Date:	Thu, 2 Apr 2015 10:38:56 -0700
From:	Scott Feldman <sfeldma@...il.com>
To:	David Miller <davem@...emloft.net>
Cc:	Netdev <netdev@...r.kernel.org>,
	Jiří Pírko <jiri@...nulli.us>,
	Roopa Prabhu <roopa@...ulusnetworks.com>,
	Guenter Roeck <linux@...ck-us.net>,
	Florian Fainelli <f.fainelli@...il.com>,
	"Samudrala, Sridhar" <sridhar.samudrala@...el.com>,
	"Arad, Ronen" <ronen.arad@...el.com>
Subject: Re: [PATCH net-next v2 01/26] switchdev: introduce get/set attrs ops

On Thu, Apr 2, 2015 at 9:05 AM, David Miller <davem@...emloft.net> wrote:
> From: Scott Feldman <sfeldma@...il.com>
> Date: Thu, 2 Apr 2015 00:43:57 -0700
>
>> On Wed, Apr 1, 2015 at 11:08 AM, David Miller <davem@...emloft.net> wrote:
>>> From: sfeldma@...il.com
>>> Date: Wed,  1 Apr 2015 03:07:37 -0700
>>>
>>>> +int swdev_port_attr_set(struct net_device *dev, struct swdev_attr *attr)
>>>> +{
>>>> +     struct swdev_attr prev = *attr;
>>>> +     int err, get_err, revert_err;
>>>> +
>>>> +     get_err = swdev_port_attr_get(dev, &prev);
>>>> +
>>>> +     err = __swdev_port_attr_set(dev, attr);
>>>> +     if (err && !get_err && !(attr->flags & SWDEV_F_NO_RECOVER)) {
>>>> +             /* Some err on set: revert to previous value */
>>>> +             revert_err = __swdev_port_attr_set(dev, &prev);
>>>> +             if (revert_err)
>>>> +                     netdev_err(dev, "Reverting swdev port attr %d failed\n",
>>>> +                                attr->id);
>>>> +     }
>>>> +
>>>> +     return err;
>>>
>>> This style of error recovery doesn't work.
>>>
>>> You have to have a prepare/commit model to do this sanely, because
>>> otherwise:
>>>
>>> 1) Partial state updates can be seen by the data plane (and other
>>>    code paths) that do not use RTNL mutex protection.
>>>
>>> 2) It is absoultely expected that if some resource allocation failed
>>>    when switching to the new attribute value, the same exactly thing
>>>    is extremely likely during the rollback.
>>>
>>> So you have to code this in a way that no partial state updates are
>>> ever visible, and also that rollbacks don't fail.
>>
>> I'm sending v3 with a prepare/commit model, for attr sets and obj
>> adds.  The prepare phase asks driver(s) if set/add will work (is
>> supported and device resource is available).  If yes, then do commit
>> phase.   Commit could still fail due to failures outside the control
>> of the driver, like ENOMEM.  In that case, WARN and return err.
>
> Scott, the whole purpose of the prepare phase is the allocate any
> necessary resources so that they are available for the commit phase.
> It needs to do this in addition to validating the incoming arguments.
>
> If some part of the prepare phase fails, you go back and release any
> pre-allocated resources.
>
> The commit phase must not fail.

I was afraid you were going to say that :(

I looked at doing that with rocker for setting STP state.  The driver
does allocate some system memory blocks, conditionally, about 4 call
levels down, and then it may or may not free them it.  To do that all
up-front in prepare, we'd need to traverse all the same code paths
allocating memory as we go and stashing it in some transaction object
passed from above, but skip any device accesses.  And then in commit,
go thru the same paths, but use stash memory from transaction object
and this time do call into device.  All of this to avoid failing
commit due to OOM.  So I reasoned OOM isn't a case worth the work
because the system is pretty much hosed at that point anyway, and went
with a prepare phase that only validates and checks for device
resources, but skip system resources.

It's not impossible, but my little Spring Cleanup patch is going to
turn into Spring Renovation patch.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists