IB/umad: Fix use-after-free on close
[linux/fpc-iii.git] / net / sched / sch_sfb.c
blobc6a5867d35c4e170de2a3a3c72aa3ba1cbdea494
1 /*
2 * net/sched/sch_sfb.c Stochastic Fair Blue
4 * Copyright (c) 2008-2011 Juliusz Chroboczek <jch@pps.jussieu.fr>
5 * Copyright (c) 2011 Eric Dumazet <eric.dumazet@gmail.com>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * version 2 as published by the Free Software Foundation.
11 * W. Feng, D. Kandlur, D. Saha, K. Shin. Blue:
12 * A New Class of Active Queue Management Algorithms.
13 * U. Michigan CSE-TR-387-99, April 1999.
15 * http://www.thefengs.com/wuchang/blue/CSE-TR-387-99.pdf
19 #include <linux/module.h>
20 #include <linux/types.h>
21 #include <linux/kernel.h>
22 #include <linux/errno.h>
23 #include <linux/skbuff.h>
24 #include <linux/random.h>
25 #include <linux/jhash.h>
26 #include <net/ip.h>
27 #include <net/pkt_sched.h>
28 #include <net/inet_ecn.h>
29 #include <net/flow_keys.h>
32 * SFB uses two B[l][n] : L x N arrays of bins (L levels, N bins per level)
33 * This implementation uses L = 8 and N = 16
34 * This permits us to split one 32bit hash (provided per packet by rxhash or
35 * external classifier) into 8 subhashes of 4 bits.
37 #define SFB_BUCKET_SHIFT 4
38 #define SFB_NUMBUCKETS (1 << SFB_BUCKET_SHIFT) /* N bins per Level */
39 #define SFB_BUCKET_MASK (SFB_NUMBUCKETS - 1)
40 #define SFB_LEVELS (32 / SFB_BUCKET_SHIFT) /* L */
42 /* SFB algo uses a virtual queue, named "bin" */
43 struct sfb_bucket {
44 u16 qlen; /* length of virtual queue */
45 u16 p_mark; /* marking probability */
48 /* We use a double buffering right before hash change
49 * (Section 4.4 of SFB reference : moving hash functions)
51 struct sfb_bins {
52 u32 perturbation; /* jhash perturbation */
53 struct sfb_bucket bins[SFB_LEVELS][SFB_NUMBUCKETS];
56 struct sfb_sched_data {
57 struct Qdisc *qdisc;
58 struct tcf_proto *filter_list;
59 unsigned long rehash_interval;
60 unsigned long warmup_time; /* double buffering warmup time in jiffies */
61 u32 max;
62 u32 bin_size; /* maximum queue length per bin */
63 u32 increment; /* d1 */
64 u32 decrement; /* d2 */
65 u32 limit; /* HARD maximal queue length */
66 u32 penalty_rate;
67 u32 penalty_burst;
68 u32 tokens_avail;
69 unsigned long rehash_time;
70 unsigned long token_time;
72 u8 slot; /* current active bins (0 or 1) */
73 bool double_buffering;
74 struct sfb_bins bins[2];
76 struct {
77 u32 earlydrop;
78 u32 penaltydrop;
79 u32 bucketdrop;
80 u32 queuedrop;
81 u32 childdrop; /* drops in child qdisc */
82 u32 marked; /* ECN mark */
83 } stats;
87 * Each queued skb might be hashed on one or two bins
88 * We store in skb_cb the two hash values.
89 * (A zero value means double buffering was not used)
91 struct sfb_skb_cb {
92 u32 hashes[2];
95 static inline struct sfb_skb_cb *sfb_skb_cb(const struct sk_buff *skb)
97 qdisc_cb_private_validate(skb, sizeof(struct sfb_skb_cb));
98 return (struct sfb_skb_cb *)qdisc_skb_cb(skb)->data;
102 * If using 'internal' SFB flow classifier, hash comes from skb rxhash
103 * If using external classifier, hash comes from the classid.
