[RFC] Event Cache per-cpu

[Pablo Neira <pablo@eurodev.net>]

Hi all,

I've been discussing this issue with Patrick during last week. I've 
found two problems with the current approach of a event cache per cpu. 
The problem is related to 1) preemption, 2) the fact that 
ip_conntrack_in can be called from process and softirq context.

1) If preemption is enable, a calling process walking on ip_conntrack_in 
could be preempted by other process which has more priority on the same CPU.

2) A calling process walking on ip_conntrack can be preempted by a 
softirq which could walk the same piece of bits on the same CPU.

In both cases, the event cache will be corrupted. In resume, I see three 
possibilities:

a) per-cpu event cache. Won't work, even if we disable preemption in 
ip_conntrack_in, we can still have problems with softirqs preempting a 
calling process.

b) per conntrack cache. It won't work, in a SMP environment, two packets 
of the same connection can be handled by two different CPU's.

c) per packet cache. I don't see any possible race with this approach at 
the moment, but I'll need to use the nfcache field in skbuff. I prefer 
this than adding a new field to a skbuff, I think that Davem won't like 
that.

There's 15 bits in nfcache available now (because IPVS guys are using 
one in private). My last patch has 11 events.

enum ip_conntrack_events
{
       IPCT_NEW,                       /* New conntrack                */
       IPCT_RELATED,                   /* Expected connection          */
       IPCT_DESTROY,                   /* Destroyed conntrack          */
       IPCT_STATUS,                    /* Status has changed           */
       IPCT_REFRESH,                   /* Timer has been refreshed     */
       IPCT_PROTOINFO,                 /* Update of protocol info      */
       IPCT_PROTOINFO_VOLATILE,        /* Volatile protocol info       */
       IPCT_HELPER,                    /* New helper for conntrack     */
       IPCT_HELPINFO,                  /* Update of helper info        */
       IPCT_HELPINFO_VOLATILE,         /* Volatile helper info         */
       IPCT_NATINFO,                   /* NAT info                     */
};

Patrick suggests that we could run out of bits soon if events go in 
nfcache, that's true. To fix that, could we remove this stuff in 
netfilter_ipv4.h, nobody is using it ?

#define NFC_IP_SRC              0x0001
/* Dest IP address. */
#define NFC_IP_DST              0x0002
...

Please, comments welcome.

Pablo