/*      $NetBSD: altq_red.c,v 1.36 2025/01/08 13:00:04 joe Exp $        */
/*      $KAME: altq_red.c,v 1.20 2005/04/13 03:44:25 suz Exp $  */

/*
* Copyright (C) 1997-2003
*      Sony Computer Science Laboratories Inc.  All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY SONY CSL AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL SONY CSL OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
*/
/*
* Copyright (c) 1990-1994 Regents of the University of California.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
*    must display the following acknowledgement:
*      This product includes software developed by the Computer Systems
*      Engineering Group at Lawrence Berkeley Laboratory.
* 4. Neither the name of the University nor of the Laboratory may be used
*    to endorse or promote products derived from this software without
*    specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: altq_red.c,v 1.36 2025/01/08 13:00:04 joe Exp $");

#ifdef _KERNEL_OPT
#include "opt_altq.h"
#include "opt_inet.h"
#include "pf.h"
#endif

#ifdef ALTQ_RED /* red is enabled by ALTQ_RED option in opt_altq.h */

#include <sys/param.h>
#include <sys/malloc.h>
#include <sys/mbuf.h>
#include <sys/socket.h>
#include <sys/systm.h>
#include <sys/errno.h>
#include <sys/kauth.h>
#if 1 /* ALTQ3_COMPAT */
#include <sys/sockio.h>
#include <sys/proc.h>
#include <sys/kernel.h>
#ifdef ALTQ_FLOWVALVE
#include <sys/queue.h>
#include <sys/time.h>
#endif
#endif /* ALTQ3_COMPAT */
#include <sys/cprng.h>

#include <net/if.h>

#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#ifdef INET6
#include <netinet/ip6.h>
#endif

#if NPF > 0
#include <net/pfvar.h>
#endif
#include <altq/altq.h>
#include <altq/altq_red.h>
#ifdef ALTQ3_COMPAT
#include <altq/altq_conf.h>
#ifdef ALTQ_FLOWVALVE
#include <altq/altq_flowvalve.h>
#endif
#endif

/*
* ALTQ/RED (Random Early Detection) implementation using 32-bit
* fixed-point calculation.
*
* written by kjc using the ns code as a reference.
* you can learn more about red and ns from Sally's home page at
* http://www-nrg.ee.lbl.gov/floyd/
*
* most of the red parameter values are fixed in this implementation
* to prevent fixed-point overflow/underflow.
* if you change the parameters, watch out for overflow/underflow!
*
* the parameters used are recommended values by Sally.
* the corresponding ns config looks:
*      q_weight=0.00195
*      minthresh=5 maxthresh=15 queue-size=60
*      linterm=30
*      dropmech=drop-tail
*      bytes=false (can't be handled by 32-bit fixed-point)
*      doubleq=false dqthresh=false
*      wait=true
*/
/*
* alternative red parameters for a slow link.
*
* assume the queue length becomes from zero to L and keeps L, it takes
* N packets for q_avg to reach 63% of L.
* when q_weight is 0.002, N is about 500 packets.
* for a slow link like dial-up, 500 packets takes more than 1 minute!
* when q_weight is 0.008, N is about 127 packets.
* when q_weight is 0.016, N is about 63 packets.
* bursts of 50 packets are allowed for 0.002, bursts of 25 packets
* are allowed for 0.016.
* see Sally's paper for more details.
*/
/* normal red parameters */
#define W_WEIGHT        512     /* inverse of weight of EWMA (511/512) */
                               /* q_weight = 0.00195 */

/* red parameters for a slow link */
#define W_WEIGHT_1      128     /* inverse of weight of EWMA (127/128) */
                               /* q_weight = 0.0078125 */

/* red parameters for a very slow link (e.g., dialup) */
#define W_WEIGHT_2      64      /* inverse of weight of EWMA (63/64) */
                               /* q_weight = 0.015625 */

/* fixed-point uses 12-bit decimal places */
#define FP_SHIFT        12      /* fixed-point shift */

/* red parameters for drop probability */
#define INV_P_MAX       10      /* inverse of max drop probability */
#define TH_MIN          5       /* min threshold */
#define TH_MAX          15      /* max threshold */

#define RED_LIMIT       60      /* default max queue length */
#define RED_STATS               /* collect statistics */

/*
* our default policy for forced-drop is drop-tail.
* (in altq-1.1.2 or earlier, the default was random-drop.
* but it makes more sense to punish the cause of the surge.)
* to switch to the random-drop policy, define "RED_RANDOM_DROP".
*/

#ifdef ALTQ3_COMPAT
#ifdef ALTQ_FLOWVALVE
/*
* flow-valve is an extension to protect red from unresponsive flows
* and to promote end-to-end congestion control.
* flow-valve observes the average drop rates of the flows that have
* experienced packet drops in the recent past.
* when the average drop rate exceeds the threshold, the flow is
* blocked by the flow-valve.  the trapped flow should back off
* exponentially to escape from the flow-valve.
*/
#ifdef RED_RANDOM_DROP
#error "random-drop can't be used with flow-valve!"
#endif
#endif /* ALTQ_FLOWVALVE */

/* red_list keeps all red_queue_t's allocated. */
static red_queue_t *red_list = NULL;

#endif /* ALTQ3_COMPAT */

/* default red parameter values */
static int default_th_min = TH_MIN;
static int default_th_max = TH_MAX;
static int default_inv_pmax = INV_P_MAX;

