[Tarantool-patches] [RFC v5 0/5] limbo: implement packets filtering

[Tarantool-patches] [RFC v5 0/5] limbo: implement packets filtering

[Cyrill Gorcunov via Tarantool-patches]

Guys, here is another rfc for incoming packets filtering.
I added locking for terms manipulations. The filter itself
yet implements only promote requests filtering but I'll extend
it later together with tests. For now it's early draft for
comments gathering.

branch gorcunov/gh-6036-rollback-confirm-notest

Cyrill Gorcunov (5):
  latch: add latch_is_locked helper
  say: introduce panic_on helper
  limbo: gather promote tracking into a separate structure
  limbo: order access to the promote terms
  limbo: filter incoming requests

 src/box/applier.cc   |  13 +++--
 src/box/box.cc       |   3 +-
 src/box/txn_limbo.c  |  88 ++++++++++++++++++++++++++-------
 src/box/txn_limbo.h  | 113 ++++++++++++++++++++++++++++++++++---------
 src/lib/core/latch.h |  11 +++++
 src/lib/core/say.h   |   1 +
 6 files changed, 185 insertions(+), 44 deletions(-)

-- 
2.31.1

[Tarantool-patches] [RFC v5 1/5] latch: add latch_is_locked helper

[Cyrill Gorcunov via Tarantool-patches]

To test if latch is locked.

In-scope-of #6036

Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
---
 src/lib/core/latch.h | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/lib/core/latch.h b/src/lib/core/latch.h
index 49c59cf63..0aaa8b634 100644
--- a/src/lib/core/latch.h
+++ b/src/lib/core/latch.h
@@ -95,6 +95,17 @@ latch_owner(struct latch *l)
 	return l->owner;
 }
 
+/**
+ * Return true if the latch is locked.
+ *
+ * @param l - latch to be tested.
+ */
+static inline bool
+latch_is_locked(const struct latch *l)
+{
+	return l->owner != NULL;
+}
+
 /**
  * Lock a latch. If the latch is already locked by another fiber,
  * waits for timeout.
-- 
2.31.1

Re: [Tarantool-patches] [RFC v5 1/5] latch: add latch_is_locked helper

[Serge Petrenko via Tarantool-patches]

15.07.2021 00:23, Cyrill Gorcunov пишет:
> To test if latch is locked.
>
> In-scope-of #6036
>
> Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>

Thanks! LGTM.

> ---
>   src/lib/core/latch.h | 11 +++++++++++
>   1 file changed, 11 insertions(+)
>
> diff --git a/src/lib/core/latch.h b/src/lib/core/latch.h
> index 49c59cf63..0aaa8b634 100644
> --- a/src/lib/core/latch.h
> +++ b/src/lib/core/latch.h
> @@ -95,6 +95,17 @@ latch_owner(struct latch *l)
>   	return l->owner;
>   }
>   
> +/**
> + * Return true if the latch is locked.
> + *
> + * @param l - latch to be tested.
> + */
> +static inline bool
> +latch_is_locked(const struct latch *l)
> +{
> +	return l->owner != NULL;
> +}
> +
>   /**
>    * Lock a latch. If the latch is already locked by another fiber,
>    * waits for timeout.

-- 
Serge Petrenko

[Tarantool-patches] [RFC v5 2/5] say: introduce panic_on helper

[Cyrill Gorcunov via Tarantool-patches]

In-scope-of #6036

Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
---
 src/lib/core/say.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/lib/core/say.h b/src/lib/core/say.h
index e1fec8c60..4bb1645fd 100644
--- a/src/lib/core/say.h
+++ b/src/lib/core/say.h
@@ -348,6 +348,7 @@ CFORMAT(printf, 5, 6) extern sayfunc_t _say;
 
 #define panic_status(status, ...)	({ say(S_FATAL, NULL, __VA_ARGS__); exit(status); })
 #define panic(...)			panic_status(EXIT_FAILURE, __VA_ARGS__)
+#define panic_on(cond, ...)		if (cond) panic(__VA_ARGS__)
 #define panic_syserror(...)		({ say(S_FATAL, strerror(errno), __VA_ARGS__); exit(EXIT_FAILURE); })
 
 enum {
-- 
2.31.1

[Tarantool-patches] [RFC v5 3/5] limbo: gather promote tracking into a separate structure

[Cyrill Gorcunov via Tarantool-patches]

It is needed to introduce ordered promote related data
modifications in next patch.

