kino 0.4.0 → 0.5.0

data/ext/kino/src/server.rs

@@ -14,7 +14,7 @@ use magnus::{Error, Ruby};
 use parking_lot::{Mutex, RwLock};
 
 use crate::listen::Listener;
-use crate::registry::{self, BoxedCtx, ServerInner, WorkerSlot};
+use crate::registry::{self, BoxedCtx, RuntimeHandle, ServerInner, WorkerSlot};
 use crate::request::RequestCtx;
 use crate::response::{plain_response, HyperResponse, Responder};
 
@@ -56,6 +56,8 @@ pub fn server_start(ruby: &Ruby, config: magnus::RHash) -> Result<(u64, u16, Opt
     let request_timeout_ms: u64 = cfg_opt::<u64>(ruby, config, "request_timeout_ms")?.unwrap_or(0);
     let max_body_size: usize = cfg_opt::<usize>(ruby, config, "max_body_size")?.unwrap_or(0);
     let max_connections: usize = cfg_opt::<usize>(ruby, config, "max_connections")?.unwrap_or(1024);
+    let io_shards: bool = cfg_opt(ruby, config, "io_shards")?.unwrap_or(false);
+    let io_threads: usize = cfg_opt::<usize>(ruby, config, "io_threads")?.unwrap_or(0);
     let tokio_threads: usize = cfg_opt::<usize>(ruby, config, "tokio_threads")?.unwrap_or(0);
     let tls_cert: Option<String> = cfg_opt(ruby, config, "tls_cert")?;
     let tls_key: Option<String> = cfg_opt(ruby, config, "tls_key")?;
@@ -79,8 +81,7 @@ pub fn server_start(ruby: &Ruby, config: magnus::RHash) -> Result<(u64, u16, Opt
         }
     };
 
-    let listener =
-        Listener::bind(&bind, port).map_err(|e| io_error(ruby, "bind failed", e))?;
+    let listener = Listener::bind(&bind, port).map_err(|e| io_error(ruby, "bind failed", e))?;
     // Ruby refuses this combination up front; this guards embedders
     // calling the native layer directly.
     if acceptor.is_some() && matches!(listener, Listener::Unix(..)) {
@@ -106,15 +107,6 @@ pub fn server_start(ruby: &Ruby, config: magnus::RHash) -> Result<(u64, u16, Opt
         })
         .transpose()?;
 
-    let mut builder = tokio::runtime::Builder::new_multi_thread();
-    builder.enable_all().thread_name("kino-tokio");
-    if tokio_threads > 0 {
-        builder.worker_threads(tokio_threads);
-    }
-    let runtime = builder
-        .build()
-        .map_err(|e| io_error(ruby, "tokio runtime failed", e))?;
-
     let (req_tx, req_rx) = flume::bounded(queue_depth);
     let (shutdown_tx, shutdown_rx) = tokio::sync::watch::channel(false);
 
@@ -123,7 +115,7 @@ pub fn server_start(ruby: &Ruby, config: magnus::RHash) -> Result<(u64, u16, Opt
         req_tx: Mutex::new(Some(req_tx)),
         req_rx,
         shutdown_tx,
-        runtime: Mutex::new(None),
+        runtime: Mutex::new(RuntimeHandle::None),
         slots: RwLock::new(Vec::new()),
         in_flight: std::sync::atomic::AtomicUsize::new(0),
         served: std::sync::atomic::AtomicU64::new(0),
@@ -135,7 +127,12 @@ pub fn server_start(ruby: &Ruby, config: magnus::RHash) -> Result<(u64, u16, Opt
         state: std::sync::atomic::AtomicU8::new(registry::STATE_BOOTING),
         respawns: std::sync::atomic::AtomicU64::new(0),
         quarantine_replacements: std::sync::atomic::AtomicU64::new(0),
-        topology: registry::Topology { mode, workers, threads, batch },
+        topology: registry::Topology {
+            mode,
+            workers,
+            threads,
+            batch,
+        },
         https: acceptor.is_some(),
         unix_path,
         access_log: log_requests.then(|| crate::logsink::Sink::new(std::io::stdout())),
@@ -145,18 +142,48 @@ pub fn server_start(ruby: &Ruby, config: magnus::RHash) -> Result<(u64, u16, Opt
         queue_histogram: registry::QueueHistogram::new(),
     });
 
