| Message ID | 20220412202613.234896-1-axboe@kernel.dk (mailing list archive) |
|---|---|
| Headers | show |
| Series | Add support for no-lock sockets | expand |
On 4/12/22 13:26, Jens Axboe wrote: > Hi, > > If we accept a connection directly, eg without installing a file > descriptor for it, or if we use IORING_OP_SOCKET in direct mode, then > we have a socket for recv/send that we can fully serialize access to. > > With that in mind, we can feasibly skip locking on the socket for TCP > in that case. Some of the testing I've done has shown as much as 15% > of overhead in the lock_sock/release_sock part, with this change then > we see none. > > Comments welcome! > How BH handlers (including TCP timers) and io_uring are going to run safely ? Even if a tcp socket had one user, (private fd opened by a non multi-threaded program), we would still to use the spinlock. Maybe I am missing something, but so far your patches make no sense to me.
On 4/12/22 6:40 PM, Eric Dumazet wrote: > > On 4/12/22 13:26, Jens Axboe wrote: >> Hi, >> >> If we accept a connection directly, eg without installing a file >> descriptor for it, or if we use IORING_OP_SOCKET in direct mode, then >> we have a socket for recv/send that we can fully serialize access to. >> >> With that in mind, we can feasibly skip locking on the socket for TCP >> in that case. Some of the testing I've done has shown as much as 15% >> of overhead in the lock_sock/release_sock part, with this change then >> we see none. >> >> Comments welcome! >> > How BH handlers (including TCP timers) and io_uring are going to run > safely ? Even if a tcp socket had one user, (private fd opened by a > non multi-threaded program), we would still to use the spinlock. But we don't even hold the spinlock over lock_sock() and release_sock(), just the mutex. And we do check for running eg the backlog on release, which I believe is done safely and similarly in other places too. > Maybe I am missing something, but so far your patches make no sense to > me. It's probably more likely I'm missing something, since I don't know this area nearly as well as you. But it'd be great if you could be specific.
On Tue, Apr 12, 2022 at 6:26 PM Jens Axboe <axboe@kernel.dk> wrote: > > On 4/12/22 6:40 PM, Eric Dumazet wrote: > > > > On 4/12/22 13:26, Jens Axboe wrote: > >> Hi, > >> > >> If we accept a connection directly, eg without installing a file > >> descriptor for it, or if we use IORING_OP_SOCKET in direct mode, then > >> we have a socket for recv/send that we can fully serialize access to. > >> > >> With that in mind, we can feasibly skip locking on the socket for TCP > >> in that case. Some of the testing I've done has shown as much as 15% > >> of overhead in the lock_sock/release_sock part, with this change then > >> we see none. > >> > >> Comments welcome! > >> > > How BH handlers (including TCP timers) and io_uring are going to run > > safely ? Even if a tcp socket had one user, (private fd opened by a > > non multi-threaded program), we would still to use the spinlock. > > But we don't even hold the spinlock over lock_sock() and release_sock(), > just the mutex. And we do check for running eg the backlog on release, > which I believe is done safely and similarly in other places too. So lets say TCP stack receives a packet in BH handler... it proceeds using many tcp sock fields. Then io_uring wants to read/write stuff from another cpu, while BH handler(s) is(are) not done yet, and will happily read/change many of the same fields Writing a 1 and a 0 in a bit field to ensure mutual exclusion is not going to work, even with the smp_rmb() and smp_wmb() you added (adding more costs for non io_uring users which already pay a high lock tax) If we want to optimize the lock_sock()/release_sock() for common cases (a single user thread per TCP socket), then maybe we can play games with some kind of cmpxchg() games, but that would be a generic change.
On 4/12/22 7:54 PM, Eric Dumazet wrote: > On Tue, Apr 12, 2022 at 6:26 PM Jens Axboe <axboe@kernel.dk> wrote: >> >> On 4/12/22 6:40 PM, Eric Dumazet wrote: >>> >>> On 4/12/22 13:26, Jens Axboe wrote: >>>> Hi, >>>> >>>> If we accept a connection directly, eg without installing a file >>>> descriptor for it, or if we use IORING_OP_SOCKET in direct mode, then >>>> we have a socket for recv/send that we can fully serialize access to. >>>> >>>> With that in mind, we can feasibly skip locking on the socket for TCP >>>> in that case. Some of the testing I've done has shown as much as 15% >>>> of overhead in the lock_sock/release_sock part, with this change then >>>> we see none. >>>> >>>> Comments welcome! >>>> >>> How BH handlers (including TCP timers) and io_uring are going to run >>> safely ? Even if a tcp socket had one user, (private fd opened by a >>> non multi-threaded program), we would still to use the spinlock. >> >> But we don't even hold the spinlock over lock_sock() and release_sock(), >> just the mutex. And we do check for running eg the backlog on release, >> which I believe is done safely and similarly in other places too. > > So lets say TCP stack receives a packet in BH handler... it proceeds > using many tcp sock fields. > > Then io_uring wants to read/write stuff from another cpu, while BH > handler(s) is(are) not done yet, > and will happily read/change many of the same fields But how is that currently protected? The bh spinlock is only held briefly while locking the socket, and ditto on the relase. Outside of that, the owner field is used. At least as far as I can tell. I'm assuming the mutex exists solely to serialize acess to eg send/recv on the system call side. Hence if we can just make the owner check/set sane, then it would seem to be that it'd work just fine. Unless I'm still missing something here. > Writing a 1 and a 0 in a bit field to ensure mutual exclusion is not > going to work, > even with the smp_rmb() and smp_wmb() you added (adding more costs for > non io_uring users > which already pay a high lock tax) Right, that's what the set was supposed to improve :-) In all fairness, the rmb/wmb doesn't even measure compared to the current socket locking, so I highly doubt that any high frequency TCP would notice _any_ difference there. It's dwarfed by fiddling the mutex and spinlock already. But I agree, it may not be 100% bullet proof. May need actual bitops to be totally safe. Outside of that, I'm still failing to see what kind of mutual exclusion exists between BH handlers and a system call doing a send or receive on the socket. > If we want to optimize the lock_sock()/release_sock() for common cases > (a single user thread per TCP socket), > then maybe we can play games with some kind of cmpxchg() games, but > that would be a generic change. Sure, not disagreeing on that, but you'd supposedly still need the mutex to serialize send or receives on the socket for those cases.
