Redox: Ring Buffers Project Summary

The Redox article is underselling it somewhat. Part of the problem is Linux's historical syscall restriction systems (seccomp) did not (does not?) apply to io_uring, so io_uring is (was?) all or nothing on async versions of syscalls it implements. Also, io_uring is rapidly adding API surface compared to other parts of the kernel. With these factors combined, it has had repeated security problems since 2019 and has lead to, e.g., Android disabling io_uring entirely for applications.

https://security.googleblog.com/2023/06/learnings-from-kctf-...

> in the past year, there has been a clear trend: 60% of the submissions exploited the io_uring component of the Linux kernel (we paid out around 1 million USD for io_uring alone). Furthermore, io_uring vulnerabilities were used in all the submissions which bypassed our mitigations.

In the abstract there's nothing necessarily inherently insecure about io_uring. In practice on Linux it's a security disaster because it hooks into and interacts with subsystems in ways never anticipated when they were originally written, exposing and creating all kinds of bugs. Claims that the wave of bugs is now in the past were... premature. They haven't really stopped, though part of that is because io_uring hasn't stopped growing and becoming more complex itself.

> Guess what will happen.

Throughput for storage networking and GPUs will continue gaining yet more orders of magnitude and radically increased efficiency?

I look at this and cheer. https://www.phoronix.com/news/DMA-BUF-IO-uring-Linux-7.4

I get some hesitancy but do folks really think this Fear Uncertainty and Doubt, that being conservative is going to pay off in the long run?

The wins on the book for io-uring are incredible. Massive. It looks like a miracle. It's completely changed what a box can do. Orders of magnitude more. With vastly less cpu.

Has it had problems? Sure yes, it did. Is it still perfect? Probably not.

For cloud providers running arbitrary user code in containers yeah maybe the fear of the unknown makes sense. That the risk of some undisclosed vulnerability is going to get exploited against you and your customers. But most people aren't running arbitrary code on their systems. And most people are not going to be the target when there is a high profile vulnerability. We have, from what I can tell, no evidence any of these vulnerabilities from the past have ever had consequences. They're not good! But people really are batting so hard to declare an L, wind themselves and others up so hard to justify outrage. I find it ridiculous. Preposterous.

The wins are already a landslide. Issues get tackled. The rate and severity of issues has tapered to a trickle. The design fundamentally makes sense as a consumer, a programmer using it. The hardware obviously loves it. Io-uring is going to keep winning, keep cleaning house.

And what is going to happen to the dissenters standing outside year after year waving these protest banners? I can't help but think that their fate is to look ever more ridiculous. That over time the io-uring protest looks ever more an out of touch farce, completely disconnected from the silent majority's very happy better place, that 30x's performance and that makes sense to us all and that has never personally hurt a one of us in any way.

KSMBd has the same fate (albeit radically less upside), the same endless fearmongering attack hounds who will probably never ever stop yelling about it either. For what? It's so unclear. Because sometimes new things do take time to settle some. Because it's fun to yell at things, to steal the attention of the room, to feel better than the crowd. History never dies, grudges and people's bad impressions of things never get updated, negative experiences and feelings have such potency to sear they ways into our souls, to mark us forever. We are thrown off our poles and forever tilted against things, lost entirely to possibility of reevaluation, reconsideration, reflection on what the new contemporary is. https://en.wikipedia.org/wiki/Planck%27s_principle

We can and should be excited for no longer needing to cross the syscall barrier as incessantly. We can and should be excited for the radical efficiency. We can and should be excited for mechanistic sympathy, for these circular buffers that work very well on the hardware. Generally we should, for our soul's sake, work to behold a possibility of success. To allow room even in darkness for maybe perhaps possibly some light and grace and success some day. I am definitely interested in hearing tales of what else could be, other than io-uring. I know and use iouring and it makes sense to me. It works great, from what I can see. But if there's other ideas out there for how else we get to winning, I want to know! To engage in imagining the yes perhaps. Unvetted but here's Asterinas. https://github.com/asterinas/asterinas

Alternative take: I did look up that exact word while reading the article. It’s been a minute since I saw it in a chemistry context. For me, it was nice to see someone else with the same question and that they took the time to post a concise definition.