Part-of #6036

Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
---
 src/box/txn_limbo.c | 24 ++++++++++++++--------
 src/box/txn_limbo.h | 49 ++++++++++++++++++++++++++++-----------------
 2 files changed, 47 insertions(+), 26 deletions(-)

diff --git a/src/box/txn_limbo.c b/src/box/txn_limbo.c
index 570f77c46..957fe0d1e 100644
--- a/src/box/txn_limbo.c
+++ b/src/box/txn_limbo.c
@@ -37,6 +37,13 @@
 
 struct txn_limbo txn_limbo;
 
+static void
+txn_limbo_promote_create(struct txn_limbo_promote *pmt)
+{
+	vclock_create(&pmt->terms_map);
+	pmt->terms_max = 0;
+}
+
 static inline void
 txn_limbo_create(struct txn_limbo *limbo)
 {
@@ -45,8 +52,7 @@ txn_limbo_create(struct txn_limbo *limbo)
 	limbo->owner_id = REPLICA_ID_NIL;
 	fiber_cond_create(&limbo->wait_cond);
 	vclock_create(&limbo->vclock);
-	vclock_create(&limbo->promote_term_map);
-	limbo->promote_greatest_term = 0;
+	txn_limbo_promote_create(&limbo->promote);
 	limbo->confirmed_lsn = 0;
 	limbo->rollback_count = 0;
 	limbo->is_in_rollback = false;
@@ -305,10 +311,11 @@ void
 txn_limbo_checkpoint(const struct txn_limbo *limbo,
 		     struct synchro_request *req)
 {
+	const struct txn_limbo_promote *pmt = &limbo->promote;
 	req->type = IPROTO_PROMOTE;
 	req->replica_id = limbo->owner_id;
 	req->lsn = limbo->confirmed_lsn;
-	req->term = limbo->promote_greatest_term;
+	req->term = pmt->terms_max;
 }
 
 static void
@@ -726,20 +733,21 @@ txn_limbo_wait_empty(struct txn_limbo *limbo, double timeout)
 void
 txn_limbo_process(struct txn_limbo *limbo, const struct synchro_request *req)
 {
+	struct txn_limbo_promote *pmt = &limbo->promote;
 	uint64_t term = req->term;
 	uint32_t origin = req->origin_id;
 	if (txn_limbo_replica_term(limbo, origin) < term) {
-		vclock_follow(&limbo->promote_term_map, origin, term);
-		if (term > limbo->promote_greatest_term)
-			limbo->promote_greatest_term = term;
+		vclock_follow(&pmt->terms_map, origin, term);
+		if (term > pmt->terms_max)
+			pmt->terms_max = term;
 	} else if (iproto_type_is_promote_request(req->type) &&
-		   limbo->promote_greatest_term > 1) {
+		   pmt->terms_max > 1) {
 		/* PROMOTE for outdated term. Ignore. */
 		say_info("RAFT: ignoring %s request from instance "
 			 "id %u for term %llu. Greatest term seen "
 			 "before (%llu) is bigger.",
 			 iproto_type_name(req->type), origin, (long long)term,
-			 (long long)limbo->promote_greatest_term);
+			 (long long)pmt->terms_max);
 		return;
 	}
 
diff --git a/src/box/txn_limbo.h b/src/box/txn_limbo.h
index 53e52f676..70a5fbfd5 100644
--- a/src/box/txn_limbo.h
+++ b/src/box/txn_limbo.h
@@ -75,6 +75,31 @@ txn_limbo_entry_is_complete(const struct txn_limbo_entry *e)
 	return e->is_commit || e->is_rollback;
 }
 
