EINTR and PC Loser-Ing: The “Worse Is Better” Case Study (2011)

http://blog.reverberate.org/2011/04/eintr-and-pc-loser-ing-is-better-case.html

by akkartik • 7 years ago

62 72 7 years ago

blog.reverberate.org

gwern• 7 years ago

"The "worse" system (Unix) did indeed do "the right thing" eventually, even if it didn't at first. "Worse is better" systems incrementally improve by responding to user needs. Since users got tired of checking for EINTR, the "worse" system added the functionality for addressing this pain point. The whole thing did leave a rather large wart, though"

Which of course is exactly what RPG predicts about 'worse' systems: after a lot of pain, they will gradually evolve into doing the right thing, but probably never as well as if they had been correctly conceived from the start.

klodolph• 7 years ago

And the “better” systems don’t get a chance to evolve into the right thing, because while you can kludge together a fix for something that’s broken, it’s much harder to remove an unnecessary or extraneous feature.

That, and the “worse” systems have been on the market for nine months by the time the better systems are available. I try to err on the side of underengineering systems, as long as there are no lives on the line.

c256• 7 years ago

I think I understand what you’re trying to say, it the UNIX/New Jersey approach came much later than the MIT/ITS approach. The conversation happened (if I recall correctly) because the ITS approach required more architecture-specific changes (to revert/restore state), while the later UNIX approach was quickly ported to new architectures. The ITS people were effectively asking “how’d you manage to handle this gnarly thing so quickly, so often.”, and the UNIX people’s response was “we punted”.

iiirogers• 7 years ago

Discussion on EINTR wrt close in Linux: https://lwn.net/Articles/576478/

Glibc shows use with TEMP_FAILURE_RETRY: https://www.gnu.org/software/libc/manual/html_node/Opening-a...

Using TEMP_FAILURE_RETRY when close always deallocates the fd will at best get EBADF, at worse you close a random file descriptor.

mcculley3• 7 years ago

This is the best example of how bad EINTR is as a design, in my opinion. I was painfully aware of how hard it is to write correct code when dealing with interruptible system calls, but even I didn't know that close() could potentially be interrupted.

jstimpfle13• 7 years ago

It's not hard to write correct code in the face of EINTR. You can simply try again. Or just use libc (or another language's wrapper).

There is a real need for interrupts during a "slow" system call. I much prefer EINTR to sth. like completion ports. EINTR is simple and usable. (I don't understand well enough the problems around interrupted close())

teddyh• 7 years ago

You don’t always need TEMP_FAILURE_RETRY:

https://www.gnu.org/software/libc/manual/html_node/Interrupt...

Summary: If you define ‘_BSD_SOURCE’ or ‘_GNU_SOURCE’ before calling ‘signal’, you never get EINTR. If you use ‘sigaction’ to establish a signal handler, you can specify how that handler should behave. If you specify the 'SA_RESTART' flag, return from that handler will resume a primitive instead of returning with EINTR.

xenadu02• 7 years ago

A decent number of theoretically interruptible system calls don’t actually get interrupted (or automatically retry) regardless of the signal settings because no one bothers to check for it and the calls are cheap.

Honestly only IO really has any excuse for supporting this sort of behavior.

toast0• 7 years ago

That you can interrupt long running system calls with a signal provides a way to add a timeout to system calls that may (or probably will) block, by scheduling a timer signal with alarm or setitimer in advance of the possibly time consuming system call. Which is more clear is certainly up for debate, of course. Additionally, that break sends an interrupt signal also allows the user to bail out of long running system calls and at least potentially get back a responsive system.

zAy0LfpBZLC8mAC• 7 years ago

No, you can't, because that strategy has a race codition.

jschwartzi• 7 years ago

You should really explain what that race condition is.

amluto2• 7 years ago

There is a genuine complication that this post seems to have missed. If a system call is interrupted and returns to user space (due to a signal, most likely), then it is in one of three states: nothing happened, the call finished, or it is part-way done. If nothing happened, then PC can point back to the syscall or EINTR can be returned. (EINTR is a promise that no progress was made.) If it’s all done, it can return success. But, if it’s only part way done, then either it needs to restart transparently or the user code needs to be prepared to handle this.

With recv(), for example, the return value can indicate that some but not all bytes were read. When read()one from a file, most programs aren’t prepared for partial success.

Linux has some ERESTARTSYS mechanisms to handle some of these cases. The code and the semantics are a bit gross.

gumby• 7 years ago

Came here to post this. The important thing Dick glossed over was that when your process was PCLSRed you were guaranteed what state your program would be in. A guarantee made by ITS before a line of Unix was ever written.

mwcremer• 7 years ago

most programs aren’t prepared for partial success

But read() and write() return the number of bytes actually read or written. So actually they are, or should be...

amluto2• 7 years ago

On a normal file, unless it’s NFS with a special mount option, read() and write() never return partial results, which means that many programs can’t handle it.