#ifdef ALTQ3_COMPAT
/* internal function prototypes */
static int red_enqueue(struct ifaltq *, struct mbuf *);
static struct mbuf *red_dequeue(struct ifaltq *, int);
static int red_request(struct ifaltq *, int, void *);
static void red_purgeq(red_queue_t *);
static int red_detach(red_queue_t *);
#ifdef ALTQ_FLOWVALVE
static inline struct fve *flowlist_lookup(struct flowvalve *,
                        struct altq_pktattr *, struct timeval *);
static inline struct fve *flowlist_reclaim(struct flowvalve *,
                                            struct altq_pktattr *);
static inline void flowlist_move_to_head(struct flowvalve *, struct fve *);
static inline int fv_p2f(struct flowvalve *, int);
static struct flowvalve *fv_alloc(struct red *);
static void fv_destroy(struct flowvalve *);
static int fv_checkflow(struct flowvalve *, struct altq_pktattr *,
                       struct fve **);
static void fv_dropbyred(struct flowvalve *fv, struct altq_pktattr *,
                        struct fve *);
#endif
#endif /* ALTQ3_COMPAT */

/*
* red support routines
*/
red_t *
red_alloc(int weight, int inv_pmax, int th_min, int th_max, int flags,
  int pkttime)
{
       red_t   *rp;
       int      w, i;
       int      npkts_per_sec;

       rp = malloc(sizeof(red_t), M_DEVBUF, M_WAITOK|M_ZERO);
       if (rp == NULL)
               return NULL;

       rp->red_avg = 0;
       rp->red_idle = 1;

       if (weight == 0)
               rp->red_weight = W_WEIGHT;
       else
               rp->red_weight = weight;
       if (inv_pmax == 0)
               rp->red_inv_pmax = default_inv_pmax;
       else
               rp->red_inv_pmax = inv_pmax;
       if (th_min == 0)
               rp->red_thmin = default_th_min;
       else
               rp->red_thmin = th_min;
       if (th_max == 0)
               rp->red_thmax = default_th_max;
       else
               rp->red_thmax = th_max;

       rp->red_flags = flags;

       if (pkttime == 0)
               /* default packet time: 1000 bytes / 10Mbps * 8 * 1000000 */
               rp->red_pkttime = 800;
       else
               rp->red_pkttime = pkttime;

       if (weight == 0) {
               /* when the link is very slow, adjust red parameters */
               npkts_per_sec = 1000000 / rp->red_pkttime;
               if (npkts_per_sec < 50) {
                       /* up to about 400Kbps */
                       rp->red_weight = W_WEIGHT_2;
               } else if (npkts_per_sec < 300) {
                       /* up to about 2.4Mbps */
                       rp->red_weight = W_WEIGHT_1;
               }
       }

       /* calculate wshift.  weight must be power of 2 */
       w = rp->red_weight;
       for (i = 0; w > 1; i++)
               w = w >> 1;
       rp->red_wshift = i;
       w = 1 << rp->red_wshift;
       if (w != rp->red_weight) {
               printf("invalid weight value %d for red! use %d\n",
                      rp->red_weight, w);
               rp->red_weight = w;
       }

       /*
        * thmin_s and thmax_s are scaled versions of th_min and th_max
        * to be compared with avg.
        */
       rp->red_thmin_s = rp->red_thmin << (rp->red_wshift + FP_SHIFT);
       rp->red_thmax_s = rp->red_thmax << (rp->red_wshift + FP_SHIFT);

       /*
        * precompute probability denominator
        *  probd = (2 * (TH_MAX-TH_MIN) / pmax) in fixed-point
        */
       rp->red_probd = (2 * (rp->red_thmax - rp->red_thmin)
                        * rp->red_inv_pmax) << FP_SHIFT;

       /* allocate weight table */
       rp->red_wtab = wtab_alloc(rp->red_weight);

       microtime(&rp->red_last);
#ifdef ALTQ3_COMPAT
#ifdef ALTQ_FLOWVALVE
       if (flags & REDF_FLOWVALVE)
               rp->red_flowvalve = fv_alloc(rp);
       /* if fv_alloc fails, flowvalve is just disabled */
#endif
#endif /* ALTQ3_COMPAT */
       return rp;
}

void
red_destroy(red_t *rp)
{
#ifdef ALTQ3_COMPAT
#ifdef ALTQ_FLOWVALVE
       if (rp->red_flowvalve != NULL)
               fv_destroy(rp->red_flowvalve);
#endif
#endif /* ALTQ3_COMPAT */
       wtab_destroy(rp->red_wtab);
       free(rp, M_DEVBUF);
}

void
red_getstats(red_t *rp, struct redstats *sp)
{
       sp->q_avg               = rp->red_avg >> rp->red_wshift;
       sp->xmit_cnt            = rp->red_stats.xmit_cnt;
       sp->drop_cnt            = rp->red_stats.drop_cnt;
       sp->drop_forced         = rp->red_stats.drop_forced;
       sp->drop_unforced       = rp->red_stats.drop_unforced;
       sp->marked_packets      = rp->red_stats.marked_packets;
}

int
red_addq(red_t *rp, class_queue_t *q, struct mbuf *m,
   struct altq_pktattr *pktattr)
{
       int avg, droptype;
       int n;
#ifdef ALTQ3_COMPAT
#ifdef ALTQ_FLOWVALVE
       struct fve *fve = NULL;

       if (rp->red_flowvalve != NULL && rp->red_flowvalve->fv_flows > 0)
               if (fv_checkflow(rp->red_flowvalve, pktattr, &fve)) {
                       m_freem(m);
                       return -1;
               }
#endif
#endif /* ALTQ3_COMPAT */

       avg = rp->red_avg;

       /*
        * if we were idle, we pretend that n packets arrived during
        * the idle period.
        */
       if (rp->red_idle) {
               struct timeval now;
               int t;

               rp->red_idle = 0;
               microtime(&now);
               t = (now.tv_sec - rp->red_last.tv_sec);
               if (t > 60) {
                       /*
                        * being idle for more than 1 minute, set avg to zero.
                        * this prevents t from overflow.
                        */
                       avg = 0;
               } else {
                       t = t * 1000000 + (now.tv_usec - rp->red_last.tv_usec);
                       n = t / rp->red_pkttime - 1;