+/**
+ * Keep state of promote requests to handle split-brain
+ * situation and other errors.
+ */
+struct txn_limbo_promote {
+	/**
+	 * Latest terms received with PROMOTE entries from remote instances.
+	 * Limbo uses them to filter out the transactions coming not from the
+	 * limbo owner, but so outdated that they are rolled back everywhere
+	 * except outdated nodes.
+	 */
+	struct vclock terms_map;
+	/**
+	 * The biggest PROMOTE term seen by the instance and persisted in WAL.
+	 * It is related to raft term, but not the same. Synchronous replication
+	 * represented by the limbo is interested only in the won elections
+	 * ended with PROMOTE request.
+	 * It means the limbo's term might be smaller than the raft term, while
+	 * there are ongoing elections, or the leader is already known and this
+	 * instance hasn't read its PROMOTE request yet. During other times the
+	 * limbo and raft are in sync and the terms are the same.
+	 */
+	uint64_t terms_max;
+};
+
 /**
  * Limbo is a place where transactions are stored, which are
  * finished, but not committed nor rolled back. These are
@@ -130,23 +155,9 @@ struct txn_limbo {
 	 */
 	struct vclock vclock;
 	/**
-	 * Latest terms received with PROMOTE entries from remote instances.
-	 * Limbo uses them to filter out the transactions coming not from the
-	 * limbo owner, but so outdated that they are rolled back everywhere
-	 * except outdated nodes.
-	 */
-	struct vclock promote_term_map;
-	/**
-	 * The biggest PROMOTE term seen by the instance and persisted in WAL.
-	 * It is related to raft term, but not the same. Synchronous replication
-	 * represented by the limbo is interested only in the won elections
-	 * ended with PROMOTE request.
-	 * It means the limbo's term might be smaller than the raft term, while
-	 * there are ongoing elections, or the leader is already known and this
-	 * instance hasn't read its PROMOTE request yet. During other times the
-	 * limbo and raft are in sync and the terms are the same.
+	 * Track promote requests.
 	 */
-	uint64_t promote_greatest_term;
+	struct txn_limbo_promote promote;
 	/**
 	 * Maximal LSN gathered quorum and either already confirmed in WAL, or
 	 * whose confirmation is in progress right now. Any attempt to confirm
@@ -218,7 +229,8 @@ txn_limbo_last_entry(struct txn_limbo *limbo)
 static inline uint64_t
 txn_limbo_replica_term(const struct txn_limbo *limbo, uint32_t replica_id)
 {
-	return vclock_get(&limbo->promote_term_map, replica_id);
+	const struct txn_limbo_promote *pmt = &limbo->promote;
+	return vclock_get(&pmt->terms_map, replica_id);
 }
 
 /**
@@ -229,8 +241,9 @@ static inline bool
 txn_limbo_is_replica_outdated(const struct txn_limbo *limbo,
 			      uint32_t replica_id)
 {
+	const struct txn_limbo_promote *pmt = &limbo->promote;
 	return txn_limbo_replica_term(limbo, replica_id) <
-	       limbo->promote_greatest_term;
+	       pmt->terms_max;
 }
 
 /**
-- 
2.31.1

Re: [Tarantool-patches] [RFC v5 3/5] limbo: gather promote tracking into a separate structure

[Serge Petrenko via Tarantool-patches]

15.07.2021 00:23, Cyrill Gorcunov пишет:
> It is needed to introduce ordered promote related data
> modifications in next patch.
>
> Part-of #6036
>
> Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
> ---

Thanks for the patch!
Generally looks good with a couple of comments.

>   src/box/txn_limbo.c | 24 ++++++++++++++--------
>   src/box/txn_limbo.h | 49 ++++++++++++++++++++++++++++-----------------
>   2 files changed, 47 insertions(+), 26 deletions(-)
>
> diff --git a/src/box/txn_limbo.c b/src/box/txn_limbo.c
> index 570f77c46..957fe0d1e 100644
> --- a/src/box/txn_limbo.c
> +++ b/src/box/txn_limbo.c
> @@ -37,6 +37,13 @@
>   
>   struct txn_limbo txn_limbo;
>   
> +static void
> +txn_limbo_promote_create(struct txn_limbo_promote *pmt)
> +{
> +	vclock_create(&pmt->terms_map);
> +	pmt->terms_max = 0;
> +}
> +

I don't like the name (limbo->promote, struct txn_limbo_promote),
but can't come up with a better one.

The structure doesn't hold a specific promote. It's more like "promote 
history",
or "terms seen".

Maybe something like "term history" ? "term tracker" ?
"remote term set", "term set" ?

Just a suggestion, my names are not too good.