On Tue, Apr 12, 2022 at 7:01 PM Jens Axboe <axboe@kernel.dk> wrote: > > On 4/12/22 7:54 PM, Eric Dumazet wrote: > > On Tue, Apr 12, 2022 at 6:26 PM Jens Axboe <axboe@kernel.dk> wrote: > >> > >> On 4/12/22 6:40 PM, Eric Dumazet wrote: > >>> > >>> On 4/12/22 13:26, Jens Axboe wrote: > >>>> Hi, > >>>> > >>>> If we accept a connection directly, eg without installing a file > >>>> descriptor for it, or if we use IORING_OP_SOCKET in direct mode, then > >>>> we have a socket for recv/send that we can fully serialize access to. > >>>> > >>>> With that in mind, we can feasibly skip locking on the socket for TCP > >>>> in that case. Some of the testing I've done has shown as much as 15% > >>>> of overhead in the lock_sock/release_sock part, with this change then > >>>> we see none. > >>>> > >>>> Comments welcome! > >>>> > >>> How BH handlers (including TCP timers) and io_uring are going to run > >>> safely ? Even if a tcp socket had one user, (private fd opened by a > >>> non multi-threaded program), we would still to use the spinlock. > >> > >> But we don't even hold the spinlock over lock_sock() and release_sock(), > >> just the mutex. And we do check for running eg the backlog on release, > >> which I believe is done safely and similarly in other places too. > > > > So lets say TCP stack receives a packet in BH handler... it proceeds > > using many tcp sock fields. > > > > Then io_uring wants to read/write stuff from another cpu, while BH > > handler(s) is(are) not done yet, > > and will happily read/change many of the same fields > > But how is that currently protected? It is protected by current code. What you wrote would break TCP stack quite badly. I suggest you setup/run a syzbot server/farm, then you will have a hundred reports quite easily. The bh spinlock is only held > briefly while locking the socket, and ditto on the relase. The 'briefly' is exactly what is needed to ensure exclusion between BH and the user thread. Yes, this is unfortunate but this is what it is. Outside of > that, the owner field is used. At least as far as I can tell. I'm > assuming the mutex exists solely to serialize acess to eg send/recv on > the system call side. > > Hence if we can just make the owner check/set sane, then it would seem > to be that it'd work just fine. Unless I'm still missing something here. > > > Writing a 1 and a 0 in a bit field to ensure mutual exclusion is not > > going to work, > > even with the smp_rmb() and smp_wmb() you added (adding more costs for > > non io_uring users > > which already pay a high lock tax) > > Right, that's what the set was supposed to improve :-) > > In all fairness, the rmb/wmb doesn't even measure compared to the > current socket locking, so I highly doubt that any high frequency TCP > would notice _any_ difference there. It's dwarfed by fiddling the mutex > and spinlock already. > > But I agree, it may not be 100% bullet proof. May need actual bitops to > be totally safe. Outside of that, I'm still failing to see what kind of > mutual exclusion exists between BH handlers and a system call doing a > send or receive on the socket. > > > If we want to optimize the lock_sock()/release_sock() for common cases > > (a single user thread per TCP socket), > > then maybe we can play games with some kind of cmpxchg() games, but > > that would be a generic change. > > Sure, not disagreeing on that, but you'd supposedly still need the mutex > to serialize send or receives on the socket for those cases. > > -- > Jens Axboe >
On 4/12/22 8:05 PM, Eric Dumazet wrote: > On Tue, Apr 12, 2022 at 7:01 PM Jens Axboe <axboe@kernel.dk> wrote: >> >> On 4/12/22 7:54 PM, Eric Dumazet wrote: >>> On Tue, Apr 12, 2022 at 6:26 PM Jens Axboe <axboe@kernel.dk> wrote: >>>> >>>> On 4/12/22 6:40 PM, Eric Dumazet wrote: >>>>> >>>>> On 4/12/22 13:26, Jens Axboe wrote: >>>>>> Hi, >>>>>> >>>>>> If we accept a connection directly, eg without installing a file >>>>>> descriptor for it, or if we use IORING_OP_SOCKET in direct mode, then >>>>>> we have a socket for recv/send that we can fully serialize access to. >>>>>> >>>>>> With that in mind, we can feasibly skip locking on the socket for TCP >>>>>> in that case. Some of the testing I've done has shown as much as 15% >>>>>> of overhead in the lock_sock/release_sock part, with this change then >>>>>> we see none. >>>>>> >>>>>> Comments welcome! >>>>>> >>>>> How BH handlers (including TCP timers) and io_uring are going to run >>>>> safely ? Even if a tcp socket had one user, (private fd opened by a >>>>> non multi-threaded program), we would still to use the spinlock. >>>> >>>> But we don't even hold the spinlock over lock_sock() and release_sock(), >>>> just the mutex. And we do check for running eg the backlog on release, >>>> which I believe is done safely and similarly in other places too. >>> >>> So lets say TCP stack receives a packet in BH handler... it proceeds >>> using