                       /* the following line does (avg = (1 - Wq)^n * avg) */
                       if (n > 0)
                               avg = (avg >> FP_SHIFT) *
                                   pow_w(rp->red_wtab, n);
               }
       }

       /* run estimator. (note: avg is scaled by WEIGHT in fixed-point) */
       avg += (qlen(q) << FP_SHIFT) - (avg >> rp->red_wshift);
       rp->red_avg = avg;              /* save the new value */

       /*
        * red_count keeps a tally of arriving traffic that has not
        * been dropped.
        */
       rp->red_count++;

       /* see if we drop early */
       droptype = DTYPE_NODROP;
       if (avg >= rp->red_thmin_s && qlen(q) > 1) {
               if (avg >= rp->red_thmax_s) {
                       /* avg >= th_max: forced drop */
                       droptype = DTYPE_FORCED;
               } else if (rp->red_old == 0) {
                       /* first exceeds th_min */
                       rp->red_count = 1;
                       rp->red_old = 1;
               } else if (drop_early((avg - rp->red_thmin_s) >> rp->red_wshift,
                                     rp->red_probd, rp->red_count)) {
                       /* mark or drop by red */
                       if ((rp->red_flags & REDF_ECN) &&
                           mark_ecn(m, pktattr, rp->red_flags)) {
                               /* successfully marked.  do not drop. */
                               rp->red_count = 0;
#ifdef RED_STATS
                               rp->red_stats.marked_packets++;
#endif
                       } else {
                               /* unforced drop by red */
                               droptype = DTYPE_EARLY;
                       }
               }
       } else {
               /* avg < th_min */
               rp->red_old = 0;
       }

       /*
        * if the queue length hits the hard limit, it's a forced drop.
        */
       if (droptype == DTYPE_NODROP && qlen(q) >= qlimit(q))
               droptype = DTYPE_FORCED;

#ifdef RED_RANDOM_DROP
       /* if successful or forced drop, enqueue this packet. */
       if (droptype != DTYPE_EARLY)
               _addq(q, m);
#else
       /* if successful, enqueue this packet. */
       if (droptype == DTYPE_NODROP)
               _addq(q, m);
#endif
       if (droptype != DTYPE_NODROP) {
               if (droptype == DTYPE_EARLY) {
                       /* drop the incoming packet */
#ifdef RED_STATS
                       rp->red_stats.drop_unforced++;
#endif
               } else {
                       /* forced drop, select a victim packet in the queue. */
#ifdef RED_RANDOM_DROP
                       m = _getq_random(q);
#endif
#ifdef RED_STATS
                       rp->red_stats.drop_forced++;
#endif
               }
#ifdef RED_STATS
               PKTCNTR_ADD(&rp->red_stats.drop_cnt, m_pktlen(m));
#endif
               rp->red_count = 0;
#ifdef ALTQ3_COMPAT
#ifdef ALTQ_FLOWVALVE
               if (rp->red_flowvalve != NULL)
                       fv_dropbyred(rp->red_flowvalve, pktattr, fve);
#endif
#endif /* ALTQ3_COMPAT */
               m_freem(m);
               return -1;
       }
       /* successfully queued */
#ifdef RED_STATS
       PKTCNTR_ADD(&rp->red_stats.xmit_cnt, m_pktlen(m));
#endif
       return 0;
}

/*
* early-drop probability is calculated as follows:
*   prob = p_max * (avg - th_min) / (th_max - th_min)
*   prob_a = prob / (2 - count*prob)
*          = (avg-th_min) / (2*(th_max-th_min)*inv_p_max - count*(avg-th_min))
* here prob_a increases as successive undrop count increases.
* (prob_a starts from prob/2, becomes prob when (count == (1 / prob)),
* becomes 1 when (count >= (2 / prob))).
*/
int
drop_early(int fp_len, int fp_probd, int count)
{
       int     d;              /* denominator of drop-probability */

       d = fp_probd - count * fp_len;
       if (d <= 0)
               /* count exceeds the hard limit: drop or mark */
               return 1;

       /*
        * now the range of d is [1..600] in fixed-point. (when
        * th_max-th_min=10 and p_max=1/30)
        * drop probability = (avg - TH_MIN) / d
        */

       if ((cprng_fast32() % d) < fp_len) {
               /* drop or mark */
               return 1;
       }
       /* no drop/mark */
       return 0;
}

/*
* try to mark CE bit to the packet.
*    returns 1 if successfully marked, 0 otherwise.
*/
int
mark_ecn(struct mbuf *m, struct altq_pktattr *pktattr, int flags)
{
       struct mbuf     *m0;
       struct m_tag    *t;
       struct altq_tag *at;
       void            *hdr;
       int              af;

       t = m_tag_find(m, PACKET_TAG_ALTQ_QID);
       if (t != NULL) {
               at = (struct altq_tag *)(t + 1);
               if (at == NULL)
                       return 0;
               af = at->af;
               hdr = at->hdr;
#ifdef ALTQ3_COMPAT
       } else if (pktattr != NULL) {
               af = pktattr->pattr_af;
               hdr = pktattr->pattr_hdr;
#endif /* ALTQ3_COMPAT */
       } else
               return 0;

       if (af != AF_INET && af != AF_INET6)
               return 0;