>   static inline void
>   txn_limbo_create(struct txn_limbo *limbo)
>   {
> @@ -45,8 +52,7 @@ txn_limbo_create(struct txn_limbo *limbo)
>   	limbo->owner_id = REPLICA_ID_NIL;
>   	fiber_cond_create(&limbo->wait_cond);
>   	vclock_create(&limbo->vclock);
> -	vclock_create(&limbo->promote_term_map);
> -	limbo->promote_greatest_term = 0;
> +	txn_limbo_promote_create(&limbo->promote);
>   	limbo->confirmed_lsn = 0;
>   	limbo->rollback_count = 0;
>   	limbo->is_in_rollback = false;
> @@ -305,10 +311,11 @@ void
>   txn_limbo_checkpoint(const struct txn_limbo *limbo,
>   		     struct synchro_request *req)
>   {
> +	const struct txn_limbo_promote *pmt = &limbo->promote;
>   	req->type = IPROTO_PROMOTE;
>   	req->replica_id = limbo->owner_id;
>   	req->lsn = limbo->confirmed_lsn;
> -	req->term = limbo->promote_greatest_term;
> +	req->term = pmt->terms_max;
>   }
>   
>   static void
> @@ -726,20 +733,21 @@ txn_limbo_wait_empty(struct txn_limbo *limbo, double timeout)
>   void
>   txn_limbo_process(struct txn_limbo *limbo, const struct synchro_request *req)
>   {
> +	struct txn_limbo_promote *pmt = &limbo->promote;
>   	uint64_t term = req->term;
>   	uint32_t origin = req->origin_id;
>   	if (txn_limbo_replica_term(limbo, origin) < term) {
> -		vclock_follow(&limbo->promote_term_map, origin, term);
> -		if (term > limbo->promote_greatest_term)
> -			limbo->promote_greatest_term = term;
> +		vclock_follow(&pmt->terms_map, origin, term);
> +		if (term > pmt->terms_max)
> +			pmt->terms_max = term;
>   	} else if (iproto_type_is_promote_request(req->type) &&
> -		   limbo->promote_greatest_term > 1) {
> +		   pmt->terms_max > 1) {
>   		/* PROMOTE for outdated term. Ignore. */
>   		say_info("RAFT: ignoring %s request from instance "
>   			 "id %u for term %llu. Greatest term seen "
>   			 "before (%llu) is bigger.",
>   			 iproto_type_name(req->type), origin, (long long)term,
> -			 (long long)limbo->promote_greatest_term);
> +			 (long long)pmt->terms_max);
>   		return;
>   	}
>   
> diff --git a/src/box/txn_limbo.h b/src/box/txn_limbo.h
> index 53e52f676..70a5fbfd5 100644
> --- a/src/box/txn_limbo.h
> +++ b/src/box/txn_limbo.h
> @@ -75,6 +75,31 @@ txn_limbo_entry_is_complete(const struct txn_limbo_entry *e)
>   	return e->is_commit || e->is_rollback;
>   }
>   
> +/**
> + * Keep state of promote requests to handle split-brain
> + * situation and other errors.
> + */
> +struct txn_limbo_promote {
> +	/**
> +	 * Latest terms received with PROMOTE entries from remote instances.
> +	 * Limbo uses them to filter out the transactions coming not from the
> +	 * limbo owner, but so outdated that they are rolled back everywhere
> +	 * except outdated nodes.
> +	 */
> +	struct vclock terms_map;
> +	/**
> +	 * The biggest PROMOTE term seen by the instance and persisted in WAL.
> +	 * It is related to raft term, but not the same. Synchronous replication
> +	 * represented by the limbo is interested only in the won elections
> +	 * ended with PROMOTE request.
> +	 * It means the limbo's term might be smaller than the raft term, while
> +	 * there are ongoing elections, or the leader is already known and this
> +	 * instance hasn't read its PROMOTE request yet. During other times the
> +	 * limbo and raft are in sync and the terms are the same.
> +	 */
> +	uint64_t terms_max;
> +};
> +
>   /**
>    * Limbo is a place where transactions are stored, which are
>    * finished, but not committed nor rolled back. These are
> @@ -130,23 +155,9 @@ struct txn_limbo {
>   	 */
>   	struct vclock vclock;
>   	/**
> -	 * Latest terms received with PROMOTE entries from remote instances.
> -	 * Limbo uses them to filter out the transactions coming not from the
> -	 * limbo owner, but so outdated that they are rolled back everywhere
> -	 * except outdated nodes.
> -	 */
> -	struct vclock promote_term_map;
> -	/**
> -	 * The biggest PROMOTE term seen by the instance and persisted in WAL.
> -	 * It is related to raft term, but not the same. Synchronous replication
> -	 * represented by the limbo is interested only in the won elections
> -	 * ended with PROMOTE request.
> -	 * It means the limbo's term might be smaller than the raft term, while
> -	 * there are ongoing elections, or the leader is already known and this
> -	 * instance hasn't read its PROMOTE request yet. During other times the
> -	 * limbo and raft are in sync and the terms are the same.
> +	 * Track promote requests.
>   	 */
> -	uint64_t promote_greatest_term;
> +	struct txn_limbo_promote promote;
>   	/**
>   	 * Maximal LSN gathered quorum and either already confirmed in WAL, or
>   	 * whose confirmation is in progress right now. Any attempt to confirm
> @@ -218,7 +229,8 @@ txn_limbo_last_entry(struct txn_limbo *limbo)
>   static inline uint64_t
>   txn_limbo_replica_term(const struct txn_limbo *limbo, uint32_t replica_id)
>   {
> -	return vclock_get(&limbo->promote_term_map, replica_id);
> +	const struct txn_limbo_promote *pmt = &limbo->promote;
> +	return vclock_get(&pmt->terms_map, replica_id);
>   }
>   
>   /**
> @@ -229,8 +241,9 @@ static inline bool
>   txn_limbo_is_replica_outdated(const struct txn_limbo *limbo,
>   			      uint32_t replica_id)
>   {
> +	const struct txn_limbo_promote *pmt = &limbo->promote;
>   	return txn_limbo_replica_term(limbo, replica_id) <
> -	       limbo->promote_greatest_term;
> +	       pmt->terms_max;
>   }
>   
>   /**