Even modern async/await/promise/future systems frequently have no reliable way to express partial success.

daurnimator• 7 years ago

EINTR is a promise that no progress was made.

If only.... on many operating systems, you shouldn't retry close on EINTR, e.g. From [linux man page](http://man7.org/linux/man-pages/man2/close.2.html):

In particular close() should not be retried after an EINTR since this may cause a reused descriptor from another thread to be closed.

Worse, it's different per operating system!

- HP-UX you must try again

- Linux, Solaris and AIX you don't want to try again

- OSX is ill-defined and hence unsafe, you should use `close$nocancel` instead of `close` and _not_ try again.

- http://alobbs.com/post/54503240599/close-and-eintr

- http://www.daemonology.net/blog/2011-12-17-POSIX-close-is-br...

- https://code.google.com/p/chromium/issues/detail?id=269623

- https://github.com/wahern/cqueues/issues/56

- https://github.com/ziglang/zig/issues/2425

wrs• 7 years ago

The Unix side of this comparison is talking about signals, but what is the ITS side talking about? A technical description of that is available at [0].

Another way to state the PCLSRing modularity principle is to say that when a process looks at the program counter of another process, it must always see a User mode PC, never an Exec mode PC. When one process wants to access the state of another process, and the target process happens to be executing in Exec mode, then something must be done in order to put the target process into User mode.

[0] https://hack.org/mc/texts/pclsr.txt

comex• 7 years ago

And to complete the circle, the Unix way for one process to look at another’s program counter, ptrace(), works via signals.

I recently had to implement a version of that behavior when writing a GDB stub for an embedded microkernel. The system in question originally had neither a debugger nor an equivalent of signals, or any other way for system calls (message sends and receives) to be interrupted – so the programs written for it naturally assumed they wouldn’t be, and didn’t have any code to retry interrupted operations. I could have gone through and changed those programs, but it would have been a lot of work and easy to get wrong. Instead, just as described in that link, I had the GDB stub set the PC to point back to the system call instruction, so it would be restarted after continuing the thread, and adjust the argument registers if necessary (e.g. if a combined message send+receive operation was interrupted after the send but before the receive, the arguments had to be changed to request only a receive). This was made more difficult by the fact that the microkernel originally threw away some of those register values, in the name of efficiency, assuming they wouldn’t be needed once the system call had started…

emtel• 7 years ago

"worse is better" seems to be born out again and again and again. In fact it's fairly hard to find cases where "do the right thing" won. Here's some examples where a clearly flawed technology became totally dominant.

  * Unix
  * The C language
  * DOS and Windows
  * Javascript
  * The x86 instruction set.

And here are some cases where dominance was achieved in a more narrow market, or in which one might argue about which technology was "worse", or where its not totally clear which was the winner.

  * Linux/SysV vs any of the BSDs
  * Ethernet vs ATM, SONET, etc.
  * Android vs iOS
  * MySQL vs Postgres (Postgres is having a renaissance, but for a long time mysql was very dominant)

What is also especially striking is how often "The Right Thing" in programming languages seems to lose, whereby "lose" I mean "have a very small fraction of market share despite almost everyone agreeing that the language is better in almost every way to more widely-used languages like C/C++, Java, etc."

  * LISP and Scheme
  * The whole ML family
  * Haskell
  * Rust (although its soon to tell on this one)

Meanwhile, languages that aren't obviously terrible, but have major flaws, like Java and Python, are ubiquitous, and the dumpster-fire languages Perl and PHP have enjoyed massive success.

TickleSteve• 7 years ago

That's likely because the criteria to be judged as "better" is likely from an academic basis.

Academia generally does not produce products. Products are generally produced by pragmatic engineers & developers. Academically 'better' does not equate to 'better' for "getting shit done".

This just emphasises how different academia is from real product development.

jstimpfle13• 7 years ago

My impression is that there are various, even contradicting understandings and opinions in the wild what "worse is better" actually means. Rarely do people who interpret it in a cynical way demonstrate a good understanding of the total set of qualities that matter for the success of a technology.

If you think LISP or Haskell are without flaws (despite all the years of hype), then... you're wrong.

lisper10• 7 years ago

It's not that they are without flaws, it's that it is a lot easier to fix/ignore/work-around the flaws than in other languages, where the flaws are unchangeable (except by the standards committee) and constantly in your face.

msla• 7 years ago

Ethernet vs ATM, SONET, etc.