       /* verify that pattr_hdr is within the mbuf data */
       for (m0 = m; m0 != NULL; m0 = m0->m_next)
               if (((char *)hdr >= m0->m_data) &&
                   ((char *)hdr < m0->m_data + m0->m_len))
                       break;
       if (m0 == NULL) {
               /* ick, tag info is stale */
               return 0;
       }

       switch (af) {
       case AF_INET:
               if (flags & REDF_ECN4) {
                       struct ip *ip = hdr;
                       u_int8_t otos;
                       int sum;

                       if (ip->ip_v != 4)
                               return 0;       /* version mismatch! */

                       if ((ip->ip_tos & IPTOS_ECN_MASK) == IPTOS_ECN_NOTECT)
                               return 0;       /* not-ECT */
                       if ((ip->ip_tos & IPTOS_ECN_MASK) == IPTOS_ECN_CE)
                               return 1;       /* already marked */

                       /*
                        * ecn-capable but not marked,
                        * mark CE and update checksum
                        */
                       otos = ip->ip_tos;
                       ip->ip_tos |= IPTOS_ECN_CE;
                       /*
                        * update checksum (from RFC1624)
                        *         HC' = ~(~HC + ~m + m')
                        */
                       sum = ~ntohs(ip->ip_sum) & 0xffff;
                       sum += (~otos & 0xffff) + ip->ip_tos;
                       sum = (sum >> 16) + (sum & 0xffff);
                       sum += (sum >> 16);  /* add carry */
                       ip->ip_sum = htons(~sum & 0xffff);
                       return 1;
               }
               break;
#ifdef INET6
       case AF_INET6:
               if (flags & REDF_ECN6) {
                       struct ip6_hdr *ip6 = hdr;
                       u_int32_t flowlabel;

                       flowlabel = ntohl(ip6->ip6_flow);
                       if ((flowlabel >> 28) != 6)
                               return 0;       /* version mismatch! */
                       if ((flowlabel & (IPTOS_ECN_MASK << 20)) ==
                           (IPTOS_ECN_NOTECT << 20))
                               return 0;       /* not-ECT */
                       if ((flowlabel & (IPTOS_ECN_MASK << 20)) ==
                           (IPTOS_ECN_CE << 20))
                               return 1;       /* already marked */
                       /*
                        * ecn-capable but not marked,  mark CE
                        */
                       flowlabel |= (IPTOS_ECN_CE << 20);
                       ip6->ip6_flow = htonl(flowlabel);
                       return 1;
               }
               break;
#endif  /* INET6 */
       }

       /* not marked */
       return 0;
}

struct mbuf *
red_getq(red_t *rp, class_queue_t *q)
{
       struct mbuf *m;

       if ((m = _getq(q)) == NULL) {
               if (rp->red_idle == 0) {
                       rp->red_idle = 1;
                       microtime(&rp->red_last);
               }
               return NULL;
       }

       rp->red_idle = 0;
       return m;
}

/*
* helper routine to calibrate avg during idle.
* pow_w(wtab, n) returns (1 - Wq)^n in fixed-point
* here Wq = 1/weight and the code assumes Wq is close to zero.
*
* w_tab[n] holds ((1 - Wq)^(2^n)) in fixed-point.
*/
static struct wtab *wtab_list = NULL;   /* pointer to wtab list */

struct wtab *
wtab_alloc(int weight)
{
       struct wtab     *w;
       int              i;

       for (w = wtab_list; w != NULL; w = w->w_next)
               if (w->w_weight == weight) {
                       w->w_refcount++;
                       return w;
               }

       w = malloc(sizeof(struct wtab), M_DEVBUF, M_WAITOK|M_ZERO);
       if (w == NULL)
               panic("wtab_alloc: malloc failed!");
       w->w_weight = weight;
       w->w_refcount = 1;
       w->w_next = wtab_list;
       wtab_list = w;

       /* initialize the weight table */
       w->w_tab[0] = ((weight - 1) << FP_SHIFT) / weight;
       for (i = 1; i < 32; i++) {
               w->w_tab[i] = (w->w_tab[i-1] * w->w_tab[i-1]) >> FP_SHIFT;
               if (w->w_tab[i] == 0 && w->w_param_max == 0)
                       w->w_param_max = 1 << i;
       }

       return w;
}

int
wtab_destroy(struct wtab *w)
{
       struct wtab     *prev;

       if (--w->w_refcount > 0)
               return 0;

       if (wtab_list == w)
               wtab_list = w->w_next;
       else for (prev = wtab_list; prev->w_next != NULL; prev = prev->w_next)
               if (prev->w_next == w) {
                       prev->w_next = w->w_next;
                       break;
               }

       free(w, M_DEVBUF);
       return 0;
}

int32_t
pow_w(struct wtab *w, int n)
{
       int     i, bit;
       int32_t val;

       if (n >= w->w_param_max)
               return 0;

       val = 1 << FP_SHIFT;
       if (n <= 0)
               return val;

       bit = 1;
       i = 0;
       while (n) {
               if (n & bit) {
                       val = (val * w->w_tab[i]) >> FP_SHIFT;
                       n &= ~bit;
               }
               i++;
               bit <<=  1;
       }
       return val;
}

#ifdef ALTQ3_COMPAT
/*
* red device interface
*/
altqdev_decl(red);

int
redopen(dev_t dev, int flag, int fmt,
   struct lwp *l)
{
       /* everything will be done when the queueing scheme is attached. */
       return 0;
}

int
redclose(dev_t dev, int flag, int fmt,
   struct lwp *l)
{
       red_queue_t *rqp;
       int err, error = 0;

       while ((rqp = red_list) != NULL) {
               /* destroy all */
               err = red_detach(rqp);
               if (err != 0 && error == 0)
                       error = err;
       }

       return error;
}

int
redioctl(dev_t dev, ioctlcmd_t cmd, void *addr, int flag,
   struct lwp *l)
{
       red_queue_t *rqp;
       struct red_interface *ifacep;
       struct ifnet *ifp;
       int     error = 0;