-- 
Serge Petrenko

Re: [Tarantool-patches] [RFC v5 3/5] limbo: gather promote tracking into a separate structure

[Cyrill Gorcunov via Tarantool-patches]

On Thu, Jul 15, 2021 at 02:28:46PM +0300, Serge Petrenko wrote:
> > +static void
> > +txn_limbo_promote_create(struct txn_limbo_promote *pmt)
> > +{
> > +	vclock_create(&pmt->terms_map);
> > +	pmt->terms_max = 0;
> > +}
> > +
> 
> I don't like the name (limbo->promote, struct txn_limbo_promote),
> but can't come up with a better one.
> 
> The structure doesn't hold a specific promote. It's more like "promote
> history", or "terms seen".
> 
> Maybe something like "term history" ? "term tracker" ?
> "remote term set", "term set" ?
> 
> Just a suggestion, my names are not too good.

Sure! How about

struct txn_terms {
	latch		lock;
	vclock_t	map;
	uint64_t	map_max;
};

struct txn_limbo {
	...
	struct txn_terms terms;
	...
};

I don't mind for any name (except "set" because
set can't contain duplicated elements and our
vclock can have same term installed for different
replicas)

	Cyrill

Re: [Tarantool-patches] [RFC v5 3/5] limbo: gather promote tracking into a separate structure

[Serge Petrenko via Tarantool-patches]

15.07.2021 14:46, Cyrill Gorcunov пишет:
> On Thu, Jul 15, 2021 at 02:28:46PM +0300, Serge Petrenko wrote:
>>> +static void
>>> +txn_limbo_promote_create(struct txn_limbo_promote *pmt)
>>> +{
>>> +	vclock_create(&pmt->terms_map);
>>> +	pmt->terms_max = 0;
>>> +}
>>> +
>> I don't like the name (limbo->promote, struct txn_limbo_promote),
>> but can't come up with a better one.
>>
>> The structure doesn't hold a specific promote. It's more like "promote
>> history", or "terms seen".
>>
>> Maybe something like "term history" ? "term tracker" ?
>> "remote term set", "term set" ?
>>
>> Just a suggestion, my names are not too good.
> Sure! How about
>
> struct txn_terms {
> 	latch		lock;
> 	vclock_t	map;
> 	uint64_t	map_max;
> };

Maybe txn_limbo_terms then?
txn_terms sounds like something related to transactions,
but transactions know nothing of terms.

> struct txn_limbo {
> 	...
> 	struct txn_terms terms;
> 	...
> };
>
> I don't mind for any name (except "set" because
> set can't contain duplicated elements and our
> vclock can have same term installed for different
> replicas)
>
> 	Cyrill

-- 
Serge Petrenko

Re: [Tarantool-patches] [RFC v5 3/5] limbo: gather promote tracking into a separate structure

[Cyrill Gorcunov via Tarantool-patches]

On Thu, Jul 15, 2021 at 03:00:11PM +0300, Serge Petrenko wrote:
> 
> 
> 15.07.2021 14:46, Cyrill Gorcunov пишет:
> > On Thu, Jul 15, 2021 at 02:28:46PM +0300, Serge Petrenko wrote:
> > > > +static void
> > > > +txn_limbo_promote_create(struct txn_limbo_promote *pmt)
> > > > +{
> > > > +	vclock_create(&pmt->terms_map);
> > > > +	pmt->terms_max = 0;
> > > > +}
> > > > +
> > > I don't like the name (limbo->promote, struct txn_limbo_promote),
> > > but can't come up with a better one.
> > > 
> > > The structure doesn't hold a specific promote. It's more like "promote
> > > history", or "terms seen".
> > > 
> > > Maybe something like "term history" ? "term tracker" ?
> > > "remote term set", "term set" ?
> > > 
> > > Just a suggestion, my names are not too good.
> > Sure! How about
> > 
> > struct txn_terms {
> > 	latch		lock;
> > 	vclock_t	map;
> > 	uint64_t	map_max;
> > };
> 
> Maybe txn_limbo_terms then?
> txn_terms sounds like something related to transactions,
> but transactions know nothing of terms.

