From nobody@FreeBSD.org  Thu Apr  5 20:43:31 2007
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id D64CA16A401
	for <freebsd-gnats-submit@FreeBSD.org>; Thu,  5 Apr 2007 20:43:31 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [69.147.83.33])
	by mx1.freebsd.org (Postfix) with ESMTP id C847513C480
	for <freebsd-gnats-submit@FreeBSD.org>; Thu,  5 Apr 2007 20:43:31 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.13.1/8.13.1) with ESMTP id l35KhVc9047071
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 5 Apr 2007 20:43:31 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.13.1/8.13.1/Submit) id l35KcUeg046285;
	Thu, 5 Apr 2007 20:38:30 GMT
	(envelope-from nobody)
Message-Id: <200704052038.l35KcUeg046285@www.freebsd.org>
Date: Thu, 5 Apr 2007 20:38:30 GMT
From: Nathan Ferch<nf+fbsd@marginal.net>
To: freebsd-gnats-submit@FreeBSD.org
Subject: RELENG_6 em(4) watchdog timeout with IPSEC/mpsafenet
X-Send-Pr-Version: www-3.0

>Number:         111285
>Category:       kern
>Synopsis:       [em] RELENG_6 em(4) watchdog timeout with IPSEC/mpsafenet
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Apr 05 20:50:06 GMT 2007
>Closed-Date:    Thu Apr 12 05:56:22 GMT 2007
>Last-Modified:  Thu Apr 12 05:56:22 GMT 2007
>Originator:     Nathan Ferch
>Release:        6,2-RELEASE, 6.2-STABLE
>Organization:
>Environment:
FreeBSD threepwood 6.2-STABLE FreeBSD 6.2-STABLE #8: Thu Apr  5 12:40:54 CDT 2007     root@threepwood:/usr/obj/usr/src/sys/THREEPWOOD  i386
>Description:
I am getting frequent interface lockups and watchdog timeouts with em(4)
when IPSEC is loaded with mpsafenet enabled or IPSEC is compiled into the
kernel.

I have not been able to reproduce the problem with other interfaces.

This problem occurs whether APIC is turned on or not.
>How-To-Repeat:
compile kernel:
+options                        IPSEC
+options                        IPSEC_ESP
+options                        IPSEC_DEBUG

OR
add 'debug.mpsafenet="0"' to /boot/loader.conf

kldload crypto

generate network traffic:

nttcp -D  -l 65535 -T 10.129.0.2 (repeat until hang/watchdog timeout)

>Fix:
The watchdog timeout will usually reset the interface and allow operation
after a few seconds.

In the case the watchdog timeout does not kick in, bringing the interface
down then up will have the same effect.
>Release-Note:
>Audit-Trail:

From: Kris Kennaway <kris@obsecurity.org>
To: Nathan Ferch <nf+fbsd@marginal.net>
Cc: freebsd-gnats-submit@FreeBSD.org
Subject: Re: kern/111285: RELENG_6 em(4) watchdog timeout with IPSEC/mpsafenet
Date: Sat, 7 Apr 2007 00:44:04 -0400

 On Thu, Apr 05, 2007 at 08:38:30PM +0000, Nathan Ferch wrote:
 
 > I am getting frequent interface lockups and watchdog timeouts with em(4) when IPSEC is loaded with mpsafenet enabled or IPSEC is compiled into the kernel.
 > 
 > I have not been able to reproduce the problem with other interfaces.
 > 
 > This problem occurs whether APIC is turned on or not.
 > >How-To-Repeat:
 > compile kernel:
 > +options                        IPSEC
 > +options                        IPSEC_ESP
 > +options                        IPSEC_DEBUG
 > 
 > OR
 > add 'debug.mpsafenet="0"' to /boot/loader.conf
 > 
 > kldload crypto
 > 
 > generate network traffic:
 > 
 > nttcp -D  -l 65535 -T 10.129.0.2 (repeat until hang/watchdog timeout)
 
 You appear to be using IPv4, so you should use FAST_IPSEC instead.
 IPSEC is deprecated and will be removed once IPv6 support is added to
 FAST_IPSEC.
 
 The issue is probably that when you set mpsafenet=0 and you generate
 extremely heavy traffic loads, the interface watchdog timer is not run
 within the timeout period (because it is competing to acquire the
 Giant lockand starved by the other traffic).
 
 Since mpsafenet=0 is only forced in legacy configurations such as the
 above, this is not really a priority to fix in itself since the real
 fix is being pursued (and is likely already available for you).
 
 Kris
State-Changed-From-To: open->closed 
State-Changed-By: remko 
State-Changed-When: Thu Apr 12 05:56:20 UTC 2007 
State-Changed-Why:  
Kris said that using FAST_IPSEC will most likely help, the other code is 
deprecated and will most likely not get fixed. Reflect that in the PR 
status (closed). Thanks for using FreeBSD. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=111285 
>Unformatted:
