATCH 2/5] net/sched: netem: remove useless VERSION The version printed was never updated and kernel version is better indication of what is fixed or not. Signed-off-by: Stephen Hemminger Link: https://patch.msgid.link/20260509171123.307549-3-stephen@networkplumber.org Signed-off-by: Paolo Abeni --- net/sched/sch_netem.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index 5623610186bd..e82c86c2654d 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -27,8 +27,6 @@ #include #include -#define VERSION "1.3" - /* Network Emulation Queuing algorithm. ==================================== @@ -1413,10 +1411,8 @@ static struct Qdisc_ops netem_qdisc_ops __read_mostly = { }; MODULE_ALIAS_NET_SCH("netem"); - static int __init netem_module_init(void) { - pr_info("netem: version " VERSION "\n"); return register_qdisc(&netem_qdisc_ops); } static void __exit netem_module_exit(void) From 675f6f1968a6710f357ac2ab65b0cf6180b8f400 Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Sat, 9 May 2026 10:03:24 -0700 Subject: [PATCH 3/5] net/sched: netem: replace pr_info with netlink extack error messages Use netlink extack to report errors instead of sending them to the kernel log with pr_info(). The error message can them be seen with tc commands; and avoids log spam. Signed-off-by: Stephen Hemminger Link: https://patch.msgid.link/20260509171123.307549-4-stephen@networkplumber.org Signed-off-by: Paolo Abeni --- net/sched/sch_netem.c | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index e82c86c2654d..7570bcb10a15 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -921,7 +921,8 @@ static void get_rate(struct netem_sched_data *q, const struct nlattr *attr) q->cell_size_reciprocal = (struct reciprocal_value) { 0 }; } -static int get_loss_clg(struct netem_sched_data *q, const struct nlattr *attr) +static int get_loss_clg(struct netem_sched_data *q, const struct nlattr *attr, + struct netlink_ext_ack *extack) { const struct nlattr *la; int rem; @@ -934,7 +935,8 @@ static int get_loss_clg(struct netem_sched_data *q, const struct nlattr *attr) const struct tc_netem_gimodel *gi = nla_data(la); if (nla_len(la) < sizeof(struct tc_netem_gimodel)) { - pr_info("netem: incorrect gi model size\n"); + NL_SET_ERR_MSG_ATTR(extack, la, + "netem: incorrect gi model size"); return -EINVAL; } @@ -953,7 +955,8 @@ static int get_loss_clg(struct netem_sched_data *q, const struct nlattr *attr) const struct tc_netem_gemodel *ge = nla_data(la); if (nla_len(la) < sizeof(struct tc_netem_gemodel)) { - pr_info("netem: incorrect ge model size\n"); + NL_SET_ERR_MSG_ATTR(extack, la, + "netem: incorrect ge model size"); return -EINVAL; } @@ -967,7 +970,8 @@ static int get_loss_clg(struct netem_sched_data *q, const struct nlattr *attr) } default: - pr_info("netem: unknown loss type %u\n", type); + NL_SET_ERR_MSG_ATTR_FMT(extack, la, + "netem: unknown loss type %u", type); return -EINVAL; } } @@ -990,19 +994,21 @@ static const struct nla_policy netem_policy[TCA_NETEM_MAX + 1] = { }; static int parse_attr(struct nlattr *tb[], int maxtype, struct nlattr *nla, - const struct nla_policy *policy, int len) + const struct nla_policy *policy, int len, + struct netlink_ext_ack *extack) { int nested_len = nla_len(nla) - NLA_ALIGN(len); if (nested_len < 0) { - pr_info("netem: invalid attributes len %d\n", nested_len); + NL_SET_ERR_MSG_FMT(extack, "netem: invalid attributes len %d < %d", + nla_len(nla), NLA_ALIGN(len)); return -EINVAL; } if (nested_len >= nla_attr_size(0)) return nla_parse_deprecated(tb, maxtype, nla_data(nla) + NLA_ALIGN(len), - nested_len, policy, NULL); + nested_len, policy, extack); memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1)); return 0; @@ -1057,7 +1063,7 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt, int ret; qopt = nla_data(opt); - ret = parse_attr(tb, TCA_NETEM_MAX, opt, netem_policy, sizeof(*qopt)); + ret = parse_attr(tb, TCA_NETEM_MAX, opt, netem_policy, sizeof(*qopt), extack); if (ret < 0) return ret; @@ -1097,7 +1103,7 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt, old_loss_model = q->loss_model; if (tb[TCA_NETEM_LOSS]) { - ret = get_loss_clg(q, tb[TCA_NETEM_LOSS]); + ret = get_loss_clg(q, tb[TCA_NETEM_LOSS], extack); if (ret) { q->loss_model = old_loss_model; q->clg = old_clg; @@ -1181,7 +1187,6 @@ static int netem_init(struct Qdisc *sch, struct nlattr *opt, struct netlink_ext_ack *extack) { struct netem_sched_data *q = qdisc_priv(sch); - int ret; qdisc_watchdog_init(&q->watchdog, sch); @@ -1192,10 +1197,7 @@ static int netem_init(struct Qdisc *sch, struct nlattr *opt, q->prng.seed = get_random_u64(); prandom_seed_state(&q->prng.prng_state, q->prng.seed); - ret = netem_change(sch, opt, extack); - if (ret) - pr_info("netem: change failed\n"); - return ret; + return netem_change(sch, opt, extack); } static void netem_destroy(struct Qdisc *sch) From e8be7cdedc41ff28876d66b566770929d03acbb8 Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Sat, 9 May 2026 10:03:25 -0700 Subject: [PATCH 4/5] net/sched: netem: handle multi-segment skb in corruption The packet corruption code only flipped bits in the linear header portion of the skb, skipping corruption when skb_headlen() was zero. Linearize the whole skb if necessary before corruption. Extends d64cb81dcbd5 ("net/sched: sch_netem: fix out-of-bounds access in packet corruption") with a more general solution. Signed-off-by: Stephen Hemminger Link: https://patch.msgid.link/20260509171123.307549-5-stephen@networkplumber.org Signed-off-by: Paolo Abeni --- net/sched/sch_netem.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index 7570bcb10a15..1e9de2ba8891 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -513,16 +513,17 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, qdisc_qstats_drop(sch); goto finish_segs; } - if (skb->ip_summed == CHECKSUM_PARTIAL && - skb_checksum_help(skb)) { + if (skb_linearize(skb) || + (skb->ip_summed == CHECKSUM_PARTIAL && skb_checksum_help(skb))) { qdisc_drop(skb, sch, to_free); skb = NULL; goto finish_segs; } - if (skb_headlen(skb)) - skb->data[get_random_u32_below(skb_headlen(skb))] ^= - 1 << get_random_u32_below(8); + if (skb->len) { + u32 offset = get_random_u32_below(skb->len); + skb->data[offset] ^= 1 << get_random_u32_below(8); + } } if (unlikely(sch->q.qlen >= sch->limit)) { From a2f6ed7b4873288d9e90e69199012857bed4bfa4 Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Sat, 9 May 2026 10:03:26 -0700 Subject: [PATCH 5/5] net/sched: netem: add per-impairment extended statistics Add 64-bit counters for each impairment netem applies (delay, loss, ECN marking, corruption, duplication, reordering) and for skb allocation failures during enqueue. Exposed through TCA_STATS_APP as struct tc_netem_xstats. Counters increment when an impairment is occurs, independent of later events that may mask its on-wire effect. Added allocation_errors (similar to sch_fq) to account for when impairment could not be applied due to memory pressure, etc. Signed-off-by: Stephen Hemminger Link: https://patch.msgid.link/20260509171123.307549-6-stephen@networkplumber.org Signed-off-by: Paolo Abeni --- include/uapi/linux/pkt_sched.h | 10 +++++++ net/sched/sch_netem.c | 55 ++++++++++++++++++++++++++++++---- 2 files changed, 59 insertions(+), 6 deletions(-) diff --git a/include/uapi/linux/pkt_sched.h b/include/uapi/linux/pkt_sched.h index 66e8072f44df..490efd288526 100644 --- a/include/uapi/linux/pkt_sched.h +++ b/include/uapi/linux/pkt_sched.h @@ -569,6 +569,16 @@ struct tc_netem_gemodel { #define NETEM_DIST_SCALE 8192 #define NETEM_DIST_MAX 16384 +struct tc_netem_xstats { + __u64 delayed; /* packets delayed */ + __u64 dropped; /* packets dropped by loss model */ + __u64 corrupted; /* packets with bit errors injected */ + __u64 duplicated; /* duplicate packets generated */ + __u64 reordered; /* packets sent out of