       /* check super-user privilege */
       switch (cmd) {
       case RED_GETSTATS:
               break;
       default:
               if ((error = kauth_authorize_network(l->l_cred,
                   KAUTH_NETWORK_ALTQ, KAUTH_REQ_NETWORK_ALTQ_RED, NULL,
                   NULL, NULL)) != 0)
                       return error;
               break;
       }

       switch (cmd) {

       case RED_ENABLE:
               ifacep = (struct red_interface *)addr;
               if ((rqp = altq_lookup(ifacep->red_ifname, ALTQT_RED)) == NULL) {
                       error = EBADF;
                       break;
               }
               error = altq_enable(rqp->rq_ifq);
               break;

       case RED_DISABLE:
               ifacep = (struct red_interface *)addr;
               if ((rqp = altq_lookup(ifacep->red_ifname, ALTQT_RED)) == NULL) {
                       error = EBADF;
                       break;
               }
               error = altq_disable(rqp->rq_ifq);
               break;

       case RED_IF_ATTACH:
               ifp = ifunit(((struct red_interface *)addr)->red_ifname);
               if (ifp == NULL) {
                       error = ENXIO;
                       break;
               }

               /* allocate and initialize red_queue_t */
               rqp = malloc(sizeof(red_queue_t), M_DEVBUF, M_WAITOK|M_ZERO);
               if (rqp == NULL) {
                       error = ENOMEM;
                       break;
               }

               rqp->rq_q = malloc(sizeof(class_queue_t), M_DEVBUF,
                   M_WAITOK|M_ZERO);
               if (rqp->rq_q == NULL) {
                       free(rqp, M_DEVBUF);
                       error = ENOMEM;
                       break;
               }

               rqp->rq_red = red_alloc(0, 0, 0, 0, 0, 0);
               if (rqp->rq_red == NULL) {
                       free(rqp->rq_q, M_DEVBUF);
                       free(rqp, M_DEVBUF);
                       error = ENOMEM;
                       break;
               }

               rqp->rq_ifq = &ifp->if_snd;
               qtail(rqp->rq_q) = NULL;
               qlen(rqp->rq_q) = 0;
               qlimit(rqp->rq_q) = RED_LIMIT;
               qtype(rqp->rq_q) = Q_RED;

               /*
                * set RED to this ifnet structure.
                */
               error = altq_attach(rqp->rq_ifq, ALTQT_RED, rqp,
                                   red_enqueue, red_dequeue, red_request,
                                   NULL, NULL);
               if (error) {
                       red_destroy(rqp->rq_red);
                       free(rqp->rq_q, M_DEVBUF);
                       free(rqp, M_DEVBUF);
                       break;
               }

               /* add this state to the red list */
               rqp->rq_next = red_list;
               red_list = rqp;
               break;

       case RED_IF_DETACH:
               ifacep = (struct red_interface *)addr;
               if ((rqp = altq_lookup(ifacep->red_ifname, ALTQT_RED)) == NULL) {
                       error = EBADF;
                       break;
               }
               error = red_detach(rqp);
               break;

       case RED_GETSTATS:
               do {
                       struct red_stats *q_stats;
                       red_t *rp;

                       q_stats = (struct red_stats *)addr;
                       if ((rqp = altq_lookup(q_stats->iface.red_ifname,
                                            ALTQT_RED)) == NULL) {
                               error = EBADF;
                               break;
                       }

                       q_stats->q_len     = qlen(rqp->rq_q);
                       q_stats->q_limit   = qlimit(rqp->rq_q);

                       rp = rqp->rq_red;
                       q_stats->q_avg     = rp->red_avg >> rp->red_wshift;
                       q_stats->xmit_cnt  = rp->red_stats.xmit_cnt;
                       q_stats->drop_cnt  = rp->red_stats.drop_cnt;
                       q_stats->drop_forced   = rp->red_stats.drop_forced;
                       q_stats->drop_unforced = rp->red_stats.drop_unforced;
                       q_stats->marked_packets = rp->red_stats.marked_packets;

                       q_stats->weight         = rp->red_weight;
                       q_stats->inv_pmax       = rp->red_inv_pmax;
                       q_stats->th_min         = rp->red_thmin;
                       q_stats->th_max         = rp->red_thmax;

#ifdef ALTQ_FLOWVALVE
                       if (rp->red_flowvalve != NULL) {
                               struct flowvalve *fv = rp->red_flowvalve;
                               q_stats->fv_flows    = fv->fv_flows;
                               q_stats->fv_pass     = fv->fv_stats.pass;
                               q_stats->fv_predrop  = fv->fv_stats.predrop;
                               q_stats->fv_alloc    = fv->fv_stats.alloc;
                               q_stats->fv_escape   = fv->fv_stats.escape;
                       } else {
#endif /* ALTQ_FLOWVALVE */
                               q_stats->fv_flows    = 0;
                               q_stats->fv_pass     = 0;
                               q_stats->fv_predrop  = 0;
                               q_stats->fv_alloc    = 0;
                               q_stats->fv_escape   = 0;
#ifdef ALTQ_FLOWVALVE
                       }
#endif /* ALTQ_FLOWVALVE */
               } while (/*CONSTCOND*/ 0);
               break;

       case RED_CONFIG:
               do {
                       struct red_conf *fc;
                       red_t *new;
                       int s, limit;

                       fc = (struct red_conf *)addr;
                       if ((rqp = altq_lookup(fc->iface.red_ifname,
                                              ALTQT_RED)) == NULL) {
                               error = EBADF;
                               break;
                       }
                       new = red_alloc(fc->red_weight,
                                       fc->red_inv_pmax,
                                       fc->red_thmin,
                                       fc->red_thmax,
                                       fc->red_flags,
                                       fc->red_pkttime);
                       if (new == NULL) {
                               error = ENOMEM;
                               break;
                       }

                       s = splnet();
                       red_purgeq(rqp);
                       limit = fc->red_limit;
                       if (limit < fc->red_thmax)
                               limit = fc->red_thmax;
                       qlimit(rqp->rq_q) = limit;
                       fc->red_limit = limit;  /* write back the new value */

                       red_destroy(rqp->rq_red);
                       rqp->rq_red = new;

                       splx(s);

