netfilter: flowtable: Use rw sem as flow block lock

Currently flow offload threads are synchronized by the flow block mutex.
Use rw lock instead to increase flow insertion (read) concurrency.

Signed-off-by: Paul Blakey <paulb@mellanox.com>
Reviewed-by: Oz Shlomo <ozsh@mellanox.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
index 4a2ec6fd9ad23a1d3aa3d0f56f09347a63114caf..6bf69652f57df0a54c69c8c4d9e491409acf6d87 100644 (file)
--- a/include/net/netfilter/nf_flow_table.h
+++ b/include/net/netfilter/nf_flow_table.h
@@ -74,7 +74,7 @@ struct nf_flowtable {
        struct delayed_work             gc_work;
        unsigned int                    flags;
        struct flow_block               flow_block;
-       struct mutex                    flow_block_lock; /* Guards flow_block */
+       struct rw_semaphore             flow_block_lock; /* Guards flow_block */
        possible_net_t                  net;
 };
 

diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 9a477bd563b74e00360a05c338c44e725c654789..9399bb2df295479a8427a2c0aaa91acbd87dc48a 100644 (file)
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -392,7 +392,7 @@ int nf_flow_table_offload_add_cb(struct nf_flowtable *flow_table,
        struct flow_block_cb *block_cb;
        int err = 0;
 
-       mutex_lock(&flow_table->flow_block_lock);
+       down_write(&flow_table->flow_block_lock);
        block_cb = flow_block_cb_lookup(block, cb, cb_priv);
        if (block_cb) {
                err = -EEXIST;
@@ -408,7 +408,7 @@ int nf_flow_table_offload_add_cb(struct nf_flowtable *flow_table,
        list_add_tail(&block_cb->list, &block->cb_list);
 
 unlock:
-       mutex_unlock(&flow_table->flow_block_lock);
+       up_write(&flow_table->flow_block_lock);
        return err;
 }
 EXPORT_SYMBOL_GPL(nf_flow_table_offload_add_cb);
@@ -419,13 +419,13 @@ void nf_flow_table_offload_del_cb(struct nf_flowtable *flow_table,
        struct flow_block *block = &flow_table->flow_block;
        struct flow_block_cb *block_cb;
 
-       mutex_lock(&flow_table->flow_block_lock);
+       down_write(&flow_table->flow_block_lock);
        block_cb = flow_block_cb_lookup(block, cb, cb_priv);
        if (block_cb)
                list_del(&block_cb->list);
        else
                WARN_ON(true);
-       mutex_unlock(&flow_table->flow_block_lock);
+       up_write(&flow_table->flow_block_lock);
 }
 EXPORT_SYMBOL_GPL(nf_flow_table_offload_del_cb);
 
@@ -551,7 +551,7 @@ int nf_flow_table_init(struct nf_flowtable *flowtable)
 
        INIT_DEFERRABLE_WORK(&flowtable->gc_work, nf_flow_offload_work_gc);
        flow_block_init(&flowtable->flow_block);
-       mutex_init(&flowtable->flow_block_lock);
+       init_rwsem(&flowtable->flow_block_lock);
 
        err = rhashtable_init(&flowtable->rhashtable,
                              &nf_flow_offload_rhash_params);
@@ -614,7 +614,6 @@ void nf_flow_table_free(struct nf_flowtable *flow_table)
        nf_flow_table_iterate(flow_table, nf_flow_offload_gc_step, flow_table);
        nf_flow_table_offload_flush(flow_table);
        rhashtable_destroy(&flow_table->rhashtable);
-       mutex_destroy(&flow_table->flow_block_lock);
 }
 EXPORT_SYMBOL_GPL(nf_flow_table_free);
 

diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index 0c6437fab4feb85c1de785ab3ec854e5f860c873..b96db831b4caab982d4404908f0ad64881384029 100644 (file)
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -691,7 +691,7 @@ static int nf_flow_offload_tuple(struct nf_flowtable *flowtable,
        if (cmd == FLOW_CLS_REPLACE)
                cls_flow.rule = flow_rule->rule;
 
-       mutex_lock(&flowtable->flow_block_lock);
+       down_read(&flowtable->flow_block_lock);
        list_for_each_entry(block_cb, block_cb_list, list) {
                err = block_cb->cb(TC_SETUP_CLSFLOWER, &cls_flow,
                                   block_cb->cb_priv);
@@ -700,7 +700,7 @@ static int nf_flow_offload_tuple(struct nf_flowtable *flowtable,
 
                i++;
        }
-       mutex_unlock(&flowtable->flow_block_lock);
+       up_read(&flowtable->flow_block_lock);
 
        if (cmd == FLOW_CLS_STATS)
                memcpy(stats, &cls_flow.stats, sizeof(*stats));