105 static u32 sfb_hash(const struct sk_buff *skb, u32 slot)
107 return sfb_skb_cb(skb)->hashes[slot];
110 /* Probabilities are coded as Q0.16 fixed-point values,
111 * with 0xFFFF representing 65535/65536 (almost 1.0)
112 * Addition and subtraction are saturating in [0, 65535]
114 static u32 prob_plus(u32 p1, u32 p2)
116 u32 res = p1 + p2;
118 return min_t(u32, res, SFB_MAX_PROB);
121 static u32 prob_minus(u32 p1, u32 p2)
123 return p1 > p2 ? p1 - p2 : 0;
126 static void increment_one_qlen(u32 sfbhash, u32 slot, struct sfb_sched_data *q)
128 int i;
129 struct sfb_bucket *b = &q->bins[slot].bins[0][0];
131 for (i = 0; i < SFB_LEVELS; i++) {
132 u32 hash = sfbhash & SFB_BUCKET_MASK;
134 sfbhash >>= SFB_BUCKET_SHIFT;
135 if (b[hash].qlen < 0xFFFF)
136 b[hash].qlen++;
137 b += SFB_NUMBUCKETS; /* next level */
141 static void increment_qlen(const struct sk_buff *skb, struct sfb_sched_data *q)
143 u32 sfbhash;
145 sfbhash = sfb_hash(skb, 0);
146 if (sfbhash)
147 increment_one_qlen(sfbhash, 0, q);
149 sfbhash = sfb_hash(skb, 1);
150 if (sfbhash)
151 increment_one_qlen(sfbhash, 1, q);
154 static void decrement_one_qlen(u32 sfbhash, u32 slot,
155 struct sfb_sched_data *q)
157 int i;
158 struct sfb_bucket *b = &q->bins[slot].bins[0][0];
160 for (i = 0; i < SFB_LEVELS; i++) {
161 u32 hash = sfbhash & SFB_BUCKET_MASK;
163 sfbhash >>= SFB_BUCKET_SHIFT;
164 if (b[hash].qlen > 0)
165 b[hash].qlen--;
166 b += SFB_NUMBUCKETS; /* next level */
170 static void decrement_qlen(const struct sk_buff *skb, struct sfb_sched_data *q)
172 u32 sfbhash;
174 sfbhash = sfb_hash(skb, 0);
175 if (sfbhash)
176 decrement_one_qlen(sfbhash, 0, q);
178 sfbhash = sfb_hash(skb, 1);
179 if (sfbhash)
180 decrement_one_qlen(sfbhash, 1, q);
183 static void decrement_prob(struct sfb_bucket *b, struct sfb_sched_data *q)
185 b->p_mark = prob_minus(b->p_mark, q->decrement);
188 static void increment_prob(struct sfb_bucket *b, struct sfb_sched_data *q)
190 b->p_mark = prob_plus(b->p_mark, q->increment);
193 static void sfb_zero_all_buckets(struct sfb_sched_data *q)
195 memset(&q->bins, 0, sizeof(q->bins));
199 * compute max qlen, max p_mark, and avg p_mark
201 static u32 sfb_compute_qlen(u32 *prob_r, u32 *avgpm_r, const struct sfb_sched_data *q)
203 int i;
204 u32 qlen = 0, prob = 0, totalpm = 0;
205 const struct sfb_bucket *b = &q->bins[q->slot].bins[0][0];
207 for (i = 0; i < SFB_LEVELS * SFB_NUMBUCKETS; i++) {
208 if (qlen < b->qlen)
209 qlen = b->qlen;
210 totalpm += b->p_mark;
211 if (prob < b->p_mark)
212 prob = b->p_mark;
213 b++;
215 *prob_r = prob;
216 *avgpm_r = totalpm / (SFB_LEVELS * SFB_NUMBUCKETS);
217 return qlen;
221 static void sfb_init_perturbation(u32 slot, struct sfb_sched_data *q)
223 q->bins[slot].perturbation = net_random();
226 static void sfb_swap_slot(struct sfb_sched_data *q)
228 sfb_init_perturbation(q->slot, q);
229 q->slot ^= 1;
230 q->double_buffering = false;
