Merge branch 'master' of /repos/git/net-next-2.6

[net-next-2.6.git] / net / netfilter / nf_conntrack_core.c

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 77288980fae017d8694df9d4c5efccd8b18d23b4..16b41b4e2a3c18a4b7979f19d51a91a9427761ae 100644 (file)
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -62,8 +62,8 @@ EXPORT_SYMBOL_GPL(nf_conntrack_htable_size);
 unsigned int nf_conntrack_max __read_mostly;
 EXPORT_SYMBOL_GPL(nf_conntrack_max);
 
-struct nf_conn nf_conntrack_untracked __read_mostly;
-EXPORT_SYMBOL_GPL(nf_conntrack_untracked);
+DEFINE_PER_CPU(struct nf_conn, nf_conntrack_untracked);
+EXPORT_PER_CPU_SYMBOL(nf_conntrack_untracked);
 
 static int nf_conntrack_hash_rnd_initted;
 static unsigned int nf_conntrack_hash_rnd;
@@ -1181,10 +1181,21 @@ static void nf_ct_release_dying_list(struct net *net)
        spin_unlock_bh(&nf_conntrack_lock);
 }
 
+static int untrack_refs(void)
+{
+       int cnt = 0, cpu;
+
+       for_each_possible_cpu(cpu) {
+               struct nf_conn *ct = &per_cpu(nf_conntrack_untracked, cpu);
+
+               cnt += atomic_read(&ct->ct_general.use) - 1;
+       }
+       return cnt;
+}
+
 static void nf_conntrack_cleanup_init_net(void)
 {
-       /* wait until all references to nf_conntrack_untracked are dropped */
-       while (atomic_read(&nf_conntrack_untracked.ct_general.use) > 1)
+       while (untrack_refs() > 0)
                schedule();
 
        nf_conntrack_helper_fini();
@@ -1319,10 +1330,19 @@ EXPORT_SYMBOL_GPL(nf_conntrack_set_hashsize);
 module_param_call(hashsize, nf_conntrack_set_hashsize, param_get_uint,
                  &nf_conntrack_htable_size, 0600);
 
+void nf_ct_untracked_status_or(unsigned long bits)
+{
+       int cpu;
+
+       for_each_possible_cpu(cpu)
+               per_cpu(nf_conntrack_untracked, cpu).status |= bits;
+}
+EXPORT_SYMBOL_GPL(nf_ct_untracked_status_or);
+
 static int nf_conntrack_init_init_net(void)
 {
        int max_factor = 8;
-       int ret;
+       int ret, cpu;
 
        /* Idea from tcp.c: use 1/16384 of memory.  On i386: 32MB
         * machine has 512 buckets. >= 1GB machines have 16384 buckets. */
@@ -1361,11 +1381,13 @@ static int nf_conntrack_init_init_net(void)
                goto err_extend;
 #endif
        /* Set up fake conntrack: to never be deleted, not in any hashes */
-       write_pnet(&nf_conntrack_untracked.ct_net, &init_net);
-       atomic_set(&nf_conntrack_untracked.ct_general.use, 1);
+       for_each_possible_cpu(cpu) {
+               struct nf_conn *ct = &per_cpu(nf_conntrack_untracked, cpu);
+               write_pnet(&ct->ct_net, &init_net);
+               atomic_set(&ct->ct_general.use, 1);
+       }
        /*  - and look it like as a confirmed connection */
-       set_bit(IPS_CONFIRMED_BIT, &nf_conntrack_untracked.status);
-
+       nf_ct_untracked_status_or(IPS_CONFIRMED | IPS_UNTRACKED);
        return 0;
 
 #ifdef CONFIG_NF_CONNTRACK_ZONES