many tcp sock fields. >>> >>> Then io_uring wants to read/write stuff from another cpu, while BH >>> handler(s) is(are) not done yet, >>> and will happily read/change many of the same fields >> >> But how is that currently protected? > > It is protected by current code. > > What you wrote would break TCP stack quite badly. No offense, but your explanations are severely lacking. By "current code"? So what you're saying is that it's protected by how the code currently works? From how that it currently is? Yeah, that surely explains it. > I suggest you setup/run a syzbot server/farm, then you will have a > hundred reports quite easily. Nowhere am I claiming this is currently perfect, and it should have had an RFC on it. Was hoping for some constructive criticism on how to move this forward, as high frequency TCP currently _sucks_ in the stack. Instead I get useless replies, not very encouraging. I've run this quite extensively on just basic send/receive over sockets, so it's not like it hasn't been run at all. And it's been fine so far, no ill effects observed. If we need to tighten down the locking, perhaps a valid use would be to simply skip the mutex and retain the bh lock for setting owner. As far as I can tell, should still be safe to skip on release, except if we need to process the backlog. And it'd serialize the owner setting with the BH, which seems to be your main objection in. Mostly guessing here, based on the in-depth replies. But it'd be nice if we could have a more constructive dialogue about this, rather than the weird dismisiveness.
On Tue, Apr 12, 2022 at 7:12 PM Jens Axboe <axboe@kernel.dk> wrote: > > On 4/12/22 8:05 PM, Eric Dumazet wrote: > > On Tue, Apr 12, 2022 at 7:01 PM Jens Axboe <axboe@kernel.dk> wrote: > >> > >> On 4/12/22 7:54 PM, Eric Dumazet wrote: > >>> On Tue, Apr 12, 2022 at 6:26 PM Jens Axboe <axboe@kernel.dk> wrote: > >>>> > >>>> On 4/12/22 6:40 PM, Eric Dumazet wrote: > >>>>> > >>>>> On 4/12/22 13:26, Jens Axboe wrote: > >>>>>> Hi, > >>>>>> > >>>>>> If we accept a connection directly, eg without installing a file > >>>>>> descriptor for it, or if we use IORING_OP_SOCKET in direct mode, then > >>>>>> we have a socket for recv/send that we can fully serialize access to. > >>>>>> > >>>>>> With that in mind, we can feasibly skip locking on the socket for TCP > >>>>>> in that case. Some of the testing I've done has shown as much as 15% > >>>>>> of overhead in the lock_sock/release_sock part, with this change then > >>>>>> we see none. > >>>>>> > >>>>>> Comments welcome! > >>>>>> > >>>>> How BH handlers (including TCP timers) and io_uring are going to run > >>>>> safely ? Even if a tcp socket had one user, (private fd opened by a > >>>>> non multi-threaded program), we would still to use the spinlock. > >>>> > >>>> But we don't even hold the spinlock over lock_sock() and release_sock(), > >>>> just the mutex. And we do check for running eg the backlog on release, > >>>> which I believe is done safely and similarly in other places too. > >>> > >>> So lets say TCP stack receives a packet in BH handler... it proceeds > >>> using many tcp sock fields. > >>> > >>> Then io_uring wants to read/write stuff from another cpu, while BH > >>> handler(s) is(are) not done yet, > >>> and will happily read/change many of the same fields > >> > >> But how is that currently protected? > > > > It is protected by current code. > > > > What you wrote would break TCP stack quite badly. > > No offense, but your explanations are severely lacking. By "current > code"? So what you're saying is that it's protected by how the code > currently works? From how that it currently is? Yeah, that surely > explains it. > > > I suggest you setup/run a syzbot server/farm, then you will have a > > hundred reports quite easily. > > Nowhere am I claiming this is currently perfect, and it should have had > an RFC on it. Was hoping for some constructive criticism on how to move > this forward, as high frequency TCP currently _sucks_ in the stack. > Instead I get useless replies, not very encouraging. > > I've run this quite extensively on just basic send/receive over sockets, > so it's not like it hasn't been run at all. And it's been fine so far, > no ill effects observed. If we need to tighten down the locking, perhaps > a valid use would be to simply skip the mutex and retain the bh lock for > setting owner. As far as I can tell, should still be safe to skip on > release, except if we need to process the backlog. And it'd serialize > the owner setting with the BH, which seems to be your main objection in. > Mostly guessing here, based on the in-depth replies. > > But it'd be nice if we could have a more constructive dialogue about > this, rather than the weird dismisiveness. > > Sure. It would be nice that I have not received such a patch series the day I am sick. Jakub, David, Paolo, please provide details to Jens, thanks.
