1 files changed, 147 insertions, 97 deletions

diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 6bcfe52a9c8..9ffa24b9a80 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -51,8 +51,8 @@
  *  lookups performed with disabled BHs.
  *
  *  Serialisation issues.
- *  1.  Nodes may appear in the tree only with the pool write lock held.
- *  2.  Nodes may disappear from the tree only with the pool write lock held
+ *  1.  Nodes may appear in the tree only with the pool lock held.
+ *  2.  Nodes may disappear from the tree only with the pool lock held
  *      AND reference count being 0.
  *  3.  Nodes appears and disappears from unused node list only under
  *      "inet_peer_unused_lock".
@@ -64,23 +64,31 @@
  *                 usually under some other lock to prevent node disappearing
  *              dtime: unused node list lock
  *              v4daddr: unchangeable
- *              ip_id_count: idlock
+ *              ip_id_count: atomic value (no lock needed)
  */
 
 static struct kmem_cache *peer_cachep __read_mostly;
 
 #define node_height(x) x->avl_height
-static struct inet_peer peer_fake_node = {
-        .avl_left       = &peer_fake_node,
-        .avl_right      = &peer_fake_node,
+
+#define peer_avl_empty ((struct inet_peer *)&peer_fake_node)
+static const struct inet_peer peer_fake_node = {
+        .avl_left       = peer_avl_empty,
+        .avl_right      = peer_avl_empty,
         .avl_height     = 0
 };
-#define peer_avl_empty (&peer_fake_node)
-static struct inet_peer *peer_root = peer_avl_empty;
-static DEFINE_RWLOCK(peer_pool_lock);
+
+static struct {
+        struct inet_peer *root;
+        spinlock_t      lock;
+        int             total;
+} peers = {
+        .root           = peer_avl_empty,
+        .lock           = __SPIN_LOCK_UNLOCKED(peers.lock),
+        .total          = 0,
+};
 #define PEER_MAXDEPTH 40 /* sufficient for about 2^27 nodes */
 
-static int peer_total;
 /* Exported for sysctl_net_ipv4.  */
 int inet_peer_threshold __read_mostly = 65536 + 128;    /* start to throw entries more
                                          * aggressively at this stage */
@@ -89,8 +97,13 @@ int inet_peer_maxttl __read_mostly = 10 * 60 * HZ;	/* usual time to live: 10 min
 int inet_peer_gc_mintime __read_mostly = 10 * HZ;
 int inet_peer_gc_maxtime __read_mostly = 120 * HZ;
 
-static LIST_HEAD(unused_peers);
-static DEFINE_SPINLOCK(inet_peer_unused_lock);
+static struct {
+        struct list_head        list;
+        spinlock_t              lock;
+} unused_peers = {
+        .list                   = LIST_HEAD_INIT(unused_peers.list),
+        .lock                   = __SPIN_LOCK_UNLOCKED(unused_peers.lock),
+};
 
 static void peer_check_expire(unsigned long dummy);
 static DEFINE_TIMER(peer_periodic_timer, peer_check_expire, 0, 0);
@@ -116,7 +129,7 @@ void __init inet_initpeers(void)
 
         peer_cachep = kmem_cache_create("inet_peer_cache",
                         sizeof(struct inet_peer),
-                        0, SLAB_HWCACHE_ALIGN|SLAB_PANIC,
+                        0, SLAB_HWCACHE_ALIGN | SLAB_PANIC,
                         NULL);
 
         /* All the timers, started at system startup tend
@@ -131,38 +144,69 @@ void __init inet_initpeers(void)
 /* Called with or without local BH being disabled. */
 static void unlink_from_unused(struct inet_peer *p)
 {
-        spin_lock_bh(&inet_peer_unused_lock);
-        list_del_init(&p->unused);
-        spin_unlock_bh(&inet_peer_unused_lock);
+        if (!list_empty(&p->unused)) {
+                spin_lock_bh(&unused_peers.lock);
+                list_del_init(&p->unused);
+                spin_unlock_bh(&unused_peers.lock);
+        }
 }
 
