mirror of
https://github.com/samba-team/samba.git
synced 2025-01-11 05:18:09 +03:00
0736fdcdb0
Finally: use the new dos_mode_at_send() in the directory enumeration
loop. This means that fetching the DOS attributes for directory entries
is done asynchronously with regard to the enumeration loop.
As the DOS attribute is typically read from an extended attribute in the
filesytem, this avoids sequentially blocking on IO. If the IO subsystem
is slow servicing these request, enabling async processing can result in
performance improvements.
A parametric option
smbd:async dosmode = true | false (default: false)
can be used to enable the new async processing.
Simulating slow IO with usleep(5000) in the synchronous and asynchronous
versions of SMB_VFS_GET_DOS_ATTRIBUTES(), the results of enumerating a
directory with 10,000 files are:
smbd:async dosmode = no:
$ time bin/smbclient -U slow%x //localhost/test -c "ls dir\*" > /dev/null
real 0m59.597s
user 0m0.024s
sys 0m0.012s
smbd:async dosmode = yes:
$ time bin/smbclient -U slow%x //localhost/test -c "ls dir\*" > /dev/null
real 0m0.698s
user 0m0.038s
sys 0m0.025s
Performance gains in real world workloads depends on whether the actual
IO requests can be merged and parallelized by the kernel. Without such
wins at the IO layer, the async processing may even be slower then the
sync processing due to the additional overhead.
The following parameters can be used to adapt async processing behaviour
for specific workloads and systems:
aio max threads = X (default: 100)
smbd:max async dosmode = Y (default: "aio max threads" * 2)
By default we have at most twice the number of async requests in flight
as threads provided by the underlying threadpool. This ensures a worker
thread that finishes a job can directly pick up a new one without going
to sleep.
It may be advisable to reduce the number of threads to avoid scheduling
overhead while also increasing "smbd:max async dosmode".
Note that we disable async processing for certain VFS modules in the VFS
connect function to avoid the overhead of triggering the sync fallback
in dos_mode_at_send(). This is done for VFS modules that implement the
sync SMB_VFS_GET_DOS_ATTRIBUTES(), but not the async version (gpfs), and
for VFS modules that don't share a real filesystem where fchdir() can be
used (ceph, gluster). It is disabled for catia, because we realized that
the catia name translation macros used on
fsps (CATIA_FETCH_FSP_[PRE|POST]_NEXT) have a bug (#13547).
We use threadpool = smb_vfs_ev_glue_tp_chdir_safe() and then
pthreadpool_tevent_max_threads(threadpool) to get the number of maximum
worker threads which matches the pool used by the low level
SMB_VFS_GETXATTRAT_[SEND|RECV] implementation in vfs_default.
This is a terrible abstraction leak that should be removed in the future
by maybe making it possible to ask a VFS function which threadpool it
uses, internally suporting chaining so VFS function FOO that internally
uses BAR can forward the question to BAR.
On a hyphotetical system that had a getxattrat(dirfd, path, ...)
syscall and at the same time doesn't support per-thread current working
directories (eg FreeBSD doesn't have the latter) but has support for
per-thread-credentials, pthreadpool_tevent_max_threads() on the
tp_chdir_safe threadpool returns 1.
So when hooking the hyphotetical getxattrat() into the async
SMB_VFS_GETXATTRAT_[SEND|RECV] implementation in an VFS module, the
implementation could use the tp_path_safe threadpool, but the SMB2
layer would use the wrong threadpool in the call to
pthreadpool_tevent_max_threads(), resulting in no parallelism.
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
|
||
|---|---|---|
| .. | ||
| developer.c | ||
| getdate.c | ||
| getdate.h | ||
| getdate.y | ||
| lib_vxfs.c | ||
| nfs4_acls.c | ||
| nfs4_acls.h | ||
| nfs4acl_xattr_ndr.c | ||
| nfs4acl_xattr_ndr.h | ||
| nfs4acl_xattr_xdr.c | ||
| nfs4acl_xattr_xdr.h | ||
| nfs4acl_xattr.h | ||
| nfs41acl.x | ||
| non_posix_acls.c | ||
| non_posix_acls.h | ||
| offload_token.c | ||
| offload_token.h | ||
| perfcount_test.c | ||
| posixacl_xattr.c | ||
| posixacl_xattr.h | ||
| README-gpfs-acl.txt | ||
| README.nfs4acls.txt | ||
| string_replace.c | ||
| string_replace.h | ||
| vfs_acl_common.c | ||
| vfs_acl_common.h | ||
| vfs_acl_tdb.c | ||
| vfs_acl_xattr.c | ||
| vfs_afsacl.c | ||
| vfs_aio_fork.c | ||
| vfs_aio_pthread.c | ||
| vfs_aixacl2.c | ||
| vfs_aixacl_util.c | ||
| vfs_aixacl_util.h | ||
| vfs_aixacl.c | ||
| vfs_audit.c | ||
| vfs_btrfs.c | ||
| vfs_cacheprime.c | ||
| vfs_cap.c | ||
| vfs_catia.c | ||
| vfs_ceph.c | ||
| vfs_commit.c | ||
| vfs_crossrename.c | ||
| vfs_default_quota.c | ||
| vfs_default.c | ||
| vfs_dfs_samba4.c | ||
| vfs_dirsort.c | ||
| vfs_error_inject.c | ||
| vfs_expand_msdfs.c | ||