On Tue, Apr 12, 2022 at 7:19 PM Eric Dumazet <edumazet@google.com> wrote: > > On Tue, Apr 12, 2022 at 7:12 PM Jens Axboe <axboe@kernel.dk> wrote: > > > > On 4/12/22 8:05 PM, Eric Dumazet wrote: > > > On Tue, Apr 12, 2022 at 7:01 PM Jens Axboe <axboe@kernel.dk> wrote: > > >> > > >> On 4/12/22 7:54 PM, Eric Dumazet wrote: > > >>> On Tue, Apr 12, 2022 at 6:26 PM Jens Axboe <axboe@kernel.dk> wrote: > > >>>> > > >>>> On 4/12/22 6:40 PM, Eric Dumazet wrote: > > >>>>> > > >>>>> On 4/12/22 13:26, Jens Axboe wrote: > > >>>>>> Hi, > > >>>>>> > > >>>>>> If we accept a connection directly, eg without installing a file > > >>>>>> descriptor for it, or if we use IORING_OP_SOCKET in direct mode, then > > >>>>>> we have a socket for recv/send that we can fully serialize access to. > > >>>>>> > > >>>>>> With that in mind, we can feasibly skip locking on the socket for TCP > > >>>>>> in that case. Some of the testing I've done has shown as much as 15% > > >>>>>> of overhead in the lock_sock/release_sock part, with this change then > > >>>>>> we see none. > > >>>>>> > > >>>>>> Comments welcome! > > >>>>>> > > >>>>> How BH handlers (including TCP timers) and io_uring are going to run > > >>>>> safely ? Even if a tcp socket had one user, (private fd opened by a > > >>>>> non multi-threaded program), we would still to use the spinlock. > > >>>> > > >>>> But we don't even hold the spinlock over lock_sock() and release_sock(), > > >>>> just the mutex. And we do check for running eg the backlog on release, > > >>>> which I believe is done safely and similarly in other places too. > > >>> > > >>> So lets say TCP stack receives a packet in BH handler... it proceeds > > >>> using many tcp sock fields. > > >>> > > >>> Then io_uring wants to read/write stuff from another cpu, while BH > > >>> handler(s) is(are) not done yet, > > >>> and will happily read/change many of the same fields > > >> > > >> But how is that currently protected? > > > > > > It is protected by current code. > > > > > > What you wrote would break TCP stack quite badly. > > > > No offense, but your explanations are severely lacking. By "current > > code"? So what you're saying is that it's protected by how the code > > currently works? From how that it currently is? Yeah, that surely > > explains it. > > > > > I suggest you setup/run a syzbot server/farm, then you will have a > > > hundred reports quite easily. > > > > Nowhere am I claiming this is currently perfect, and it should have had > > an RFC on it. Was hoping for some constructive criticism on how to move > > this forward, as high frequency TCP currently _sucks_ in the stack. > > Instead I get useless replies, not very encouraging. > > > > I've run this quite extensively on just basic send/receive over sockets, > > so it's not like it hasn't been run at all. And it's been fine so far, > > no ill effects observed. If we need to tighten down the locking, perhaps > > a valid use would be to simply skip the mutex and retain the bh lock for > > setting owner. As far as I can tell, should still be safe to skip on > > release, except if we need to process the backlog. And it'd serialize > > the owner setting with the BH, which seems to be your main objection in. > > Mostly guessing here, based on the in-depth replies. > > > > But it'd be nice if we could have a more constructive dialogue about > > this, rather than the weird dismisiveness. > > > > > > Sure. It would be nice that I have not received such a patch series > the day I am sick. > > Jakub, David, Paolo, please provide details to Jens, thanks. FYI, include/net/sock.h has this comment, which has been served for 20+ years just fine. /* Used by processes to "lock" a socket state, so that * interrupts and bottom half handlers won't change it * from under us. It essentially blocks any incoming * packets, so that we won't get any new data or any * packets that change the state of the socket. * * While locked, BH processing will add new packets to * the backlog queue. This queue is processed by the * owner of the socket lock right before it is released. * * Since ~2.3.5 it is also exclusive sleep lock serializing * accesses from user process context. */
On 4/12/22 8:19 PM, Eric Dumazet wrote: > On Tue, Apr 12, 2022 at 7:12 PM Jens Axboe <axboe@kernel.dk> wrote: >> >> On 4/12/22 8:05 PM, Eric Dumazet wrote: >>> On Tue, Apr 12, 2022 at 7:01 PM Jens Axboe <axboe@kernel.dk> wrote: >>>> >>>> On 4/12/22 7:54 PM, Eric Dumazet wrote: >>>>> On Tue, Apr 12, 2022 at 6:26 PM Jens Axboe <axboe@kernel.dk> wrote: >>>>>> >>>>>> On 4/12/22 6:40 PM, Eric Dumazet wrote: >>>>>>> >>>>>>> On 4/12/22 13:26, Jens Axboe wrote: >>>>>>>> Hi, >>>>>>>> >>>>>>>> If we accept a connection directly, eg without installing a file >>>>>>>> descriptor for it, or if we use IORING_OP_SOCKET in direct mode, then >>>>>>>> we have a socket for recv/send that we can fully serialize access to. >>>>>>>> >>>>>>>> With that in mind, we can feasibly skip locking on the socket for TCP >>>>>>>> in that case. Some of the testing I've done has shown as much as 15% >>>>>>>> of overhead in the lock_sock/release_sock part, with this change then >>>>>>>> we see none. >>>>>>>> >>>>>>>> Comments welcome! >>>>>>>> >>>>>>> How BH handlers (including TCP timers) and io_uring are going to run >>>>>>> safely ? Even if a tcp socket had one user, (private fd opened by a >>>>>>> non multi-threaded program), we would still to use the spinlock. >>>>>> >>>>>> But we don't even hold the spinlock over lock_sock() and release_sock(), >>>>>> just the mutex. And we do check for running eg the backlog on release, >>>>>> which I believe is done safely and similarly in other places too. >>>>> >>>>> So lets say TCP stack receives a packet in BH handler... it proceeds >>>>> using many tcp sock fields. >>>>> >>>>> Then io_uring wants