 /*
  * Called with local BH disabled and the pool lock held.
- * _stack is known to be NULL or not at compile time,
- * so compiler will optimize the if (_stack) tests.
  */
 #define lookup(_daddr, _stack)                                  \
 ({                                                              \
         struct inet_peer *u, **v;                               \
-        if (_stack != NULL) {                                   \
-                stackptr = _stack;                              \
-                *stackptr++ = &peer_root;                       \
-        }                                                       \
-        for (u = peer_root; u != peer_avl_empty; ) {            \
+                                                                \
+        stackptr = _stack;                                      \
+        *stackptr++ = &peers.root;                              \
+        for (u = peers.root; u != peer_avl_empty; ) {           \
                 if (_daddr == u->v4daddr)                       \
                         break;                                  \
                 if ((__force __u32)_daddr < (__force __u32)u->v4daddr)  \
                         v = &u->avl_left;                       \
                 else                                            \
                         v = &u->avl_right;                      \
-                if (_stack != NULL)                             \
-                        *stackptr++ = v;                        \
+                *stackptr++ = v;                                \
                 u = *v;                                         \
         }                                                       \
         u;                                                      \
 })
 
-/* Called with local BH disabled and the pool write lock held. */
+/*
+ * Called with rcu_read_lock_bh()
+ * Because we hold no lock against a writer, its quite possible we fall
+ * in an endless loop.
+ * But every pointer we follow is guaranteed to be valid thanks to RCU.
+ * We exit from this function if number of links exceeds PEER_MAXDEPTH
+ */
+static struct inet_peer *lookup_rcu_bh(__be32 daddr)
+{
+        struct inet_peer *u = rcu_dereference_bh(peers.root);
+        int count = 0;
+
+        while (u != peer_avl_empty) {
+                if (daddr == u->v4daddr) {
+                        /* Before taking a reference, check if this entry was
+                         * deleted, unlink_from_pool() sets refcnt=-1 to make
+                         * distinction between an unused entry (refcnt=0) and
+                         * a freed one.
+                         */
+                        if (unlikely(!atomic_add_unless(&u->refcnt, 1, -1)))
+                                u = NULL;
+                        return u;
+                }
+                if ((__force __u32)daddr < (__force __u32)u->v4daddr)
+                        u = rcu_dereference_bh(u->avl_left);
+                else
+                        u = rcu_dereference_bh(u->avl_right);
+                if (unlikely(++count == PEER_MAXDEPTH))
+                        break;
+        }
+        return NULL;
+}
+
+/* Called with local BH disabled and the pool lock held. */
 #define lookup_rightempty(start)                                \
 ({                                                              \
         struct inet_peer *u, **v;                               \
@@ -176,9 +220,10 @@ static void unlink_from_unused(struct inet_peer *p)
         u;                                                      \
 })
 
-/* Called with local BH disabled and the pool write lock held.
+/* Called with local BH disabled and the pool lock held.
  * Variable names are the proof of operation correctness.
- * Look into mm/map_avl.c for more detail description of the ideas.  */
+ * Look into mm/map_avl.c for more detail description of the ideas.
+ */
 static void peer_avl_rebalance(struct inet_peer **stack[],
                 struct inet_peer ***stackend)
 {
@@ -254,15 +299,21 @@ static void peer_avl_rebalance(struct inet_peer **stack[],
         }
 }
 
-/* Called with local BH disabled and the pool write lock held. */
+/* Called with local BH disabled and the pool lock held. */
 #define link_to_pool(n)                                         \
 do {                                                            \
         n->avl_height = 1;                                      \
         n->avl_left = peer_avl_empty;                           \
         n->avl_right = peer_avl_empty;                          \
+        smp_wmb(); /* lockless readers can catch us now */      \
         **--stackptr = n;                                       \
         peer_avl_rebalance(stack, stackptr);                    \
-} while(0)
+} while (0)
+
+static void inetpeer_free_rcu(struct rcu_head *head)
+{
+        kmem_cache_free(peer_cachep, container_of(head, struct inet_peer, rcu));
+}
 
 /* May be called with local BH enabled. */
 static void unlink_from_pool(struct inet_peer *p)
@@ -271,13 +322,14 @@ static void unlink_from_pool(struct inet_peer *p)
 
         do_free = 0;
 