233 /* Non elastic flows are allowed to use part of the bandwidth, expressed
234 * in "penalty_rate" packets per second, with "penalty_burst" burst
236 static bool sfb_rate_limit(struct sk_buff *skb, struct sfb_sched_data *q)
238 if (q->penalty_rate == 0 || q->penalty_burst == 0)
239 return true;
241 if (q->tokens_avail < 1) {
242 unsigned long age = min(10UL * HZ, jiffies - q->token_time);
244 q->tokens_avail = (age * q->penalty_rate) / HZ;
245 if (q->tokens_avail > q->penalty_burst)
246 q->tokens_avail = q->penalty_burst;
247 q->token_time = jiffies;
248 if (q->tokens_avail < 1)
249 return true;
252 q->tokens_avail--;
253 return false;
256 static bool sfb_classify(struct sk_buff *skb, struct sfb_sched_data *q,
257 int *qerr, u32 *salt)
259 struct tcf_result res;
260 int result;
262 result = tc_classify(skb, q->filter_list, &res);
263 if (result >= 0) {
264 #ifdef CONFIG_NET_CLS_ACT
265 switch (result) {
266 case TC_ACT_STOLEN:
267 case TC_ACT_QUEUED:
268 *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
269 case TC_ACT_SHOT:
270 return false;
272 #endif
273 *salt = TC_H_MIN(res.classid);
274 return true;
276 return false;
279 static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
282 struct sfb_sched_data *q = qdisc_priv(sch);
283 struct Qdisc *child = q->qdisc;
284 int i;
285 u32 p_min = ~0;
286 u32 minqlen = ~0;
287 u32 r, slot, salt, sfbhash;
288 int ret = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
289 struct flow_keys keys;
291 if (unlikely(sch->q.qlen >= q->limit)) {
292 sch->qstats.overlimits++;
293 q->stats.queuedrop++;
294 goto drop;
297 if (q->rehash_interval > 0) {
298 unsigned long limit = q->rehash_time + q->rehash_interval;
300 if (unlikely(time_after(jiffies, limit))) {
301 sfb_swap_slot(q);
302 q->rehash_time = jiffies;
303 } else if (unlikely(!q->double_buffering && q->warmup_time > 0 &&
304 time_after(jiffies, limit - q->warmup_time))) {
305 q->double_buffering = true;
309 if (q->filter_list) {
310 /* If using external classifiers, get result and record it. */
311 if (!sfb_classify(skb, q, &ret, &salt))
312 goto other_drop;
313 keys.src = salt;
314 keys.dst = 0;
315 keys.ports = 0;
316 } else {
317 skb_flow_dissect(skb, &keys);
320 slot = q->slot;
322 sfbhash = jhash_3words((__force u32)keys.dst,
323 (__force u32)keys.src,
324 (__force u32)keys.ports,
325 q->bins[slot].perturbation);
326 if (!sfbhash)
327 sfbhash = 1;
328 sfb_skb_cb(skb)->hashes[slot] = sfbhash;
330 for (i = 0; i < SFB_LEVELS; i++) {
331 u32 hash = sfbhash & SFB_BUCKET_MASK;
332 struct sfb_bucket *b = &q->bins[slot].bins[i][hash];
334 sfbhash >>= SFB_BUCKET_SHIFT;
335 if (b->qlen == 0)
336 decrement_prob(b, q);
337 else if (b->qlen >= q->bin_size)
338 increment_prob(b, q);
339 if (minqlen > b->qlen)
340 minqlen = b->qlen;
341 if (p_min > b->p_mark)
342 p_min = b->p_mark;
345 slot ^= 1;
346 sfb_skb_cb(skb)->hashes[slot] = 0;
348 if (unlikely(minqlen >= q->max)) {
349 sch->qstats.overlimits++;