to read/write stuff from another cpu, while BH >>>>> handler(s) is(are) not done yet, >>>>> and will happily read/change many of the same fields >>>> >>>> But how is that currently protected? >>> >>> It is protected by current code. >>> >>> What you wrote would break TCP stack quite badly. >> >> No offense, but your explanations are severely lacking. By "current >> code"? So what you're saying is that it's protected by how the code >> currently works? From how that it currently is? Yeah, that surely >> explains it. >> >>> I suggest you setup/run a syzbot server/farm, then you will have a >>> hundred reports quite easily. >> >> Nowhere am I claiming this is currently perfect, and it should have had >> an RFC on it. Was hoping for some constructive criticism on how to move >> this forward, as high frequency TCP currently _sucks_ in the stack. >> Instead I get useless replies, not very encouraging. >> >> I've run this quite extensively on just basic send/receive over sockets, >> so it's not like it hasn't been run at all. And it's been fine so far, >> no ill effects observed. If we need to tighten down the locking, perhaps >> a valid use would be to simply skip the mutex and retain the bh lock for >> setting owner. As far as I can tell, should still be safe to skip on >> release, except if we need to process the backlog. And it'd serialize >> the owner setting with the BH, which seems to be your main objection in. >> Mostly guessing here, based on the in-depth replies. >> >> But it'd be nice if we could have a more constructive dialogue about >> this, rather than the weird dismisiveness. >> >> > > Sure. It would be nice that I have not received such a patch series > the day I am sick. I'm sorry that you are sick - but if you are not in a state to reply, then please just don't. It sets a bad example. It was sent to the list, not to you personally. Don't check email then, putting the blame on ME for posting a patchset while you are sick is uncalled for and rude. If I had a crystal ball, I would not be spending my time working on the kernel. You know what would've been a better idea? Replying that you are sick and that you are sorry for being an ass on the mailing list. > Jakub, David, Paolo, please provide details to Jens, thanks. There's no rush here fwiw - I'm heading out on PTO rest of the week, so we can pick this back up when I get back. I'll check in on emails, but activity will be sparse.
On Tue, Apr 12, 2022 at 7:27 PM Jens Axboe <axboe@kernel.dk> wrote: > > On 4/12/22 8:19 PM, Eric Dumazet wrote: > > On Tue, Apr 12, 2022 at 7:12 PM Jens Axboe <axboe@kernel.dk> wrote: > >> > >> On 4/12/22 8:05 PM, Eric Dumazet wrote: > >>> On Tue, Apr 12, 2022 at 7:01 PM Jens Axboe <axboe@kernel.dk> wrote: > >>>> > >>>> On 4/12/22 7:54 PM, Eric Dumazet wrote: > >>>>> On Tue, Apr 12, 2022 at 6:26 PM Jens Axboe <axboe@kernel.dk> wrote: > >>>>>> > >>>>>> On 4/12/22 6:40 PM, Eric Dumazet wrote: > >>>>>>> > >>>>>>> On 4/12/22 13:26, Jens Axboe wrote: > >>>>>>>> Hi, > >>>>>>>> > >>>>>>>> If we accept a connection directly, eg without installing a file > >>>>>>>> descriptor for it, or if we use IORING_OP_SOCKET in direct mode, then > >>>>>>>> we have a socket for recv/send that we can fully serialize access to. > >>>>>>>> > >>>>>>>> With that in mind, we can feasibly skip locking on the socket for TCP > >>>>>>>> in that case. Some of the testing I've done has shown as much as 15% > >>>>>>>> of overhead in the lock_sock/release_sock part, with this change then > >>>>>>>> we see none. > >>>>>>>> > >>>>>>>> Comments welcome! > >>>>>>>> > >>>>>>> How BH handlers (including TCP timers) and io_uring are going to run > >>>>>>> safely ? Even if a tcp socket had one user, (private fd opened by a > >>>>>>> non multi-threaded program), we would still to use the spinlock. > >>>>>> > >>>>>> But we don't even hold the spinlock over lock_sock() and release_sock(), > >>>>>> just the mutex. And we do check for running eg the backlog on release, > >>>>>> which I believe is done safely and similarly in other places too. > >>>>> > >>>>> So lets say TCP stack receives a packet in BH handler... it proceeds > >>>>> using many tcp sock fields. > >>>>> > >>>>> Then io_uring wants to read/write stuff from another cpu, while BH > >>>>> handler(s) is(are) not done yet, > >>>>> and will happily read/change many of the same fields > >>>> > >>>> But how is that currently protected? > >>> > >>> It is protected by current code. > >>> > >>> What you wrote would break TCP stack quite badly. > >> > >> No offense, but your explanations are severely lacking. By "current > >> code"? So what you're saying is that it's protected by how the code > >> currently works? From how that it currently is? Yeah, that surely > >> explains it. > >> > >>> I suggest you setup/run a syzbot server/farm, then you will have a > >>> hundred reports quite easily. > >> > >> Nowhere am I claiming this is currently perfect, and it should have had > >> an RFC on it. Was hoping for some constructive criticism on how to move > >> this forward, as high frequency TCP currently _sucks_ in the stack. > >> Instead I get useless replies, not very encouraging. > >> > >> I've run this quite extensively on just basic send/receive over sockets, > >> so it's not like it hasn't been run at all. And it's been fine so far, > >> no ill effects observed. If we need to tighten down the locking, perhaps > >> a valid use would be to simply skip the mutex and retain the bh lock for > >> setting owner. As far as I can tell, should still be safe to skip on > >> release, except if we need to process the backlog. And it'd serialize > >> the owner setting with the BH, which seems to be your main objection in. > >> Mostly guessing here, based on the in-depth replies. > >> > >> But it'd be nice if we could have a