Re: [GIT PULL] kdbus for 4.1-rc1

David Lang
2015-04-29T20:16:29Z

On Wed, 29 Apr 2015, Andy Lutomirski wrote:

> On Wed, Apr 29, 2015 at 12:30 PM, Austin S Hemmelgarn
> <ahferroin7@gmail.com> wrote:
>> On 2015-04-29 14:54, Andy Lutomirski wrote:
>>>
>>> On Apr 29, 2015 5:48 AM, "Harald Hoyer" <harald@redhat.com> wrote:
>>>>
>>>>
>>>> * Being in the kernel closes a lot of races which can't be fixed with
>>>> the current userspace solutions. For example, with kdbus, there is a
>>>> way a client can disconnect from a bus, but do so only if no further
>>>> messages present in its queue, which is crucial for implementing
>>>> race-free "exit-on-idle" services
>>>
>>>
>>> This can be implemented in userspace.
>>>
>>> Client to dbus daemon: may I exit now?
>>> Dbus daemon to client: yes (and no more messages) or no
>>>
>> Depending on how this is implemented, there would be a potential issue if a
>> message arrived for the client after the daemon told it it could exit, but
>> before it finished shutdown, in which case the message might get lost.
>>
>
> Then implement it the right way? The client sends some kind of
> sequence number with its request.

so any app in the system can prevent any other app from exiting/restarting by
just sending it the equivalent of a ping over dbus?

preventing an app from exiting because there are unhandled messages doesn't mean
that those messages are going to be handled, just that they will get read and
dropped on the floor by an app trying to exit. Sometimes you will just end up
with a hung app that can't process messages and needs to be restarted, but can't
be restarted because there are pending messages.

The problem with "guaranteed delivery" messages is that things _will_ go wrong
that will cause the messages to not be received and processed. At that point you
have the choice of loosing some messages or freezing your entire system (you can
buffer them for some time, but eventually you will run out of buffer space)

We see this all the time in the logging world, people configure their systems
for reliable delivery of log messages to a remote machine, then when that remote
machine goes down and can't receive messages (or a network issue blocks the
traffic), the sending machine blocks and causes an outage.

Being too strict about guaranteeing delivery just doesn't work. You must have a
mechanism to abort and throw away unprocessed messages. If this means
disconnecting the receiver so that there are no missing messages to the
receiver, that's a valid choice. But preventing a receiver from exiting because
it hasn't processed a message is not a valid choice.

David Lang