Sounds OK! Will rename.

[Tarantool-patches] [RFC v5 4/5] limbo: order access to the promote terms

[Cyrill Gorcunov via Tarantool-patches]

Promote terms tracking is shared between appliers and when
one of appliers is waiting for write to complete inside
journal_write() routine, an other may need to access read
term value to figure out if promote request is valid to
apply. Due to cooperative multitasking access to the terms
is not consistent so we need to be sure that other fibers
either read up to date terms (ie written to the WAL).

For this sake we use latching mechanism, when one fiber
took promote-lock for terms updating other readers are
waiting until update is complete.

For example here is a call graph of two appliers

applier 1
---------
applier_apply_tx
  (promote term = 3
   current max term = 2)
  applier_synchro_filter_tx
  apply_synchro_row
    journal_write
      (sleeping)

at this moment another applier comes in with obsolete
data and term 2

                              applier 2
                              ---------
                              applier_apply_tx
                                (term 2)
                                applier_synchro_filter_tx
                                  txn_limbo_is_replica_outdated -> false
                                journal_write (sleep)

applier 1
---------
journal wakes up
  apply_synchro_row_cb
    set max term to 3

So the applier 2 didn't notice that term 3 is already seen
and wrote obsolete data. With locking the applier 2 will
wait until applier 1 has finished its write.

Part-of #6036

Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
---
 src/box/applier.cc  | 10 +++++---
 src/box/box.cc      |  3 +--
 src/box/txn_limbo.c | 18 ++++++++++++--
 src/box/txn_limbo.h | 59 +++++++++++++++++++++++++++++++++++++++++----
 4 files changed, 78 insertions(+), 12 deletions(-)

diff --git a/src/box/applier.cc b/src/box/applier.cc
index 978383e64..838aa372d 100644
--- a/src/box/applier.cc
+++ b/src/box/applier.cc
@@ -854,7 +854,7 @@ apply_synchro_row_cb(struct journal_entry *entry)
 		applier_rollback_by_wal_io(entry->res);
 	} else {
 		replica_txn_wal_write_cb(synchro_entry->rcb);
-		txn_limbo_process(&txn_limbo, synchro_entry->req);
+		txn_limbo_process_locked(&txn_limbo, synchro_entry->req);
 		trigger_run(&replicaset.applier.on_wal_write, NULL);
 	}
 	fiber_wakeup(synchro_entry->owner);
@@ -870,6 +870,7 @@ apply_synchro_row(uint32_t replica_id, struct xrow_header *row)
 	if (xrow_decode_synchro(row, &req) != 0)
 		goto err;
 
+	txn_limbo_promote_lock(&txn_limbo);
 	struct replica_cb_data rcb_data;
 	struct synchro_entry entry;
 	/*
@@ -907,12 +908,15 @@ apply_synchro_row(uint32_t replica_id, struct xrow_header *row)
 	 * transactions side, including the async ones.
 	 */
 	if (journal_write(&entry.base) != 0)
-		goto err;
+		goto err_unlock;
 	if (entry.base.res < 0) {
 		diag_set_journal_res(entry.base.res);
-		goto err;
+		goto err_unlock;
 	}
+	txn_limbo_promote_unlock(&txn_limbo);
 	return 0;
+err_unlock:
+	txn_limbo_promote_unlock(&txn_limbo);
 err:
 	diag_log();
 	return -1;
diff --git a/src/box/box.cc b/src/box/box.cc
index d211589b5..8b0f9859e 100644
--- a/src/box/box.cc
+++ b/src/box/box.cc
@@ -1566,10 +1566,9 @@ box_clear_synchro_queue(bool demote)
 		 * (synchronous replication and leader election are in sync, and
 		 * both chose this node as a leader).
 		 */
-		if (!demote && txn_limbo_replica_term(&txn_limbo, instance_id) ==
+		if (!demote && txn_limbo_term(&txn_limbo, instance_id) ==
 		    box_raft()->term)
 			return 0;
-
 		break;
 	default:
 		unreachable();
diff --git a/src/box/txn_limbo.c b/src/box/txn_limbo.c
index 957fe0d1e..d24df3606 100644
--- a/src/box/txn_limbo.c
+++ b/src/box/txn_limbo.c
@@ -40,6 +40,7 @@ struct txn_limbo txn_limbo;
 static void
 txn_limbo_promote_create(struct txn_limbo_promote *pmt)
 {
+	latch_create(&pmt->latch);
 	vclock_create(&pmt->terms_map);
 	pmt->terms_max = 0;
 }
@@ -731,12 +732,17 @@ txn_limbo_wait_empty(struct txn_limbo *limbo, double timeout)
 }
 