-        write_lock_bh(&peer_pool_lock);
+        spin_lock_bh(&peers.lock);
         /* Check the reference counter.  It was artificially incremented by 1
-         * in cleanup() function to prevent sudden disappearing.  If the
-         * reference count is still 1 then the node is referenced only as `p'
-         * here and from the pool.  So under the exclusive pool lock it's safe
-         * to remove the node and free it later. */
-        if (atomic_read(&p->refcnt) == 1) {
+         * in cleanup() function to prevent sudden disappearing.  If we can
+         * atomically (because of lockless readers) take this last reference,
+         * it's safe to remove the node and free it later.
+         * We use refcnt=-1 to alert lockless readers this entry is deleted.
+         */
+        if (atomic_cmpxchg(&p->refcnt, 1, -1) == 1) {
                 struct inet_peer **stack[PEER_MAXDEPTH];
                 struct inet_peer ***stackptr, ***delp;
                 if (lookup(p->v4daddr, stack) != p)
@@ -303,20 +355,21 @@ static void unlink_from_pool(struct inet_peer *p)
                         delp[1] = &t->avl_left; /* was &p->avl_left */
                 }
                 peer_avl_rebalance(stack, stackptr);
-                peer_total--;
+                peers.total--;
                 do_free = 1;
         }
-        write_unlock_bh(&peer_pool_lock);
+        spin_unlock_bh(&peers.lock);
 
         if (do_free)
-                kmem_cache_free(peer_cachep, p);
+                call_rcu_bh(&p->rcu, inetpeer_free_rcu);
         else
                 /* The node is used again.  Decrease the reference counter
                  * back.  The loop "cleanup -> unlink_from_unused
                  *   -> unlink_from_pool -> putpeer -> link_to_unused
                  *   -> cleanup (for the same node)"
                  * doesn't really exist because the entry will have a
-                 * recent deletion time and will not be cleaned again soon. */
+                 * recent deletion time and will not be cleaned again soon.
+                 */
                 inet_putpeer(p);
 }
 
@@ -326,16 +379,16 @@ static int cleanup_once(unsigned long ttl)
         struct inet_peer *p = NULL;
 
         /* Remove the first entry from the list of unused nodes. */
-        spin_lock_bh(&inet_peer_unused_lock);
-        if (!list_empty(&unused_peers)) {
+        spin_lock_bh(&unused_peers.lock);
+        if (!list_empty(&unused_peers.list)) {
                 __u32 delta;
 
-                p = list_first_entry(&unused_peers, struct inet_peer, unused);
+                p = list_first_entry(&unused_peers.list, struct inet_peer, unused);
                 delta = (__u32)jiffies - p->dtime;
 
                 if (delta < ttl) {
                         /* Do not prune fresh entries. */
-                        spin_unlock_bh(&inet_peer_unused_lock);
+                        spin_unlock_bh(&unused_peers.lock);
                         return -1;
                 }
 
@@ -345,7 +398,7 @@ static int cleanup_once(unsigned long ttl)
                  * before unlink_from_pool() call. */
                 atomic_inc(&p->refcnt);
         }
-        spin_unlock_bh(&inet_peer_unused_lock);
+        spin_unlock_bh(&unused_peers.lock);
 
         if (p == NULL)
                 /* It means that the total number of USED entries has
@@ -360,62 +413,56 @@ static int cleanup_once(unsigned long ttl)
 /* Called with or without local BH being disabled. */
 struct inet_peer *inet_getpeer(__be32 daddr, int create)
 {
-        struct inet_peer *p, *n;
+        struct inet_peer *p;
         struct inet_peer **stack[PEER_MAXDEPTH], ***stackptr;
 
-        /* Look up for the address quickly. */
-        read_lock_bh(&peer_pool_lock);
-        p = lookup(daddr, NULL);
-        if (p != peer_avl_empty)
-                atomic_inc(&p->refcnt);
-        read_unlock_bh(&peer_pool_lock);
+        /* Look up for the address quickly, lockless.
+         * Because of a concurrent writer, we might not find an existing entry.
+         */
+        rcu_read_lock_bh();
+        p = lookup_rcu_bh(daddr);
+        rcu_read_unlock_bh();
+
+        if (p) {
+                /* The existing node has been found.
+                 * Remove the entry from unused list if it was there.
+                 */
+                unlink_from_unused(p);
+                return p;
+        }
 