-    let tokio_listener = {
-        let _guard = runtime.enter();
-        AsyncListener::from_std(listener).map_err(|e| io_error(ruby, "listener setup failed", e))?
-    };
-    runtime.spawn(accept_loop(
-        tokio_listener,
-        acceptor,
-        server.clone(),
-        max_connections,
-        shutdown_rx,
-    ));
-    *server.runtime.lock() = Some(runtime);
+    if io_shards {
+        // The shards keep serving accepted connections while the acceptor
+        // drains on `shutdown_rx`; this second signal stops them only at
+        // final teardown.
+        let (runtime_shutdown_tx, runtime_shutdown_rx) = tokio::sync::watch::channel(false);
+        let threads = crate::io_shards::spawn(
+            listener,
+            acceptor,
+            server.clone(),
+            max_connections,
+            shutdown_rx,
+            runtime_shutdown_rx,
+            crate::io_shards::thread_count(io_threads),
+        )
+        .map_err(|e| io_error(ruby, "sharded runtime failed", e))?;
+        *server.runtime.lock() = RuntimeHandle::Shards {
+            shutdown_tx: runtime_shutdown_tx,
+            threads,
+        };
+    } else {
+        let mut builder = tokio::runtime::Builder::new_multi_thread();
+        builder.enable_all().thread_name("kino-tokio");
+        if tokio_threads > 0 {
+            builder.worker_threads(tokio_threads);
+        }
+        let runtime = builder
+            .build()
+            .map_err(|e| io_error(ruby, "tokio runtime failed", e))?;
+        let tokio_listener = {
+            let _guard = runtime.enter();
+            AsyncListener::from_std(listener)
+                .map_err(|e| io_error(ruby, "listener setup failed", e))?
+        };
+        runtime.spawn(accept_loop(
+            tokio_listener,
+            acceptor,
+            server.clone(),
+            max_connections,
+            shutdown_rx,
+        ));
+        *server.runtime.lock() = RuntimeHandle::MultiThread(runtime);
+    }
 
     let id = server.id;
     let control_port = match control_bind {
@@ -170,10 +197,11 @@ pub fn server_start(ruby: &Ruby, config: magnus::RHash) -> Result<(u64, u16, Opt
         Some(bind) => match crate::control::start(bind, server.clone(), control_token) {
             Ok(port) => port,
             Err(e) => {
-                // A plain drop blocks until the accept loop's task (its
-                // only task, idling on accept/shutdown) is torn down; the
-                // runtime only ever had this one thing to cancel.
-                drop(server.runtime.lock().take());
+                // Nothing is serving yet, so the bound only matters for a
+                // wedged shard thread; the default runtime just cancels
+                // its one idle accept task.
+                let _ = server.shutdown_tx.send(true);
+                std::mem::take(&mut *server.runtime.lock()).shutdown(Duration::from_millis(1_000));
                 return Err(io_error(ruby, "control start failed", e));
             }
         },
@@ -200,22 +228,24 @@ const UNIX_LOCAL: SocketAddr = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST),
 
 /// The accept loop's listener: TCP (optionally behind TLS), or a unix
 /// socket, which carries plain HTTP only.
-enum AsyncListener {
+pub(crate) enum AsyncListener {
     Tcp(tokio::net::TcpListener),
     Unix(tokio::net::UnixListener),
 }
 
 /// One accepted connection, before the protocol layer sees it.
-enum Conn {
+pub(crate) enum Conn {
     Tcp(tokio::net::TcpStream),
     Unix(tokio::net::UnixStream),
 }
 
 impl AsyncListener {
     /// Register the bound listener with the current runtime.
-    fn from_std(listener: Listener) -> std::io::Result<AsyncListener> {
+    pub(crate) fn from_std(listener: Listener) -> std::io::Result<AsyncListener> {
         Ok(match listener {
-            Listener::Tcp(listener) => AsyncListener::Tcp(tokio::net::TcpListener::from_std(listener)?),
+            Listener::Tcp(listener) => {
+                AsyncListener::Tcp(tokio::net::TcpListener::from_std(listener)?)
+            }
             Listener::Unix(listener, _) => {
                 AsyncListener::Unix(tokio::net::UnixListener::from_std(listener)?)
             }
@@ -223,7 +253,7 @@ impl AsyncListener {
     }
 
     /// The next connection with its (peer, local) addresses.
-    async fn accept(&self) -> std::io::Result<(Conn, SocketAddr, SocketAddr)> {
+    pub(crate) async fn accept(&self) -> std::io::Result<(Conn, SocketAddr, SocketAddr)> {
         match self {
             AsyncListener::Tcp(listener) => {
                 let (stream, remote_addr) = listener.accept().await?;
@@ -274,27 +304,38 @@ async fn accept_loop(
         tokio::spawn(async move {
             // Held for the connection's lifetime; dropping it frees a slot.
             let _permit = permit;
-            match (conn, acceptor) {
-                (Conn::Tcp(stream), Some(acceptor)) => {
-                    // Handshake failures (port scans, plain HTTP to a TLS
-                    // port) and stalled handshakes (slowloris) just drop the
-                    // connection; the timeout bounds the latter.
-                    let handshake = tokio::time::timeout(TLS_HANDSHAKE_TIMEOUT, acceptor.accept(stream));
-                    let Ok(Ok(tls)) = handshake.await else { return };
-                    serve_connection(tls, server, remote_addr, local_addr).await;
-                }
-                (Conn::Tcp(stream), None) => {
-                    serve_connection(stream, server, remote_addr, local_addr).await
-                }
-                // TLS over a unix socket is refused at bind time.
-                (Conn::Unix(stream), _) => {
-                    serve_connection(stream, server, remote_addr, local_addr).await
-                }
-            }
+            serve_conn(conn, acceptor, server, remote_addr, local_addr).await;
         });
     }
 }
 
+/// Everything between an accepted connection and hyper: the optional TLS
+/// handshake, then the protocol layer. Shared by the default accept loop
+/// and the sharded one, so connection policy exists exactly once.
+pub(crate) async fn serve_conn(
+    conn: Conn,
+    acceptor: Option<tokio_rustls::TlsAcceptor>,
+    server: Arc<ServerInner>,
+    remote_addr: SocketAddr,
+    local_addr: SocketAddr,
+) {
+    match (conn, acceptor) {
+        (Conn::Tcp(stream), Some(acceptor)) => {
+            // Handshake failures (port scans, plain HTTP to a TLS
+            // port) and stalled handshakes (slowloris) just drop the
+            // connection; the timeout bounds the latter.
+            let handshake = tokio::time::timeout(TLS_HANDSHAKE_TIMEOUT, acceptor.accept(stream));
+            let Ok(Ok(tls)) = handshake.await else { return };
+            serve_connection(tls, server, remote_addr, local_addr).await;
+        }
+        (Conn::Tcp(stream), None) => {
+            serve_connection(stream, server, remote_addr, local_addr).await
+        }
+        // TLS over a unix socket is refused at bind time.
+        (Conn::Unix(stream), _) => serve_connection(stream, server, remote_addr, local_addr).await,
+    }
+}
+
 /// Slowloris guard: drop a connection that has not sent its complete request
 /// headers within this window. Long enough never to trip a real client (even
 /// on a slow mobile link), short enough to reap a stalled one. Deliberately a
@@ -380,7 +421,11 @@ async fn handle_request(
             None => parts.uri.path().to_string(),
         };
         let method = parts.method.to_string();
-        log.write_line(crate::access_log::arrival(&method, &target, remote_addr.ip()));
+        log.write_line(crate::access_log::arrival(
+            &method,
+            &target,
+            remote_addr.ip(),
+        ));
         (std::time::Instant::now(), method, target)
     });
 
@@ -627,7 +672,9 @@ pub fn register_worker(ruby: &Ruby, server_id: u64) -> Result<usize, Error> {
 
 pub fn stop_accepting(_ruby: &Ruby, server_id: u64) -> Result<(), Error> {
     if let Some(server) = registry::try_get(server_id) {
-        server.state.store(registry::STATE_DRAINING, Ordering::Relaxed);
+        server
+            .state
+            .store(registry::STATE_DRAINING, Ordering::Relaxed);
         let _ = server.shutdown_tx.send(true);
     }
     Ok(())
@@ -716,9 +763,8 @@ pub fn interrupt_all_workers(_ruby: &Ruby, server_id: u64) -> Result<(), Error>
 