350 q->stats.bucketdrop++;
351 goto drop;
354 if (unlikely(p_min >= SFB_MAX_PROB)) {
355 /* Inelastic flow */
356 if (q->double_buffering) {
357 sfbhash = jhash_3words((__force u32)keys.dst,
358 (__force u32)keys.src,
359 (__force u32)keys.ports,
360 q->bins[slot].perturbation);
361 if (!sfbhash)
362 sfbhash = 1;
363 sfb_skb_cb(skb)->hashes[slot] = sfbhash;
365 for (i = 0; i < SFB_LEVELS; i++) {
366 u32 hash = sfbhash & SFB_BUCKET_MASK;
367 struct sfb_bucket *b = &q->bins[slot].bins[i][hash];
369 sfbhash >>= SFB_BUCKET_SHIFT;
370 if (b->qlen == 0)
371 decrement_prob(b, q);
372 else if (b->qlen >= q->bin_size)
373 increment_prob(b, q);
376 if (sfb_rate_limit(skb, q)) {
377 sch->qstats.overlimits++;
378 q->stats.penaltydrop++;
379 goto drop;
381 goto enqueue;
384 r = net_random() & SFB_MAX_PROB;
386 if (unlikely(r < p_min)) {
387 if (unlikely(p_min > SFB_MAX_PROB / 2)) {
388 /* If we're marking that many packets, then either
389 * this flow is unresponsive, or we're badly congested.
390 * In either case, we want to start dropping packets.
392 if (r < (p_min - SFB_MAX_PROB / 2) * 2) {
393 q->stats.earlydrop++;
394 goto drop;
397 if (INET_ECN_set_ce(skb)) {
398 q->stats.marked++;
399 } else {
400 q->stats.earlydrop++;
401 goto drop;
405 enqueue:
406 ret = qdisc_enqueue(skb, child);
407 if (likely(ret == NET_XMIT_SUCCESS)) {
408 sch->q.qlen++;
409 increment_qlen(skb, q);
410 } else if (net_xmit_drop_count(ret)) {
411 q->stats.childdrop++;
412 sch->qstats.drops++;
414 return ret;
416 drop:
417 qdisc_drop(skb, sch);
418 return NET_XMIT_CN;
419 other_drop:
420 if (ret & __NET_XMIT_BYPASS)
421 sch->qstats.drops++;
422 kfree_skb(skb);
423 return ret;
426 static struct sk_buff *sfb_dequeue(struct Qdisc *sch)
428 struct sfb_sched_data *q = qdisc_priv(sch);
429 struct Qdisc *child = q->qdisc;
430 struct sk_buff *skb;
432 skb = child->dequeue(q->qdisc);
434 if (skb) {
435 qdisc_bstats_update(sch, skb);
436 sch->q.qlen--;
437 decrement_qlen(skb, q);
440 return skb;
443 static struct sk_buff *sfb_peek(struct Qdisc *sch)
445 struct sfb_sched_data *q = qdisc_priv(sch);
446 struct Qdisc *child = q->qdisc;
448 return child->ops->peek(child);
451 /* No sfb_drop -- impossible since the child doesn't return the dropped skb. */
453 static void sfb_reset(struct Qdisc *sch)
455 struct sfb_sched_data *q = qdisc_priv(sch);
457 qdisc_reset(q->qdisc);
458 sch->q.qlen = 0;
459 q->slot = 0;
460 q->double_buffering = false;
461 sfb_zero_all_buckets(q);
462 sfb_init_perturbation(0, q);
465 static void sfb_destroy(struct Qdisc *sch)
467 struct sfb_sched_data *q = qdisc_priv(sch);
469 tcf_destroy_chain(&q->filter_list);
470 qdisc_destroy(q->qdisc);
473 static const struct nla_policy sfb_policy[TCA_SFB_MAX + 1] = {
474 [TCA_SFB_PARMS] = { .len = sizeof(struct tc_sfb_qopt) },
477 static const struct tc_sfb_qopt sfb_default_ops = {
478 .rehash_interval = 600 * MSEC_PER_SEC,