+        /* retry an exact lookup, taking the lock before.
+         * At least, nodes should be hot in our cache.
+         */
+        spin_lock_bh(&peers.lock);
+        p = lookup(daddr, stack);
         if (p != peer_avl_empty) {
-                /* The existing node has been found. */
+                atomic_inc(&p->refcnt);
+                spin_unlock_bh(&peers.lock);
                 /* Remove the entry from unused list if it was there. */
                 unlink_from_unused(p);
                 return p;
         }
+        p = create ? kmem_cache_alloc(peer_cachep, GFP_ATOMIC) : NULL;
+        if (p) {
+                p->v4daddr = daddr;
+                atomic_set(&p->refcnt, 1);
+                atomic_set(&p->rid, 0);
+                atomic_set(&p->ip_id_count, secure_ip_id(daddr));
+                p->tcp_ts_stamp = 0;
+                INIT_LIST_HEAD(&p->unused);
+
+
+                /* Link the node. */
+                link_to_pool(p);
+                peers.total++;
+        }
+        spin_unlock_bh(&peers.lock);
 
-        if (!create)
-                return NULL;
-
-        /* Allocate the space outside the locked region. */
-        n = kmem_cache_alloc(peer_cachep, GFP_ATOMIC);
-        if (n == NULL)
-                return NULL;
-        n->v4daddr = daddr;
-        atomic_set(&n->refcnt, 1);
-        atomic_set(&n->rid, 0);
-        atomic_set(&n->ip_id_count, secure_ip_id(daddr));
-        n->tcp_ts_stamp = 0;
-
-        write_lock_bh(&peer_pool_lock);
-        /* Check if an entry has suddenly appeared. */
-        p = lookup(daddr, stack);
-        if (p != peer_avl_empty)
-                goto out_free;
-
-        /* Link the node. */
-        link_to_pool(n);
-        INIT_LIST_HEAD(&n->unused);
-        peer_total++;
-        write_unlock_bh(&peer_pool_lock);
-
-        if (peer_total >= inet_peer_threshold)
+        if (peers.total >= inet_peer_threshold)
                 /* Remove one less-recently-used entry. */
                 cleanup_once(0);
 
-        return n;
-
-out_free:
-        /* The appropriate node is already in the pool. */
-        atomic_inc(&p->refcnt);
-        write_unlock_bh(&peer_pool_lock);
-        /* Remove the entry from unused list if it was there. */
-        unlink_from_unused(p);
-        /* Free preallocated the preallocated node. */
-        kmem_cache_free(peer_cachep, n);
         return p;
 }
 
@@ -425,12 +472,12 @@ static void peer_check_expire(unsigned long dummy)
         unsigned long now = jiffies;
         int ttl;
 
-        if (peer_total >= inet_peer_threshold)
+        if (peers.total >= inet_peer_threshold)
                 ttl = inet_peer_minttl;
         else
                 ttl = inet_peer_maxttl
                                 - (inet_peer_maxttl - inet_peer_minttl) / HZ *
-                                        peer_total / inet_peer_threshold * HZ;
+                                        peers.total / inet_peer_threshold * HZ;
         while (!cleanup_once(ttl)) {
                 if (jiffies != now)
                         break;
@@ -439,22 +486,25 @@ static void peer_check_expire(unsigned long dummy)
         /* Trigger the timer after inet_peer_gc_mintime .. inet_peer_gc_maxtime
          * interval depending on the total number of entries (more entries,
          * less interval). */
-        if (peer_total >= inet_peer_threshold)
+        if (peers.total >= inet_peer_threshold)
                 peer_periodic_timer.expires = jiffies + inet_peer_gc_mintime;
         else
                 peer_periodic_timer.expires = jiffies
                         + inet_peer_gc_maxtime
                         - (inet_peer_gc_maxtime - inet_peer_gc_mintime) / HZ *
-                                peer_total / inet_peer_threshold * HZ;
+                                peers.total / inet_peer_threshold * HZ;
         add_timer(&peer_periodic_timer);
 }
 
 void inet_putpeer(struct inet_peer *p)
 {
-        spin_lock_bh(&inet_peer_unused_lock);
-        if (atomic_dec_and_test(&p->refcnt)) {
-                list_add_tail(&p->unused, &unused_peers);
+        local_bh_disable();
+
+        if (atomic_dec_and_lock(&p->refcnt, &unused_peers.lock)) {
+                list_add_tail(&p->unused, &unused_peers.list);
                 p->dtime = (__u32)jiffies;
+                spin_unlock(&unused_peers.lock);
         }
-        spin_unlock_bh(&inet_peer_unused_lock);
+
+        local_bh_enable();
 }