 pub fn shutdown_runtime(_ruby: &Ruby, server_id: u64, timeout_ms: u64) -> Result<(), Error> {
     if let Some(server) = registry::remove(server_id) {
-        if let Some(runtime) = server.runtime.lock().take() {
-            runtime.shutdown_timeout(Duration::from_millis(timeout_ms));
-        }
+        let _ = server.shutdown_tx.send(true);
+        std::mem::take(&mut *server.runtime.lock()).shutdown(Duration::from_millis(timeout_ms));
         // The listener is closed with the runtime; its socket file is not.
         if let Some(path) = &server.unix_path {
             crate::listen::cleanup_unix(path);
@@ -775,10 +821,7 @@ pub type WorkerStatRow = (usize, u64, usize, u64, bool);
 
 /// Per-slot rows for Server#stats parity: [index, served, in_flight,
 /// busy_ms, quarantined] each. Empty when the server is gone.
-pub fn worker_stats(
-    _ruby: &Ruby,
-    server_id: u64,
-) -> Result<Vec<WorkerStatRow>, Error> {
+pub fn worker_stats(_ruby: &Ruby, server_id: u64) -> Result<Vec<WorkerStatRow>, Error> {
     let Some(server) = registry::try_get(server_id) else {
         return Ok(Vec::new());
     };
@@ -800,7 +843,9 @@ pub fn quarantine_slot(ruby: &Ruby, server_id: u64, worker_id: usize) -> Result<
 /// One replacement spawned by the quarantine monitor.
 pub fn record_quarantine_replacement(_ruby: &Ruby, server_id: u64) -> Result<(), Error> {
     if let Some(server) = registry::try_get(server_id) {
-        server.quarantine_replacements.fetch_add(1, Ordering::Relaxed);
+        server
+            .quarantine_replacements
+            .fetch_add(1, Ordering::Relaxed);
     }
     Ok(())
 }
@@ -851,7 +896,10 @@ mod tests {
         server.register_worker();
         server.slots.read()[0].lane_tx.lock().take();
 
-        assert!(matches!(try_dispatch(&server, test_ctx()), Dispatch::Closed));
+        assert!(matches!(
+            try_dispatch(&server, test_ctx()),
+            Dispatch::Closed
+        ));
     }
 
     #[test]
@@ -894,9 +942,7 @@ mod tests {
         let server = test_server(true, 4);
         server.register_worker();
         server.register_worker();
-        server.slots.read()[0]
-            .parked
-            .store(true, Ordering::Relaxed);
+        server.slots.read()[0].parked.store(true, Ordering::Relaxed);
 
         // Both dispatches land on the awake lane (slot 1), regardless of
         // where the rotating cursor starts.

data/ext/kino/src/tls.rs

@@ -71,7 +71,8 @@ WJ2lRijROyX9v7f8aSQlb6kEwKhI8kG8SbeUc+zbKkzGgRXNaZHY/mAa
     #[test]
     fn missing_file_paths_error_without_panicking() {
         let err = build_acceptor("/nonexistent/cert.pem", "/nonexistent/key.pem")
-            .err().expect("missing files");
+            .err()
+            .expect("missing files");
         assert!(err.contains("cannot read"));
     }
 
@@ -83,14 +84,20 @@ WJ2lRijROyX9v7f8aSQlb6kEwKhI8kG8SbeUc+zbKkzGgRXNaZHY/mAa
 
     #[test]
     fn pem_without_a_key_is_rejected() {
-        let err = build_acceptor(CERT, CERT).err().expect("a cert is not a key");
+        let err = build_acceptor(CERT, CERT)
+            .err()
+            .expect("a cert is not a key");
         assert!(err.contains("no private key found"));
     }
 
     #[test]
     fn mismatched_cert_and_garbage_key_are_rejected() {
-        let err = build_acceptor(CERT, "-----BEGIN PRIVATE KEY-----\ngarbage\n-----END PRIVATE KEY-----")
-            .err().expect("garbage key");
+        let err = build_acceptor(
+            CERT,
+            "-----BEGIN PRIVATE KEY-----\ngarbage\n-----END PRIVATE KEY-----",
+        )
+        .err()
+        .expect("garbage key");
         assert!(!err.is_empty());
     }
 }