                       /* write back new values */
                       fc->red_limit = limit;
                       fc->red_inv_pmax = rqp->rq_red->red_inv_pmax;
                       fc->red_thmin = rqp->rq_red->red_thmin;
                       fc->red_thmax = rqp->rq_red->red_thmax;

               } while (/*CONSTCOND*/ 0);
               break;

       case RED_SETDEFAULTS:
               do {
                       struct redparams *rp;

                       rp = (struct redparams *)addr;

                       default_th_min = rp->th_min;
                       default_th_max = rp->th_max;
                       default_inv_pmax = rp->inv_pmax;
               } while (/*CONSTCOND*/ 0);
               break;

       default:
               error = EINVAL;
               break;
       }
       return error;
}

static int
red_detach(red_queue_t *rqp)
{
       red_queue_t *tmp;
       int error = 0;

       if (ALTQ_IS_ENABLED(rqp->rq_ifq))
               altq_disable(rqp->rq_ifq);

       if ((error = altq_detach(rqp->rq_ifq)))
               return error;

       if (red_list == rqp)
               red_list = rqp->rq_next;
       else {
               for (tmp = red_list; tmp != NULL; tmp = tmp->rq_next)
                       if (tmp->rq_next == rqp) {
                               tmp->rq_next = rqp->rq_next;
                               break;
                       }
               if (tmp == NULL)
                       printf("red_detach: no state found in red_list!\n");
       }

       red_destroy(rqp->rq_red);
       free(rqp->rq_q, M_DEVBUF);
       free(rqp, M_DEVBUF);
       return error;
}

/*
* enqueue routine:
*
*      returns: 0 when successfully queued.
*               ENOBUFS when drop occurs.
*/
static int
red_enqueue(struct ifaltq *ifq, struct mbuf *m)
{
       struct altq_pktattr pktattr;
       red_queue_t *rqp = (red_queue_t *)ifq->altq_disc;

       pktattr.pattr_class = m->m_pkthdr.pattr_class;
       pktattr.pattr_af = m->m_pkthdr.pattr_af;
       pktattr.pattr_hdr = m->m_pkthdr.pattr_hdr;

       if (red_addq(rqp->rq_red, rqp->rq_q, m, &pktattr) < 0)
               return ENOBUFS;
       ifq->ifq_len++;
       return 0;
}

/*
* dequeue routine:
*      must be called in splnet.
*
*      returns: mbuf dequeued.
*               NULL when no packet is available in the queue.
*/

static struct mbuf *
red_dequeue(struct ifaltq *ifq, int op)
{
       red_queue_t *rqp = (red_queue_t *)ifq->altq_disc;
       struct mbuf *m;

       if (op == ALTDQ_POLL)
               return qhead(rqp->rq_q);

       /* op == ALTDQ_REMOVE */
       m =  red_getq(rqp->rq_red, rqp->rq_q);
       if (m != NULL)
               ifq->ifq_len--;
       return m;
}

static int
red_request(struct ifaltq *ifq, int req, void *arg)
{
       red_queue_t *rqp = (red_queue_t *)ifq->altq_disc;

       switch (req) {
       case ALTRQ_PURGE:
               red_purgeq(rqp);
               break;
       }
       return 0;
}

static void
red_purgeq(red_queue_t *rqp)
{
       _flushq(rqp->rq_q);
       if (ALTQ_IS_ENABLED(rqp->rq_ifq))
               rqp->rq_ifq->ifq_len = 0;
}

#ifdef ALTQ_FLOWVALVE

#define FV_PSHIFT       7       /* weight of average drop rate -- 1/128 */
#define FV_PSCALE(x)    ((x) << FV_PSHIFT)
#define FV_PUNSCALE(x)  ((x) >> FV_PSHIFT)
#define FV_FSHIFT       5       /* weight of average fraction -- 1/32 */
#define FV_FSCALE(x)    ((x) << FV_FSHIFT)
#define FV_FUNSCALE(x)  ((x) >> FV_FSHIFT)

#define FV_TIMER        (3 * hz)        /* timer value for garbage collector */
#define FV_FLOWLISTSIZE         64      /* how many flows in flowlist */

#define FV_N                    10      /* update fve_f every FV_N packets */

#define FV_BACKOFFTHRESH        1  /* backoff threshold interval in second */
#define FV_TTHRESH              3  /* time threshold to delete fve */
#define FV_ALPHA                5  /* extra packet count */

#define FV_STATS

#define FV_TIMESTAMP(tp)        getmicrotime(tp)

/*
* Brtt table: 127 entry table to convert drop rate (p) to
* the corresponding bandwidth fraction (f)
* the following equation is implemented to use scaled values,
* fve_p and fve_f, in the fixed point format.
*
*   Brtt(p) = 1 /(sqrt(4*p/3) + min(1,3*sqrt(p*6/8)) * p * (1+32 * p*p))
*   f = Brtt(p) / (max_th + alpha)
*/
#define BRTT_SIZE       128
#define BRTT_SHIFT      12
#define BRTT_MASK       0x0007f000
#define BRTT_PMAX       (1 << (FV_PSHIFT + FP_SHIFT))