479 .warmup_time = 60 * MSEC_PER_SEC,
480 .limit = 0,
481 .max = 25,
482 .bin_size = 20,
483 .increment = (SFB_MAX_PROB + 500) / 1000, /* 0.1 % */
484 .decrement = (SFB_MAX_PROB + 3000) / 6000,
485 .penalty_rate = 10,
486 .penalty_burst = 20,
489 static int sfb_change(struct Qdisc *sch, struct nlattr *opt)
491 struct sfb_sched_data *q = qdisc_priv(sch);
492 struct Qdisc *child;
493 struct nlattr *tb[TCA_SFB_MAX + 1];
494 const struct tc_sfb_qopt *ctl = &sfb_default_ops;
495 u32 limit;
496 int err;
498 if (opt) {
499 err = nla_parse_nested(tb, TCA_SFB_MAX, opt, sfb_policy);
500 if (err < 0)
501 return -EINVAL;
503 if (tb[TCA_SFB_PARMS] == NULL)
504 return -EINVAL;
506 ctl = nla_data(tb[TCA_SFB_PARMS]);
509 limit = ctl->limit;
510 if (limit == 0)
511 limit = max_t(u32, qdisc_dev(sch)->tx_queue_len, 1);
513 child = fifo_create_dflt(sch, &pfifo_qdisc_ops, limit);
514 if (IS_ERR(child))
515 return PTR_ERR(child);
517 sch_tree_lock(sch);
519 qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen);
520 qdisc_destroy(q->qdisc);
521 q->qdisc = child;
523 q->rehash_interval = msecs_to_jiffies(ctl->rehash_interval);
524 q->warmup_time = msecs_to_jiffies(ctl->warmup_time);
525 q->rehash_time = jiffies;
526 q->limit = limit;
527 q->increment = ctl->increment;
528 q->decrement = ctl->decrement;
529 q->max = ctl->max;
530 q->bin_size = ctl->bin_size;
531 q->penalty_rate = ctl->penalty_rate;
532 q->penalty_burst = ctl->penalty_burst;
533 q->tokens_avail = ctl->penalty_burst;
534 q->token_time = jiffies;
536 q->slot = 0;
537 q->double_buffering = false;
538 sfb_zero_all_buckets(q);
539 sfb_init_perturbation(0, q);
540 sfb_init_perturbation(1, q);
542 sch_tree_unlock(sch);
544 return 0;
547 static int sfb_init(struct Qdisc *sch, struct nlattr *opt)
549 struct sfb_sched_data *q = qdisc_priv(sch);
551 q->qdisc = &noop_qdisc;
552 return sfb_change(sch, opt);
555 static int sfb_dump(struct Qdisc *sch, struct sk_buff *skb)
557 struct sfb_sched_data *q = qdisc_priv(sch);
558 struct nlattr *opts;
559 struct tc_sfb_qopt opt = {
560 .rehash_interval = jiffies_to_msecs(q->rehash_interval),
561 .warmup_time = jiffies_to_msecs(q->warmup_time),
562 .limit = q->limit,
563 .max = q->max,
564 .bin_size = q->bin_size,
565 .increment = q->increment,
566 .decrement = q->decrement,
567 .penalty_rate = q->penalty_rate,
568 .penalty_burst = q->penalty_burst,
571 sch->qstats.backlog = q->qdisc->qstats.backlog;
572 opts = nla_nest_start(skb, TCA_OPTIONS);
573 if (opts == NULL)
574 goto nla_put_failure;
575 NLA_PUT(skb, TCA_SFB_PARMS, sizeof(opt), &opt);
576 return nla_nest_end(skb, opts);
578 nla_put_failure:
579 nla_nest_cancel(skb, opts);
580 return -EMSGSIZE;
583 static int sfb_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
585 struct sfb_sched_data *q = qdisc_priv(sch);
586 struct tc_sfb_xstats st = {
587 .earlydrop = q->stats.earlydrop,
588 .penaltydrop = q->stats.penaltydrop,
589 .bucketdrop = q->stats.bucketdrop,
