From owner-freebsd-net@FreeBSD.ORG Fri Jun 30 11:01:24 2006 Return-Path: X-Original-To: freebsd-net@freebsd.org Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3AA4F16A416; Fri, 30 Jun 2006 11:01:24 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from cyrus.watson.org (cyrus.watson.org [209.31.154.42]) by mx1.FreeBSD.org (Postfix) with ESMTP id D9D9943D49; Fri, 30 Jun 2006 11:01:23 +0000 (GMT) (envelope-from rwatson@FreeBSD.org) Received: from fledge.watson.org (fledge.watson.org [209.31.154.41]) by cyrus.watson.org (Postfix) with ESMTP id 46D3446C38; Fri, 30 Jun 2006 07:01:23 -0400 (EDT) Date: Fri, 30 Jun 2006 12:01:23 +0100 (BST) From: Robert Watson X-X-Sender: robert@fledge.watson.org To: Julian Elischer In-Reply-To: <44A40C25.904@elischer.org> Message-ID: <20060630115749.G3964@fledge.watson.org> References: <200606290752.k5T7qU06021639@repoman.freebsd.org> <20060629132354.D73145@mp2.macomnet.net> <20060629131201.GA67682@comp.chem.msu.su> <44A40C25.904@elischer.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: Yar Tikhiy , src-committers@FreeBSD.org, FreeBSD Net Subject: Re: cvs commit: src/sys/net if_vlan.c X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Jun 2006 11:01:24 -0000 On Thu, 29 Jun 2006, Julian Elischer wrote: >> I stress tested gif(4) in the same manner for kicks and got a very similar >> panic in in_control(). I suppose that my change eliminated a concurrency >> problem in vlan(4) and we began to feel the lack of refcounting at ifnet >> level. Indeed, a thread can keep a pointer to an ifnet beyond its lifetime >> and panic the system on access to the dead ifnet. > > Unfortunatly, since mbufs point to ifnets it is almost impossible to > "efficiently" refcount ifnets. Mbufs may persist almost indefinitly in a > socket receive buffer, well after the given receive interface has gone away. > I submitted patches to full real referenc counting of ifnets in 1995 but it > was already too cumbersom then, and since then it has gotten worse. (due to > SMP etc.) Partial solutions are possible here -- even if we don't immediately fix the mbuf pointer issue, we can fix other types of ifnet references to be real, such as references from heavier weight administrative structures and operations, even if mbufs don't get them. It's been suggested that interfaces become dead and be GC'd after a timeout in order to reduce the chances of mbuf related races. I think this is a pretty reasonable work-around to the general problem here, especially if "dead" is really implemented properly. An example of a "bad" implementation of dead would have the ifnet continue to be visible and occupy space in the interface name space, preventing tun0 from being immediately reallocated after it is destroyed. A better implementation would have all external signs of the ifnet disappear, except that the pointer remains minimally valid for a few seconds. Not ideal, but better than reference counting ifnets from mbufs. For gif interfaces, etc, real references are possible and desirable. Robert N M Watson Computer Laboratory University of Cambridge