more constructive dialogue about > >> this, rather than the weird dismisiveness. > >> > >> > > > > Sure. It would be nice that I have not received such a patch series > > the day I am sick. > > I'm sorry that you are sick - but if you are not in a state to reply, > then please just don't. It sets a bad example. It was sent to the list, > not to you personally. I tried to be as constructive as possible, and Jakub pinged me about this series, so I really thought Jakub was okay with it. So I am a bit concerned. > > Don't check email then, putting the blame on ME for posting a patchset > while you are sick is uncalled for and rude. If I had a crystal ball, I > would not be spending my time working on the kernel. You know what > would've been a better idea? Replying that you are sick and that you are > sorry for being an ass on the mailing list. Wow. > > > Jakub, David, Paolo, please provide details to Jens, thanks. > > There's no rush here fwiw - I'm heading out on PTO rest of the week, > so we can pick this back up when I get back. I'll check in on emails, > but activity will be sparse. > > -- > Jens Axboe >
On 4/12/22 8:32 PM, Eric Dumazet wrote: > On Tue, Apr 12, 2022 at 7:27 PM Jens Axboe <axboe@kernel.dk> wrote: >> >> On 4/12/22 8:19 PM, Eric Dumazet wrote: >>> On Tue, Apr 12, 2022 at 7:12 PM Jens Axboe <axboe@kernel.dk> wrote: >>>> >>>> On 4/12/22 8:05 PM, Eric Dumazet wrote: >>>>> On Tue, Apr 12, 2022 at 7:01 PM Jens Axboe <axboe@kernel.dk> wrote: >>>>>> >>>>>> On 4/12/22 7:54 PM, Eric Dumazet wrote: >>>>>>> On Tue, Apr 12, 2022 at 6:26 PM Jens Axboe <axboe@kernel.dk> wrote: >>>>>>>> >>>>>>>> On 4/12/22 6:40 PM, Eric Dumazet wrote: >>>>>>>>> >>>>>>>>> On 4/12/22 13:26, Jens Axboe wrote: >>>>>>>>>> Hi, >>>>>>>>>> >>>>>>>>>> If we accept a connection directly, eg without installing a file >>>>>>>>>> descriptor for it, or if we use IORING_OP_SOCKET in direct mode, then >>>>>>>>>> we have a socket for recv/send that we can fully serialize access to. >>>>>>>>>> >>>>>>>>>> With that in mind, we can feasibly skip locking on the socket for TCP >>>>>>>>>> in that case. Some of the testing I've done has shown as much as 15% >>>>>>>>>> of overhead in the lock_sock/release_sock part, with this change then >>>>>>>>>> we see none. >>>>>>>>>> >>>>>>>>>> Comments welcome! >>>>>>>>>> >>>>>>>>> How BH handlers (including TCP timers) and io_uring are going to run >>>>>>>>> safely ? Even if a tcp socket had one user, (private fd opened by a >>>>>>>>> non multi-threaded program), we would still to use the spinlock. >>>>>>>> >>>>>>>> But we don't even hold the spinlock over lock_sock() and release_sock(), >>>>>>>> just the mutex. And we do check for running eg the backlog on release, >>>>>>>> which I believe is done safely and similarly in other places too. >>>>>>> >>>>>>> So lets say TCP stack receives a packet in BH handler... it proceeds >>>>>>> using many tcp sock fields. >>>>>>> >>>>>>> Then io_uring wants to read/write stuff from another cpu, while BH >>>>>>> handler(s) is(are) not done yet, >>>>>>> and will happily read/change many of the same fields >>>>>> >>>>>> But how is that currently protected? >>>>> >>>>> It is protected by current code. >>>>> >>>>> What you wrote would break TCP stack quite badly. >>>> >>>> No offense, but your explanations are severely lacking. By "current >>>> code"? So what you're saying is that it's protected by how the code >>>> currently works? From how that it currently is? Yeah, that surely >>>> explains it. >>>> >>>>> I suggest you setup/run a syzbot server/farm, then you will have a >>>>> hundred reports quite easily. >>>> >>>> Nowhere am I claiming this is currently perfect, and it should have had >>>> an RFC on it. Was hoping for some constructive criticism on how to move >>>> this forward, as high frequency TCP currently _sucks_ in the stack. >>>> Instead I get useless replies, not very encouraging. >>>> >>>> I've run this quite extensively on just basic send/receive over sockets, >>>> so it's not like it hasn't been run at all. And it's been fine so far, >>>> no ill effects observed. If we need to tighten down the locking, perhaps >>>> a valid use would be to simply skip the mutex and retain the bh lock for >>>> setting owner. As far as I can tell, should still be safe to skip on >>>> release, except if we need to process the backlog. And it'd serialize >>>> the owner setting with the BH, which seems to be your main objection in. >>>> Mostly guessing here, based on the in-depth replies. >>>> >>>> But it'd be nice if we could have a more constructive dialogue about >>>> this, rather than the weird dismisiveness. >>>> >>>> >>> >>> Sure. It would be nice that I have not received such a patch series >>> the day I am sick. >> >> I'm sorry that you are sick - but if you are not in a state to reply, >> then please just don't. It sets a bad example. It was sent to the list, >> not to you personally. > > I tried to be as constructive as possible, and Jakub pinged me about Are you serious?! I don't think I've ever received less constructive feedback in 20+ years of working on the kernel. > this series, > so I really thought Jakub was okay with it. > > So I am a bit concerned. I did show it to Jakub a week or so ago, probably that was why. But why the concern?! It's just a patchseries proposed for discussion. Something that happens every day. >> Don't check email then, putting the blame on ME for posting a patchset >> while you are sick is uncalled for and rude. If I had a crystal ball, I >> would not be spending my time working on the kernel. You know what >> would've been a better idea? Replying that you are sick and that you are >> sorry for being an ass on the mailing list. > > Wow. Putting the blame on me for your emails, since I posted a patchset while you're sick, is just rude.