590 .queuedrop = q->stats.queuedrop,
591 .childdrop = q->stats.childdrop,
592 .marked = q->stats.marked,
595 st.maxqlen = sfb_compute_qlen(&st.maxprob, &st.avgprob, q);
597 return gnet_stats_copy_app(d, &st, sizeof(st));
600 static int sfb_dump_class(struct Qdisc *sch, unsigned long cl,
601 struct sk_buff *skb, struct tcmsg *tcm)
603 return -ENOSYS;
606 static int sfb_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
607 struct Qdisc **old)
609 struct sfb_sched_data *q = qdisc_priv(sch);
611 if (new == NULL)
612 new = &noop_qdisc;
614 sch_tree_lock(sch);
615 *old = q->qdisc;
616 q->qdisc = new;
617 qdisc_tree_decrease_qlen(*old, (*old)->q.qlen);
618 qdisc_reset(*old);
619 sch_tree_unlock(sch);
620 return 0;
623 static struct Qdisc *sfb_leaf(struct Qdisc *sch, unsigned long arg)
625 struct sfb_sched_data *q = qdisc_priv(sch);
627 return q->qdisc;
630 static unsigned long sfb_get(struct Qdisc *sch, u32 classid)
632 return 1;
635 static void sfb_put(struct Qdisc *sch, unsigned long arg)
639 static int sfb_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
640 struct nlattr **tca, unsigned long *arg)
642 return -ENOSYS;
645 static int sfb_delete(struct Qdisc *sch, unsigned long cl)
647 return -ENOSYS;
650 static void sfb_walk(struct Qdisc *sch, struct qdisc_walker *walker)
652 if (!walker->stop) {
653 if (walker->count >= walker->skip)
654 if (walker->fn(sch, 1, walker) < 0) {
655 walker->stop = 1;
656 return;
658 walker->count++;
662 static struct tcf_proto **sfb_find_tcf(struct Qdisc *sch, unsigned long cl)
664 struct sfb_sched_data *q = qdisc_priv(sch);
666 if (cl)
667 return NULL;
668 return &q->filter_list;
671 static unsigned long sfb_bind(struct Qdisc *sch, unsigned long parent,
672 u32 classid)
674 return 0;
678 static const struct Qdisc_class_ops sfb_class_ops = {
679 .graft = sfb_graft,
680 .leaf = sfb_leaf,
681 .get = sfb_get,
682 .put = sfb_put,
683 .change = sfb_change_class,
684 .delete = sfb_delete,
685 .walk = sfb_walk,
686 .tcf_chain = sfb_find_tcf,
687 .bind_tcf = sfb_bind,
688 .unbind_tcf = sfb_put,
689 .dump = sfb_dump_class,
692 static struct Qdisc_ops sfb_qdisc_ops __read_mostly = {
693 .id = "sfb",
694 .priv_size = sizeof(struct sfb_sched_data),
695 .cl_ops = &sfb_class_ops,
696 .enqueue = sfb_enqueue,
697 .dequeue = sfb_dequeue,
698 .peek = sfb_peek,
699 .init = sfb_init,
700 .reset = sfb_reset,
701 .destroy = sfb_destroy,
702 .change = sfb_change,
703 .dump = sfb_dump,
704 .dump_stats = sfb_dump_stats,
705 .owner = THIS_MODULE,
708 static int __init sfb_module_init(void)
710 return register_qdisc(&sfb_qdisc_ops);
713 static void __exit sfb_module_exit(void)
715 unregister_qdisc(&sfb_qdisc_ops);
718 module_init(sfb_module_init)
719 module_exit(sfb_module_exit)
721 MODULE_DESCRIPTION("Stochastic Fair Blue queue discipline");
722 MODULE_AUTHOR("Juliusz Chroboczek");
723 MODULE_AUTHOR("Eric Dumazet");
724 MODULE_LICENSE("GPL");