| vfs_extd_audit.c | ||
| vfs_fake_acls.c | ||
| vfs_fake_dfq.c | ||
| vfs_fake_perms.c | ||
| vfs_fileid.c | ||
| vfs_fruit.c | ||
| vfs_full_audit.c | ||
| vfs_glusterfs.c | ||
| vfs_gpfs.c | ||
| vfs_hpuxacl.c | ||
| vfs_hpuxacl.h | ||
| vfs_linux_xfs_sgid.c | ||
| vfs_media_harmony.c | ||
| vfs_netatalk.c | ||
| vfs_nfs4acl_xattr.c | ||
| vfs_not_implemented.c | ||
| vfs_offline.c | ||
| vfs_posix_eadb.c | ||
| vfs_posixacl.c | ||
| vfs_posixacl.h | ||
| vfs_prealloc.c | ||
| vfs_preopen.c | ||
| vfs_readahead.c | ||
| vfs_readonly.c | ||
| vfs_recycle.c | ||
| vfs_shadow_copy2.c | ||
| vfs_shadow_copy.c | ||
| vfs_shell_snap.c | ||
| vfs_snapper.c | ||
| vfs_solarisacl.c | ||
| vfs_solarisacl.h | ||
| vfs_streams_depot.c | ||
| vfs_streams_xattr.c | ||
| vfs_syncops.c | ||
| vfs_time_audit.c | ||
| vfs_tru64acl.c | ||
| vfs_tru64acl.h | ||
| vfs_tsmsm.c | ||
| vfs_unityed_media.c | ||
| vfs_virusfilter_clamav.c | ||
| vfs_virusfilter_common.h | ||
| vfs_virusfilter_fsav.c | ||
| vfs_virusfilter_sophos.c | ||
| vfs_virusfilter_utils.c | ||
| vfs_virusfilter_utils.h | ||
| vfs_virusfilter.c | ||
| vfs_vxfs.c | ||
| vfs_vxfs.h | ||
| vfs_worm.c | ||
| vfs_xattr_tdb.c | ||
| vfs_zfsacl.c | ||
| wscript_build | ||
Configuring NFS4 ACLs in Samba3
===============================
Created: Peter Somogyi, 2006-JUN-06
Last modified: Alexander Werth, 2013-MAY-02
Revision no.: 4
-------------------------------
Parameters in smb.conf:
=======================
Each parameter must have a prefix "nfs4:".
Each one affects the behaviour only when _setting_ an acl on a file/dir:
mode = [simple|special]
- simple: Use OWNER@ and GROUP@ special IDs for non inheriting ACEs only.
This mode is the default.
- special: use OWNER@ and GROUP@ special IDs in ACEs instead of simple
user&group ids. This mode is deprecated.
Note1: EVERYONE@ is always processed (if found such an ACE).
Note2: There is a side effect when _only_ chown is performed.
Later this may be worked out.
Note3: Mode special inherits incorrect ACL entries when the user creating
a file is different from the owner of the caurrent folder.
Note4: Mode simple uses inheriting OWNER@ and GROUP@ special IDs to
support Creator Owner and Creator Group.
It's strongly advised to set "store dos attributes = yes" in smb.conf.
chown = [true|false]
- true => enable changing owner and group - default.
- false => disable support for changing owner or group
acedup = [dontcare|reject|ignore|merge]
- dontcare: copy ACEs as they come, don't care with "duplicate" records. Default.
- reject: stop operation, exit acl setter operation with an error
- ignore: don't include the second matching ACE
- merge: OR 2 ace.flag fields and 2 ace.mask fields of the 2 duplicate ACEs into 1 ACE
Two ACEs are considered here "duplicate" when their type and id fields are matching.
Example:
[smbtest]
path = /tests/psomogyi/smbtest
writable = yes
vfs objects = aixacl2
nfs4: mode = special
nfs4: chown = yes
nfs4: acedup = merge
Configuring AIX ACL support
==============================
Binaries: (default install path is [samba]/lib/vfs/)
- aixacl.so: provides AIXC ACL support only, can be compiled and works on all AIX platforms
- aixacl2.so: provides AIXC and JFS2-NFS4 ACL support, can be compiled and works only under AIX 5.3 and newer.
NFS4 acl currently has support only under JFS2 (ext. attr. format must be set to v2).
aixacl2.so always detects support for NFS4 acls and redirects to POSIX ACL handling automatically when NFS4 is not supported for a path.
Adding "vfs objects = aixacl2" to a share should be done only in case when NFS4 is really supported by the filesystem.
(Otherwise you may get performance loss.)
For configuration see also the example above.
General notes
=============
NFS4 handling logic is separated from AIX/jfs2 ACL parsing.
Samba and its VFS modules dosn't reorder ACEs. Windows clients do that (and the smbcacl tool). MSDN also says deny ACEs must come first.
NFS4 ACL's validity is checked by the system API, not by Samba.
NFS4 ACL rights are enforced by the OS or filesystem, not by Samba.
The flag INHERITED_ACE is never set (not required, as doesn't do WinNT/98/me, only since Win2k).
Win2k GUI behaves strangely when detecting inheritance (sometimes it doesn't detect,
but after adding an ace it shows that - it's some GUI error).
Unknown (unmappable) SIDs are not accepted.
TODOs
=====
- Creator Owner & Group SID handling (same way as posix)
- the 4 generic rights bits support (GENERIC_RIGHT_READ_ACCESS, WRITE, EXEC, ALL)
- chown & no ACL, but we have ONWER@ and GROUP@
- DIALUP, ANONYMOUS, ... builtin SIDs
- audit & alarm support - in theory it's forwarded so it should work, but currently there's no platform which supports them to test
- support for a real NFS4 client (we don't have an accepted API yet)