On Tue, Apr 12, 2022 at 08:01:10PM -0600, Jens Axboe wrote: >On 4/12/22 7:54 PM, Eric Dumazet wrote: >> On Tue, Apr 12, 2022 at 6:26 PM Jens Axboe <axboe@kernel.dk> wrote: >>> >>> On 4/12/22 6:40 PM, Eric Dumazet wrote: >>>> >>>> On 4/12/22 13:26, Jens Axboe wrote: >>>>> Hi, >>>>> >>>>> If we accept a connection directly, eg without installing a file >>>>> descriptor for it, or if we use IORING_OP_SOCKET in direct mode, then >>>>> we have a socket for recv/send that we can fully serialize access to. >>>>> >>>>> With that in mind, we can feasibly skip locking on the socket for TCP >>>>> in that case. Some of the testing I've done has shown as much as 15% >>>>> of overhead in the lock_sock/release_sock part, with this change then >>>>> we see none. >>>>> >>>>> Comments welcome! >>>>> >>>> How BH handlers (including TCP timers) and io_uring are going to run >>>> safely ? Even if a tcp socket had one user, (private fd opened by a >>>> non multi-threaded program), we would still to use the spinlock. >>> >>> But we don't even hold the spinlock over lock_sock() and release_sock(), >>> just the mutex. And we do check for running eg the backlog on release, >>> which I believe is done safely and similarly in other places too. >> >> So lets say TCP stack receives a packet in BH handler... it proceeds >> using many tcp sock fields. >> >> Then io_uring wants to read/write stuff from another cpu, while BH >> handler(s) is(are) not done yet, >> and will happily read/change many of the same fields > >But how is that currently protected? The bh spinlock is only held >briefly while locking the socket, and ditto on the relase. Outside of >that, the owner field is used. At least as far as I can tell. I'm >assuming the mutex exists solely to serialize acess to eg send/recv on >the system call side. Hi jens, I personally like the idea of using iouring to improve the performance of the socket API. AFAIU, the bh spinlock will be held by the BH when trying to make changes to those protected fields on the socket, and the userspace will try to hold that spinlock before it can change the sock lock owner field. For example: in tcp_v4_rcv() we have bh_lock_sock_nested(sk); tcp_segs_in(tcp_sk(sk), skb); ret = 0; if (!sock_owned_by_user(sk)) { ret = tcp_v4_do_rcv(sk, skb); } else { if (tcp_add_backlog(sk, skb, &drop_reason)) goto discard_and_relse; } bh_unlock_sock(sk); When this is called in the BH, it will first hold the bh spinlock and then check the owner field, tcp_v4_do_rcv() will always been protected by the bh spinlock. If the user thread tries to make changes to the socket, it first call lock_sock() which will also try to hold the bh spinlock, I think that prevent the race. void lock_sock_nested(struct sock *sk, int subclass) { /* The sk_lock has mutex_lock() semantics here. */ mutex_acquire(&sk->sk_lock.dep_map, subclass, 0, _RET_IP_); might_sleep(); spin_lock_bh(&sk->sk_lock.slock); if (sock_owned_by_user_nocheck(sk)) __lock_sock(sk); sk->sk_lock.owned = 1; spin_unlock_bh(&sk->sk_lock.slock); } But if we remove the spinlock in the lock_sock() when sk_no_lock is set to true. When the the bh spinlock is already held by the BH, it seems the userspace won't respect that anymore ? Maybe I missed something too... > >Hence if we can just make the owner check/set sane, then it would seem >to be that it'd work just fine. Unless I'm still missing something here. > >> Writing a 1 and a 0 in a bit field to ensure mutual exclusion is not >> going to work, >> even with the smp_rmb() and smp_wmb() you added (adding more costs for >> non io_uring users >> which already pay a high lock tax) > >Right, that's what the set was supposed to improve :-) > >In all fairness, the rmb/wmb doesn't even measure compared to the >current socket locking, so I highly doubt that any high frequency TCP >would notice _any_ difference there. It's dwarfed by fiddling the mutex >and spinlock already. > >But I agree, it may not be 100% bullet proof. May need actual bitops to >be totally safe. Outside of that, I'm still failing to see what kind of >mutual exclusion exists between BH handlers and a system call doing a >send or receive on the socket. > >> If we want to optimize the lock_sock()/release_sock() for common cases >> (a single user thread per TCP socket), >> then maybe we can play games with some kind of cmpxchg() games, but >> that would be a generic change. > >Sure, not disagreeing on that, but you'd supposedly still need the mutex >to serialize send or receives on the socket for those cases. > >-- >Jens Axboe