I'm not convinced Ethernet and ATM are going for entirely the same markets. I've never heard of SOHO ATM, at any rate. Really, Ethernet faced off with Token Ring, which has good features (guaranteed bandwidth, for one) compared to unswitched Ethernet, which is pretty much a dead technology at this point.

Linux/SysV

Linux isn't System V, it's POSIX. That sounds like a cop-out, but Linux, one, has no code from any System V systems, and, two, doesn't feel like System V. If anything, it feels like GNU, which is a lot more featureful than System V ever was. (Compare Solaris to most Linux distros, for example.) And if we're going to say System V... well, the BSDs still exist, and Solaris was the last of the classic System V OSes in anything like widespread use. And even Solaris/SunOS wasn't pure System V, was it?

The x86 instruction set.

Making good use of cache turned out to be much more important than ease of decoding, and having a Huffman-coded machine code is a good way to do that. Plus, the x86 ISA isn't weird in some ways the RISC ISAs which tried to displace it were: It has no branch delay slots, it has multiplication and division opcodes which work like normal opcodes, it can load immediates into a register without a lot of contortion, it's reasonably friendly to unaligned memory accesses... Really, x86 is only bad in a rather narrow analysis.

basementcat• 7 years ago

* The English language

userbinator• 7 years ago

LISP and Scheme

Look at how much the first Lisp machines cost, and how utterly slow they were for that price relative to other hardware of the time.

In turns out that in the real world, abstract notions of academic purity are nearly worthless, and efficiency/performance matters a lot.

lispm• 7 years ago

how utterly slow they were for that price relative to other hardware of the time

examples?

lizmat• 7 years ago

Perhaps because there's more money to be made with "worse" languages? You can make more money in language A if something takes a day in language A, and only an hour in language B, at similar cognitive load.

ncmncm5• 7 years ago

Well, yes. That was really the core of the complaint, but nobody would read complaints about The Almighty Dollar then, any more than now, so it had to be wrapped up in techno-morality.

ts4z• 7 years ago

http://wiki.c2.com/?DanWeinreb Dan Weinreb was the MIT guy; Bill Joy was the Unix partisan. Before he passed away, Dan's blog had his side of this story; unfortunately, I can't find it now. Fortunately WikiWikiWeb knows a little!

Edit: found it! https://web.archive.org/web/20121107034606/http://danweinreb...

larrik• 7 years ago

I'm confused why the guy from Berkley (in CA) originally from Michigan is suddenly referred to as "the New Jersey guy".

gwking• 7 years ago

My guess is that Bell Labs is in New Jersey.

LukeShu• 7 years ago

The essay being quoted compares two design philosophies, the MIT approach:

I will call the use of this philosophy of design the ``MIT approach.'' Common Lisp (with CLOS) and Scheme represent the MIT approach to design and implementation.

and the New Jersey approach:

Early Unix and C are examples of the use of this school of design, and I will call the use of this design strategy the ``New Jersey approach.''

(Unix came out of Bell Labs, which is in Murray Hill, New Jersey.)

When the anonymized Bill Joy is introduced, it is written that he is "from Berkeley (but working on Unix)". That parenthetical is important because it establishes him as working under the New Jersey approach (and possibly working with people in New Jersey), and therefore as being a "New Jersey guy", despite not physically being located there.

ansible• 7 years ago

In general I think that programs using the POSIX API to deal with system calls, threads, and signals is unnecessarily hard to do correctly. Especially if you want good performance.

I'd welcome some completely new operating system API that guides programmers towards correct and efficient solutions, rather than leaving numerous pitfalls that may only be discovered after the software is put into production.

jforberg2• 7 years ago

This discussion seems to ignore the fact that being blocked in a "long-running system call" is the normal state for many (most?) Unix services.

If you look at `ps ax` on your system, you'll likely see about a hundred processes. But if you look at `top`, you'll see only a handful of processes having non-zero CPU usage. Why? Because most processes are just waiting (in a system call) for something to do. A web server is blocked in a select/poll/epoll() call waiting for a connection. Your shell is blocked in a read() call waiting for you to type something. This is just the normal way that a main loop is implemented on Unix.

When you kill one of these processes, they need a way to break out of their loop and with the EINTR approach, they get a chance to break and exit.

I'm far from convinced that a "majority" of services want to just catch signals and carry on.

haberman2• 7 years ago

Correct me if I'm wrong, but I think if you kill a process normally, it will invoke a signal handler which will exit the process (maybe writing a core file first) without ever returning to normal program flow.

Recognizing EINTR at the program level isn't required for this kind of shutdown. I think the system call will only return if the signal is ignored or if the signal handler returns, but you would only do this if you thought you had recovered from the error.

jforberg2• 7 years ago

This is true, but if anything it reinforces my point that continuing past a signal is the exception, not the rule.