const int brtt_tab[BRTT_SIZE] = {
       0, 1262010, 877019, 703694, 598706, 525854, 471107, 427728,
       392026, 361788, 335598, 312506, 291850, 273158, 256081, 240361,
       225800, 212247, 199585, 187788, 178388, 169544, 161207, 153333,
       145888, 138841, 132165, 125836, 119834, 114141, 108739, 103612,
       98747, 94129, 89746, 85585, 81637, 77889, 74333, 70957,
       67752, 64711, 61824, 59084, 56482, 54013, 51667, 49440,
       47325, 45315, 43406, 41591, 39866, 38227, 36667, 35184,
       33773, 32430, 31151, 29933, 28774, 27668, 26615, 25611,
       24653, 23740, 22868, 22035, 21240, 20481, 19755, 19062,
       18399, 17764, 17157, 16576, 16020, 15487, 14976, 14487,
       14017, 13567, 13136, 12721, 12323, 11941, 11574, 11222,
       10883, 10557, 10243, 9942, 9652, 9372, 9103, 8844,
       8594, 8354, 8122, 7898, 7682, 7474, 7273, 7079,
       6892, 6711, 6536, 6367, 6204, 6046, 5893, 5746,
       5603, 5464, 5330, 5201, 5075, 4954, 4836, 4722,
       4611, 4504, 4400, 4299, 4201, 4106, 4014, 3924
};

static inline struct fve *
flowlist_lookup(struct flowvalve *fv, struct altq_pktattr *pktattr,
   struct timeval *now)
{
       struct fve *fve;
       int flows;
       struct ip *ip;
#ifdef INET6
       struct ip6_hdr *ip6;
#endif
       struct timeval tthresh;

       if (pktattr == NULL)
               return NULL;

       tthresh.tv_sec = now->tv_sec - FV_TTHRESH;
       flows = 0;
       /*
        * search the flow list
        */
       switch (pktattr->pattr_af) {
       case AF_INET:
               ip = (struct ip *)pktattr->pattr_hdr;
               TAILQ_FOREACH(fve, &fv->fv_flowlist, fve_lru){
                       if (fve->fve_lastdrop.tv_sec == 0)
                               break;
                       if (fve->fve_lastdrop.tv_sec < tthresh.tv_sec) {
                               fve->fve_lastdrop.tv_sec = 0;
                               break;
                       }
                       if (fve->fve_flow.flow_af == AF_INET &&
                           fve->fve_flow.flow_ip.ip_src.s_addr ==
                           ip->ip_src.s_addr &&
                           fve->fve_flow.flow_ip.ip_dst.s_addr ==
                           ip->ip_dst.s_addr)
                               return fve;
                       flows++;
               }
               break;
#ifdef INET6
       case AF_INET6:
               ip6 = (struct ip6_hdr *)pktattr->pattr_hdr;
               TAILQ_FOREACH(fve, &fv->fv_flowlist, fve_lru){
                       if (fve->fve_lastdrop.tv_sec == 0)
                               break;
                       if (fve->fve_lastdrop.tv_sec < tthresh.tv_sec) {
                               fve->fve_lastdrop.tv_sec = 0;
                               break;
                       }
                       if (fve->fve_flow.flow_af == AF_INET6 &&
                           IN6_ARE_ADDR_EQUAL(&fve->fve_flow.flow_ip6.ip6_src,
                                              &ip6->ip6_src) &&
                           IN6_ARE_ADDR_EQUAL(&fve->fve_flow.flow_ip6.ip6_dst,
                                              &ip6->ip6_dst))
                               return fve;
                       flows++;
               }
               break;
#endif /* INET6 */

       default:
               /* unknown protocol.  no drop. */
               return NULL;
       }
       fv->fv_flows = flows;   /* save the number of active fve's */
       return NULL;
}

static inline struct fve *
flowlist_reclaim(struct flowvalve *fv, struct altq_pktattr *pktattr)
{
       struct fve *fve;
       struct ip *ip;
#ifdef INET6
       struct ip6_hdr *ip6;
#endif

       /*
        * get an entry from the tail of the LRU list.
        */
       fve = TAILQ_LAST(&fv->fv_flowlist, fv_flowhead);

       switch (pktattr->pattr_af) {
       case AF_INET:
               ip = (struct ip *)pktattr->pattr_hdr;
               fve->fve_flow.flow_af = AF_INET;
               fve->fve_flow.flow_ip.ip_src = ip->ip_src;
               fve->fve_flow.flow_ip.ip_dst = ip->ip_dst;
               break;
#ifdef INET6
       case AF_INET6:
               ip6 = (struct ip6_hdr *)pktattr->pattr_hdr;
               fve->fve_flow.flow_af = AF_INET6;
               fve->fve_flow.flow_ip6.ip6_src = ip6->ip6_src;
               fve->fve_flow.flow_ip6.ip6_dst = ip6->ip6_dst;
               break;
#endif
       }

       fve->fve_state = Green;
       fve->fve_p = 0.0;
       fve->fve_f = 0.0;
       fve->fve_ifseq = fv->fv_ifseq - 1;
       fve->fve_count = 0;

       fv->fv_flows++;
#ifdef FV_STATS
       fv->fv_stats.alloc++;
#endif
       return fve;
}

static inline void
flowlist_move_to_head(struct flowvalve *fv, struct fve *fve)
{
       if (TAILQ_FIRST(&fv->fv_flowlist) != fve) {
               TAILQ_REMOVE(&fv->fv_flowlist, fve, fve_lru);
               TAILQ_INSERT_HEAD(&fv->fv_flowlist, fve, fve_lru);
       }
}