 void
-txn_limbo_process(struct txn_limbo *limbo, const struct synchro_request *req)
+txn_limbo_process_locked(struct txn_limbo *limbo,
+			 const struct synchro_request *req)
 {
 	struct txn_limbo_promote *pmt = &limbo->promote;
 	uint64_t term = req->term;
 	uint32_t origin = req->origin_id;
-	if (txn_limbo_replica_term(limbo, origin) < term) {
+
+	panic_on(!txn_limbo_promote_is_locked(limbo),
+		 "limbo: unlocked processing of a request");
+
+	if (txn_limbo_term_locked(limbo, origin) < term) {
 		vclock_follow(&pmt->terms_map, origin, term);
 		if (term > pmt->terms_max)
 			pmt->terms_max = term;
@@ -794,6 +800,14 @@ txn_limbo_process(struct txn_limbo *limbo, const struct synchro_request *req)
 	return;
 }
 
+void
+txn_limbo_process(struct txn_limbo *limbo, const struct synchro_request *req)
+{
+	txn_limbo_promote_lock(limbo);
+	txn_limbo_process_locked(limbo, req);
+	txn_limbo_promote_unlock(limbo);
+}
+
 void
 txn_limbo_on_parameters_change(struct txn_limbo *limbo)
 {
diff --git a/src/box/txn_limbo.h b/src/box/txn_limbo.h
index 70a5fbfd5..a2595bcff 100644
--- a/src/box/txn_limbo.h
+++ b/src/box/txn_limbo.h
@@ -31,6 +31,7 @@
  */
 #include "small/rlist.h"
 #include "vclock/vclock.h"
+#include "latch.h"
 
 #include <stdint.h>
 
@@ -80,6 +81,10 @@ txn_limbo_entry_is_complete(const struct txn_limbo_entry *e)
  * situation and other errors.
  */
 struct txn_limbo_promote {
+	/**
+	 * To order access to the promote data.
+	 */
+	struct latch latch;
 	/**
 	 * Latest terms received with PROMOTE entries from remote instances.
 	 * Limbo uses them to filter out the transactions coming not from the
@@ -222,15 +227,52 @@ txn_limbo_last_entry(struct txn_limbo *limbo)
 				in_queue);
 }
 
+/** Lock promote data. */
+static inline void
+txn_limbo_promote_lock(struct txn_limbo *limbo)
+{
+	struct txn_limbo_promote *pmt = &limbo->promote;
+	latch_lock(&pmt->latch);
+}
+
+/** Unlock promote data. */
+static void
+txn_limbo_promote_unlock(struct txn_limbo *limbo)
+{
+	struct txn_limbo_promote *pmt = &limbo->promote;
+	latch_unlock(&pmt->latch);
+}
+
+/** Test if promote data is locked. */
+static inline bool
+txn_limbo_promote_is_locked(struct txn_limbo *limbo)
+{
+	const struct txn_limbo_promote *pmt = &limbo->promote;
+	return latch_is_locked(&pmt->latch);
+}
+
+/** Fetch replica's term with lock taken. */
+static inline uint64_t
+txn_limbo_term_locked(struct txn_limbo *limbo, uint32_t replica_id)
+{
+	struct txn_limbo_promote *pmt = &limbo->promote;
+	panic_on(!txn_limbo_promote_is_locked(limbo),
+		 "limbo: unlocked term read for replica %u",
+		 replica_id);
+	return vclock_get(&pmt->terms_map, replica_id);
+}
+
 /**
  * Return the latest term as seen in PROMOTE requests from instance with id
  * @a replica_id.
  */
 static inline uint64_t
-txn_limbo_replica_term(const struct txn_limbo *limbo, uint32_t replica_id)
+txn_limbo_term(struct txn_limbo *limbo, uint32_t replica_id)
 {
-	const struct txn_limbo_promote *pmt = &limbo->promote;
-	return vclock_get(&pmt->terms_map, replica_id);
+	txn_limbo_promote_lock(limbo);
+	uint64_t v = txn_limbo_term_locked(limbo, replica_id);
+	txn_limbo_promote_unlock(limbo);
+	return v;
 }
 