data/lib/kino/configuration.rb

@@ -26,6 +26,8 @@ module Kino
       after_request_complete: nil,
       on_worker_exit: nil,
       shutdown_timeout: 30,
+      io_shards: false,
+      io_threads: nil,
       tokio_threads: nil,
       tls: nil,
       environment: nil,
@@ -148,6 +150,8 @@ module Kino
     #   queue_depth 2048
     #   queue_timeout 0.5
     #   shutdown_timeout 15
+    #   io_shards true
+    #   io_threads 6
     #   tokio_threads 4
     #   tls cert: "cert.pem", key: "key.pem"
     #
@@ -229,6 +233,12 @@ module Kino
       # Graceful-shutdown drain deadline in seconds.
       def shutdown_timeout(seconds) = @config.set(:shutdown_timeout, seconds)
 
+      # Run native HTTP I/O on current-thread shards instead of Tokio's shared pool.
+      def io_shards(enabled = true) = @config.set(:io_shards, !!enabled)
+
+      # Native HTTP I/O shard count; default with io_shards: half available CPUs.
+      def io_threads(count) = @config.set(:io_threads, Integer(count))
+
       # Threads for the tokio (Rust I/O) runtime; default: one per core.
       def tokio_threads(count) = @config.set(:tokio_threads, Integer(count))
 

data/lib/kino/server.rb

@@ -98,6 +98,12 @@ module Kino
       @lanes = !!settings[:lanes]
       @log_requests = !!settings[:log_requests]
       @shutdown_timeout = settings[:shutdown_timeout]
+      @io_shards = !!settings[:io_shards]
+      @io_threads = Integer(settings[:io_threads]) unless settings[:io_threads].nil?
+      if @io_threads && @io_threads < 1
+        raise ArgumentError, "io_threads must be >= 1"
+      end
+      Log.warn("io_threads has no effect unless io_shards is true") if @io_threads && !@io_shards
       @tokio_threads = settings[:tokio_threads]
       @tls = validate_tls(settings[:tls])
       if @tls && unix?
@@ -145,6 +151,8 @@ module Kino
           request_timeout_ms: @request_timeout_ms,
           max_connections: @max_connections,
           max_body_size: @max_body_size,
+          io_shards: @io_shards,
+          io_threads: @io_threads,
           tokio_threads: @tokio_threads,
           tls_cert: @tls&.fetch(:cert), tls_key: @tls&.fetch(:key),
           lanes: @lanes, log_requests: @log_requests,

data/lib/kino/templates/kino.rb.tt

@@ -125,8 +125,14 @@
 
 ## Runtime
 
-# Threads for the Rust I/O engine. The default suits most apps; for
-# heavily CPU-bound apps, try 1 to leave more cores for Ruby.
+# Run native HTTP I/O on current-thread shards instead of Tokio's shared
+# worker pool, reducing scheduler contention on very fast handlers.
+# io_shards true
+
+# I/O shard count. Default with io_shards: half available CPUs.
+# io_threads 6
+
+# Threads for the Tokio multi-thread runtime. Default: one per available CPU.
 # tokio_threads 4
 
 ## Control plane

data/lib/kino/version.rb

@@ -2,5 +2,5 @@
 
 module Kino
   # The gem version (single source of truth; ext/kino/Cargo.toml syncs).
-  VERSION = "0.4.0"
+  VERSION = "0.5.0"
 end

data/sig/kino.rbs

@@ -126,6 +126,8 @@ module Kino
       def after_request_complete: (?^(Hash[String, untyped], Integer) -> void handler) ?{ (Hash[String, untyped], Integer) -> void } -> untyped
       def on_worker_exit: (?^(Integer, Exception?) -> void handler) ?{ (Integer, Exception?) -> void } -> untyped
       def shutdown_timeout: (Numeric seconds) -> untyped
+      def io_shards: (?boolish enabled) -> untyped
+      def io_threads: (int? count) -> untyped
       def tokio_threads: (int count) -> untyped
       def tls: (cert: String, key: String) -> untyped
       def environment: (String | Symbol env) -> untyped

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kino
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Yaroslav Markin
@@ -180,6 +180,7 @@ files:
 - ext/kino/src/cpus.rs
 - ext/kino/src/env_strings.rs
 - ext/kino/src/gvl.rs
+- ext/kino/src/io_shards.rs
 - ext/kino/src/lib.rs
 - ext/kino/src/listen.rs
 - ext/kino/src/log.rs