In the general case services are not at liberty to just exit(), they need to perform some kind of active cleanup action before exit. So the signal handler would set an "exit flag" somewhere and the EINTR would be an indication for the main loop to check this flag before continuing.

The only common case I can think to continue past signals is SIGHUP, which some services interpret as a command to re-read their configuration file. In this case, you are essentially doing a shutdown and startup sequence anyway, only in a possibly more efficient way. E.g. the case of a web server, if you were previously listening on port N there's no reason to believe that the new config file won't ask you to instead listen on port M. So you will be closing down most connections anyway, and catching SIGHUP is mostly an optimisation as exiting and restarting would have a similar effect.

haberman2• 7 years ago

Wow. I am the author of this, but I forgot all of this after 8 years and it was like reading an article written by someone else. :)

I think the only thing I would add now is that SA_RESTART does seem like inherently the wrong design for this. The code that registers the signal handler might be totally unrelated to the code making the system call. They might be from different libraries, written by different people, completely unaware that the other exists. The right place to specify whether the system call should automatically retry is at the place where the system call is made. So I don't think Unix actually evolved into the "right thing" here.

butterisgood• 7 years ago

Me neither. Sometimes you need EINTR to let you check some other state so you can tell if you need to shutdown.

ncmncm5• 7 years ago

Yes, it's fraught. Unix didn't evolve to the "right thing", if indeed there is a right thing to evolve to.

An important consideration here is that Unix, for much of its history, ran on machines with only a few kilobytes of memory -- a really big one might have 256k. So unnecessary complexity in the kernel translates to it being too big to be useful at all. Extra code in user programs wasn't great either, but couldn't make the whole system unusable, so it was less bad.

System calls that might return EINTR could have been wrapped in a standard library call that would take, say, an extra argument that says what to do -- maybe even a function pointer to call. But there also wasn't really a standard library, yet, and not everybody wanted that much junk going on around their system calls. You got less than a million instructions per second, and system calls burned often a millisecond or hundred. Anyway, what would a library pass to it? Something it got from its caller?

But if you want a loop, you know how to write one, and you can put in it exactly what you want. So the only problem is what happens in some library you use that does system calls. At the time it was considered good form to return to the caller if you got EINTR, and let the caller decide what to do, instead of looping in the library. Then your caller could have a loop calling you, instead.

Then BSD did their thing, and then library callers that might need to break out had to have a setjmp to break out to, and generally had to shut down immediately, afterward, because the library was probably left in a corrupt state.

So things are still not right, by any defensible definition.

But there's no evidence Richard Gabriel really understood these tradeoffs, or cared, really. It was really all a metaphor for LISP vs. C, where C was "worse" and drove out LISP, and Unix and PDP-11s drove out TOPS-10 and then the Lisp Machine, and then the PC came along with DOS, and the world went all to hell.

And here we all are!

nibbula• 7 years ago

It's sad, but worse is better is so pervasive, that even many of you very smart people have difficulty conceiving of what the problem is, much less what would be a better way, not because it's particularly hard, but because of technology culture. It seems trivial. Just return an error, right?

I've had to deal with the problems of EINTR for so long. SA_RESTART seems nice, but you can't rely on it, and it only begins to scratch the surface of what would actually be "better".

How about you can call anything in a signal handler?

How about any code, user or kernel, be safely re-entered?

Of course you can't magically solve every concurrency and resource contention problem, but having functional style, and things like unwind-protect, language support for safety, etc. goes a surprisingly long way.

How about you can have arbitrarily many signal handlers for any condition and have arbitrarily many places to continue on the stack, which can receive arbitrary data?

How about I can call a system call from inside a signal handler, from inside the debugger, from inside a signal handler, inside a system call, and pop up a UI to ask the user what they want?

How about every piece of code can be moved around and called from anywhere?

How about you can pass around an objects that can resume a function or a system call in the middle?

How about the thing reading trashy network packets doesn't have absolute power, while my user process doesn't have permission to close the lid or play audio?

Not just Lisp code, but a large fraction of modern languages that have things like GC and bignums, have to make sure it's safe to do anything, even in the middle of adding a number. So why can't we have these things that have been well known for over 40 years? But I'm sure you're familiar with the relatively small set of crews that designed most the stuff we use. vmlinux, kernel32.dll, and even shabby xnu, might be cute, like the jerq is a cute joke on the perq, if we didn't have to actually rely on them for real stuff.

Unfortunately, it's not hard to see that the worse-is-better culture is a result of larger human culture, which is pushed around by the same typical things. But the good thing is that culture being intangible, it only takes the mostly mental acts of skepticism, education, and personal communication, to change it.

EINTR and PC Loser-Ing: The “Worse Is Better” Case Study (2011)

Related Stories