netfilter: x_tables: dont block BH while reading counters
authorEric Dumazet <eric.dumazet@gmail.com>
Mon, 10 Jan 2011 19:11:38 +0000 (20:11 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 10 Jan 2011 19:11:38 +0000 (20:11 +0100)
commit83723d60717f8da0f53f91cf42a845ed56c09662
tree9d32edc2c6dc4849e63d422f8dad42606b2f984f
parent45b9f509b7f5d2d792b3c03b78ddc8ec543e921b
netfilter: x_tables: dont block BH while reading counters

Using "iptables -L" with a lot of rules have a too big BH latency.
Jesper mentioned ~6 ms and worried of frame drops.

Switch to a per_cpu seqlock scheme, so that taking a snapshot of
counters doesnt need to block BH (for this cpu, but also other cpus).

This adds two increments on seqlock sequence per ipt_do_table() call,
its a reasonable cost for allowing "iptables -L" not block BH
processing.

Reported-by: Jesper Dangaard Brouer <hawk@comx.dk>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
CC: Patrick McHardy <kaber@trash.net>
Acked-by: Stephen Hemminger <shemminger@vyatta.com>
Acked-by: Jesper Dangaard Brouer <hawk@comx.dk>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
include/linux/netfilter/x_tables.h
net/ipv4/netfilter/arp_tables.c
net/ipv4/netfilter/ip_tables.c
net/ipv6/netfilter/ip6_tables.c
net/netfilter/x_tables.c