/*
* allocate flowvalve structure
*/
static struct flowvalve *
fv_alloc(struct red *rp)
{
       struct flowvalve *fv;
       struct fve *fve;
       int i, num;

       num = FV_FLOWLISTSIZE;
       fv = malloc(sizeof(struct flowvalve), M_DEVBUF, M_WAITOK|M_ZERO);
       if (fv == NULL)
               return NULL;

       fv->fv_fves = malloc(sizeof(struct fve) * num, M_DEVBUF,
           M_WAITOK|M_ZERO);
       if (fv->fv_fves == NULL) {
               free(fv, M_DEVBUF);
               return NULL;
       }

       fv->fv_flows = 0;
       TAILQ_INIT(&fv->fv_flowlist);
       for (i = 0; i < num; i++) {
               fve = &fv->fv_fves[i];
               fve->fve_lastdrop.tv_sec = 0;
               TAILQ_INSERT_TAIL(&fv->fv_flowlist, fve, fve_lru);
       }

       /* initialize drop rate threshold in scaled fixed-point */
       fv->fv_pthresh = (FV_PSCALE(1) << FP_SHIFT) / rp->red_inv_pmax;

       /* initialize drop rate to fraction table */
       fv->fv_p2ftab = malloc(sizeof(int) * BRTT_SIZE, M_DEVBUF, M_WAITOK);
       if (fv->fv_p2ftab == NULL) {
               free(fv->fv_fves, M_DEVBUF);
               free(fv, M_DEVBUF);
               return NULL;
       }
       /*
        * create the p2f table.
        * (shift is used to keep the precision)
        */
       for (i = 1; i < BRTT_SIZE; i++) {
               int f;

               f = brtt_tab[i] << 8;
               fv->fv_p2ftab[i] = (f / (rp->red_thmax + FV_ALPHA)) >> 8;
       }

       return fv;
}

static void
fv_destroy(struct flowvalve *fv)
{
       free(fv->fv_p2ftab, M_DEVBUF);
       free(fv->fv_fves, M_DEVBUF);
       free(fv, M_DEVBUF);
}

static inline int
fv_p2f(struct flowvalve *fv, int p)
{
       int val, f;

       if (p >= BRTT_PMAX)
               f = fv->fv_p2ftab[BRTT_SIZE-1];
       else if ((val = (p & BRTT_MASK)))
               f = fv->fv_p2ftab[(val >> BRTT_SHIFT)];
       else
               f = fv->fv_p2ftab[1];
       return f;
}

/*
* check if an arriving packet should be pre-dropped.
* called from red_addq() when a packet arrives.
* returns 1 when the packet should be pre-dropped.
* should be called in splnet.
*/
static int
fv_checkflow(struct flowvalve *fv, struct altq_pktattr *pktattr,
   struct fve **fcache)
{
       struct fve *fve;
       struct timeval now;

       fv->fv_ifseq++;
       FV_TIMESTAMP(&now);

       if ((fve = flowlist_lookup(fv, pktattr, &now)) == NULL)
               /* no matching entry in the flowlist */
               return 0;

       *fcache = fve;

       /* update fraction f for every FV_N packets */
       if (++fve->fve_count == FV_N) {
               /*
                * f = Wf * N / (fv_ifseq - fve_ifseq) + (1 - Wf) * f
                */
               fve->fve_f =
                       (FV_N << FP_SHIFT) / (fv->fv_ifseq - fve->fve_ifseq)
                       + fve->fve_f - FV_FUNSCALE(fve->fve_f);
               fve->fve_ifseq = fv->fv_ifseq;
               fve->fve_count = 0;
       }

       /*
        * overpumping test
        */
       if (fve->fve_state == Green && fve->fve_p > fv->fv_pthresh) {
               int fthresh;

               /* calculate a threshold */
               fthresh = fv_p2f(fv, fve->fve_p);
               if (fve->fve_f > fthresh)
                       fve->fve_state = Red;
       }

       if (fve->fve_state == Red) {
               /*
                * backoff test
                */
               if (now.tv_sec - fve->fve_lastdrop.tv_sec > FV_BACKOFFTHRESH) {
                       /* no drop for at least FV_BACKOFFTHRESH sec */
                       fve->fve_p = 0;
                       fve->fve_state = Green;
#ifdef FV_STATS
                       fv->fv_stats.escape++;
#endif
               } else {
                       /* block this flow */
                       flowlist_move_to_head(fv, fve);
                       fve->fve_lastdrop = now;
#ifdef FV_STATS
                       fv->fv_stats.predrop++;
#endif
                       return 1;
               }
       }

       /*
        * p = (1 - Wp) * p
        */
       fve->fve_p -= FV_PUNSCALE(fve->fve_p);
       if (fve->fve_p < 0)
               fve->fve_p = 0;
#ifdef FV_STATS
       fv->fv_stats.pass++;
#endif
       return 0;
}

/*
* called from red_addq when a packet is dropped by red.
* should be called in splnet.
*/
static void
fv_dropbyred(struct flowvalve *fv, struct altq_pktattr *pktattr,
   struct fve *fcache)
{
       struct fve *fve;
       struct timeval now;

       if (pktattr == NULL)
               return;
       FV_TIMESTAMP(&now);

       if (fcache != NULL)
               /* the fve of this packet is already cached */
               fve = fcache;
       else if ((fve = flowlist_lookup(fv, pktattr, &now)) == NULL)
               fve = flowlist_reclaim(fv, pktattr);

       flowlist_move_to_head(fv, fve);

       /*
        * update p:  the following line cancels the update
        *            in fv_checkflow() and calculate
        *      p = Wp + (1 - Wp) * p
        */
       fve->fve_p = (1 << FP_SHIFT) + fve->fve_p;

       fve->fve_lastdrop = now;
}

#endif /* ALTQ_FLOWVALVE */

#ifdef KLD_MODULE

static struct altqsw red_sw =
       {"red", redopen, redclose, redioctl};

ALTQ_MODULE(altq_red, ALTQT_RED, &red_sw);
MODULE_VERSION(altq_red, 1);

#endif /* KLD_MODULE */
#endif /* ALTQ3_COMPAT */

#endif /* ALTQ_RED */