order */ + __u64 ecn_marked; /* packets ECN CE-marked (not dropped)*/ + __u64 allocation_errors; +}; + /* DRR */ enum { diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index 1e9de2ba8891..6cd1838e09e7 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -152,6 +152,15 @@ struct netem_sched_data { u8 state; } clg; + /* Impairment counters */ + u64 delayed; + u64 dropped; + u64 corrupted; + u64 duplicated; + u64 ecn_marked; + u64 reordered; + u64 allocation_errors; + /* Cold tail: slot reschedule config and the watchdog timer. */ struct tc_netem_slot slot_config; struct qdisc_watchdog watchdog; @@ -462,16 +471,21 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, skb->prev = NULL; /* Random duplication */ - if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor, &q->prng)) + if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor, &q->prng)) { ++count; + WRITE_ONCE(q->duplicated, q->duplicated + 1); + } /* Drop packet? */ if (loss_event(q)) { - if (q->ecn && INET_ECN_set_ce(skb)) - qdisc_qstats_drop(sch); /* mark packet */ - else + if (q->ecn && INET_ECN_set_ce(skb)) { + WRITE_ONCE(q->ecn_marked, q->ecn_marked + 1); + } else { + WRITE_ONCE(q->dropped, q->dropped + 1); --count; + } } + if (count == 0) { qdisc_qstats_drop(sch); __qdisc_drop(skb, to_free); @@ -488,8 +502,11 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, * If we need to duplicate packet, then clone it before * original is modified. */ - if (count > 1) + if (count > 1) { skb2 = skb_clone(skb, GFP_ATOMIC); + if (!skb2) + WRITE_ONCE(q->allocation_errors, q->allocation_errors + 1); + } /* * Randomized packet corruption. @@ -500,8 +517,10 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor, &q->prng)) { if (skb_is_gso(skb)) { skb = netem_segment(skb, sch, to_free); - if (!skb) + if (!skb) { + WRITE_ONCE(q->allocation_errors, q->allocation_errors + 1); goto finish_segs; + } segs = skb->next; skb_mark_not_on_list(skb); @@ -510,11 +529,13 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, skb = skb_unshare(skb, GFP_ATOMIC); if (unlikely(!skb)) { + WRITE_ONCE(q->allocation_errors, q->allocation_errors + 1); qdisc_qstats_drop(sch); goto finish_segs; } if (skb_linearize(skb) || (skb->ip_summed == CHECKSUM_PARTIAL && skb_checksum_help(skb))) { + WRITE_ONCE(q->allocation_errors, q->allocation_errors + 1); qdisc_drop(skb, sch, to_free); skb = NULL; goto finish_segs; @@ -523,6 +544,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, if (skb->len) { u32 offset = get_random_u32_below(skb->len); skb->data[offset] ^= 1 << get_random_u32_below(8); + WRITE_ONCE(q->corrupted, q->corrupted + 1); } } @@ -604,12 +626,16 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, cb->time_to_send = now + delay; ++q->counter; + if (delay) + WRITE_ONCE(q->delayed, q->delayed + 1); + tfifo_enqueue(skb, sch); } else { /* * Do re-ordering by putting one out of N packets at the front * of the queue. */ + WRITE_ONCE(q->reordered, q->reordered + 1); cb->time_to_send = ktime_get_ns(); q->counter = 0; @@ -1348,6 +1374,22 @@ nla_put_failure: return -1; } +static int netem_dump_stats(struct Qdisc *sch, struct gnet_dump *d) +{ + struct netem_sched_data *q = qdisc_priv(sch); + struct tc_netem_xstats st = { + .delayed = READ_ONCE(q->delayed), + .dropped = READ_ONCE(q->dropped), + .corrupted = READ_ONCE(q->corrupted), + .duplicated = READ_ONCE(q->duplicated), + .reordered = READ_ONCE(q->reordered), + .ecn_marked = READ_ONCE(q->ecn_marked), + .allocation_errors = READ_ONCE(q->allocation_errors), + }; + + return gnet_stats_copy_app(d, &st, sizeof(st)); +} + static int netem_dump_class(struct Qdisc *sch, unsigned long cl, struct sk_buff *skb, struct tcmsg *tcm) { @@ -1410,6 +1452,7 @@ static struct Qdisc_ops netem_qdisc_ops __read_mostly = { .destroy = netem_destroy, .change = netem_change, .dump = netem_dump, + .dump_stats = netem_dump_stats, .owner = THIS_MODULE, }; MODULE_ALIAS_NET_SCH("netem");