Re: [PATCHSET 0/4] Add support for no-lock sockets

[Eric Dumazet <edumazet@google.com>]

On Tue, Apr 12, 2022 at 7:01 PM Jens Axboe <axboe@kernel.dk> wrote:
>
> On 4/12/22 7:54 PM, Eric Dumazet wrote:
> > On Tue, Apr 12, 2022 at 6:26 PM Jens Axboe <axboe@kernel.dk> wrote:
> >>
> >> On 4/12/22 6:40 PM, Eric Dumazet wrote:
> >>>
> >>> On 4/12/22 13:26, Jens Axboe wrote:
> >>>> Hi,
> >>>>
> >>>> If we accept a connection directly, eg without installing a file
> >>>> descriptor for it, or if we use IORING_OP_SOCKET in direct mode, then
> >>>> we have a socket for recv/send that we can fully serialize access to.
> >>>>
> >>>> With that in mind, we can feasibly skip locking on the socket for TCP
> >>>> in that case. Some of the testing I've done has shown as much as 15%
> >>>> of overhead in the lock_sock/release_sock part, with this change then
> >>>> we see none.
> >>>>
> >>>> Comments welcome!
> >>>>
> >>> How BH handlers (including TCP timers) and io_uring are going to run
> >>> safely ? Even if a tcp socket had one user, (private fd opened by a
> >>> non multi-threaded program), we would still to use the spinlock.
> >>
> >> But we don't even hold the spinlock over lock_sock() and release_sock(),
> >> just the mutex. And we do check for running eg the backlog on release,
> >> which I believe is done safely and similarly in other places too.
> >
> > So lets say TCP stack receives a packet in BH handler... it proceeds
> > using many tcp sock fields.
> >
> > Then io_uring wants to read/write stuff from another cpu, while BH
> > handler(s) is(are) not done yet,
> > and will happily read/change many of the same fields
>
> But how is that currently protected?

It is protected by current code.

What you wrote would break TCP stack quite badly.

I suggest you setup/run a syzbot server/farm, then you will have a
hundred reports quite easily.


 The bh spinlock is only held
> briefly while locking the socket, and ditto on the relase.

The 'briefly' is exactly what is needed to ensure exclusion between BH
and the user thread.

Yes, this is unfortunate but this is what it is.

 Outside of
> that, the owner field is used. At least as far as I can tell. I'm
> assuming the mutex exists solely to serialize acess to eg send/recv on
> the system call side.
>
> Hence if we can just make the owner check/set sane, then it would seem
> to be that it'd work just fine. Unless I'm still missing something here.
>
> > Writing a 1 and a 0 in a bit field to ensure mutual exclusion is not
> > going to work,
> > even with the smp_rmb() and smp_wmb() you added (adding more costs for
> > non io_uring users
> > which already pay a high lock tax)
>
> Right, that's what the set was supposed to improve :-)
>
> In all fairness, the rmb/wmb doesn't even measure compared to the
> current socket locking, so I highly doubt that any high frequency TCP
> would notice _any_ difference there. It's dwarfed by fiddling the mutex
> and spinlock already.
>
> But I agree, it may not be 100% bullet proof. May need actual bitops to
> be totally safe. Outside of that, I'm still failing to see what kind of
> mutual exclusion exists between BH handlers and a system call doing a
> send or receive on the socket.
>
> > If we want to optimize the lock_sock()/release_sock() for common cases
> > (a single user thread per TCP socket),
> > then maybe we can play games with some kind of cmpxchg() games, but
> > that would be a generic change.
>
> Sure, not disagreeing on that, but you'd supposedly still need the mutex
> to serialize send or receives on the socket for those cases.
>
> --
> Jens Axboe
>