On Wed, 2022-04-13 at 13:23 +0800, dust.li wrote: > On Tue, Apr 12, 2022 at 08:01:10PM -0600, Jens Axboe wrote: > > On 4/12/22 7:54 PM, Eric Dumazet wrote: > > > On Tue, Apr 12, 2022 at 6:26 PM Jens Axboe <axboe@kernel.dk> wrote: > > > > > > > > On 4/12/22 6:40 PM, Eric Dumazet wrote: > > > > > > > > > > On 4/12/22 13:26, Jens Axboe wrote: > > > > > > Hi, > > > > > > > > > > > > If we accept a connection directly, eg without installing a file > > > > > > descriptor for it, or if we use IORING_OP_SOCKET in direct mode, then > > > > > > we have a socket for recv/send that we can fully serialize access to. > > > > > > > > > > > > With that in mind, we can feasibly skip locking on the socket for TCP > > > > > > in that case. Some of the testing I've done has shown as much as 15% > > > > > > of overhead in the lock_sock/release_sock part, with this change then > > > > > > we see none. > > > > > > > > > > > > Comments welcome! > > > > > > > > > > > How BH handlers (including TCP timers) and io_uring are going to run > > > > > safely ? Even if a tcp socket had one user, (private fd opened by a > > > > > non multi-threaded program), we would still to use the spinlock. > > > > > > > > But we don't even hold the spinlock over lock_sock() and release_sock(), > > > > just the mutex. And we do check for running eg the backlog on release, > > > > which I believe is done safely and similarly in other places too. > > > > > > So lets say TCP stack receives a packet in BH handler... it proceeds > > > using many tcp sock fields. > > > > > > Then io_uring wants to read/write stuff from another cpu, while BH > > > handler(s) is(are) not done yet, > > > and will happily read/change many of the same fields > > > > But how is that currently protected? The bh spinlock is only held > > briefly while locking the socket, and ditto on the relase. Outside of > > that, the owner field is used. At least as far as I can tell. I'm > > assuming the mutex exists solely to serialize acess to eg send/recv on > > the system call side. > > Hi jens, > > I personally like the idea of using iouring to improve the performance > of the socket API. > > AFAIU, the bh spinlock will be held by the BH when trying to make > changes to those protected fields on the socket, and the userspace > will try to hold that spinlock before it can change the sock lock > owner field. > > For example: > in tcp_v4_rcv() we have > > bh_lock_sock_nested(sk); > tcp_segs_in(tcp_sk(sk), skb); > ret = 0; > if (!sock_owned_by_user(sk)) { > ret = tcp_v4_do_rcv(sk, skb); > } else { > if (tcp_add_backlog(sk, skb, &drop_reason)) > goto discard_and_relse; > } > bh_unlock_sock(sk); > > When this is called in the BH, it will first hold the bh spinlock > and then check the owner field, tcp_v4_do_rcv() will always been > protected by the bh spinlock. > > If the user thread tries to make changes to the socket, it first > call lock_sock() which will also try to hold the bh spinlock, I > think that prevent the race. > > void lock_sock_nested(struct sock *sk, int subclass) > { > /* The sk_lock has mutex_lock() semantics here. */ > mutex_acquire(&sk->sk_lock.dep_map, subclass, 0, _RET_IP_); > > might_sleep(); > spin_lock_bh(&sk->sk_lock.slock); > if (sock_owned_by_user_nocheck(sk)) > __lock_sock(sk); > sk->sk_lock.owned = 1; > spin_unlock_bh(&sk->sk_lock.slock); > } > > But if we remove the spinlock in the lock_sock() when sk_no_lock > is set to true. When the the bh spinlock is already held by the BH, > it seems the userspace won't respect that anymore ? Exactly, with sk_no_lock we will have the following race: [BH/timer on CPU 0] [ reader/writer on CPU 1] bh_lock_sock_nested(sk); // owned is currently 0 if (!sock_owned_by_user(sk)) { // modify sk state if (sk->sk_no_lock) { sk->sk_lock.owned = 1; smp_wmb(); // still touching sk state // cuncurrently modify sk state // sk is corrupted We need both the sk spinlock and the 'owned' bit to ensure mutually exclusive access WRT soft interrupts. I personally don't see any way to fix the above without the sk spinlock - or an equivalent contended atomic operation. Additionally these changes add relevant overhead for the !sk_no_lock case - the additional memory barriers and conditionals - which will impact most/all existing users. Touching a very fundamental and internal piece of the core networking, corrently extremelly stable, similar changes will require a very extensive testing, comprising benchmarking for the current/!sk_no_lock code paths with different workloads and additional self-tests. Thanks. Paolo