 /**
@@ -238,12 +280,15 @@ txn_limbo_replica_term(const struct txn_limbo *limbo, uint32_t replica_id)
  * data from it. The check is only valid when elections are enabled.
  */
 static inline bool
-txn_limbo_is_replica_outdated(const struct txn_limbo *limbo,
+txn_limbo_is_replica_outdated(struct txn_limbo *limbo,
 			      uint32_t replica_id)
 {
 	const struct txn_limbo_promote *pmt = &limbo->promote;
-	return txn_limbo_replica_term(limbo, replica_id) <
+	txn_limbo_promote_lock(limbo);
+	bool res = txn_limbo_term_locked(limbo, replica_id) <
 	       pmt->terms_max;
+	txn_limbo_promote_unlock(limbo);
+	return res;
 }
 
 /**
@@ -317,6 +362,10 @@ txn_limbo_wait_complete(struct txn_limbo *limbo, struct txn_limbo_entry *entry);
 void
 txn_limbo_process(struct txn_limbo *limbo, const struct synchro_request *req);
 
+void
+txn_limbo_process_locked(struct txn_limbo *limbo,
+			 const struct synchro_request *req);
+
 /**
  * Waiting for confirmation of all "sync" transactions
  * during confirm timeout or fail.
-- 
2.31.1

Re: [Tarantool-patches] [RFC v5 4/5] limbo: order access to the promote terms

[Serge Petrenko via Tarantool-patches]

15.07.2021 00:23, Cyrill Gorcunov пишет:
> Promote terms tracking is shared between appliers and when
> one of appliers is waiting for write to complete inside
> journal_write() routine, an other may need to access read
> term value to figure out if promote request is valid to
> apply. Due to cooperative multitasking access to the terms
> is not consistent so we need to be sure that other fibers
> either read up to date terms (ie written to the WAL).
>
> For this sake we use latching mechanism, when one fiber
> took promote-lock for terms updating other readers are
> waiting until update is complete.
>
> For example here is a call graph of two appliers
>
> applier 1
> ---------
> applier_apply_tx
>    (promote term = 3
>     current max term = 2)
>    applier_synchro_filter_tx
>    apply_synchro_row
>      journal_write
>        (sleeping)
>
> at this moment another applier comes in with obsolete
> data and term 2
>
>                                applier 2
>                                ---------
>                                applier_apply_tx
>                                  (term 2)
>                                  applier_synchro_filter_tx
>                                    txn_limbo_is_replica_outdated -> false
>                                  journal_write (sleep)
>
> applier 1
> ---------
> journal wakes up
>    apply_synchro_row_cb
>      set max term to 3
>
> So the applier 2 didn't notice that term 3 is already seen
> and wrote obsolete data. With locking the applier 2 will
> wait until applier 1 has finished its write.
>
> Part-of #6036
>
> Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
> ---
>   src/box/applier.cc  | 10 +++++---
>   src/box/box.cc      |  3 +--
>   src/box/txn_limbo.c | 18 ++++++++++++--
>   src/box/txn_limbo.h | 59 +++++++++++++++++++++++++++++++++++++++++----
>   4 files changed, 78 insertions(+), 12 deletions(-)

Thanks for the patch!

I think all panic_on(!cond) invocations may be replaced with assert(cond)

Even if we use some functions incorrectly, this may be catched by an 
assertion.

Other than that looks good so far.
> diff --git a/src/box/applier.cc b/src/box/applier.cc
> index 978383e64..838aa372d 100644
> --- a/src/box/applier.cc
> +++ b/src/box/applier.cc
> @@ -854,7 +854,7 @@ apply_synchro_row_cb(struct journal_entry *entry)
>   		applier_rollback_by_wal_io(entry->res);
>   	} else {
>   		replica_txn_wal_write_cb(synchro_entry->rcb);
> -		txn_limbo_process(&txn_limbo, synchro_entry->req);
> +		txn_limbo_process_locked(&txn_limbo, synchro_entry->req);
>   		trigger_run(&replicaset.applier.on_wal_write, NULL);
>   	}
>   	fiber_wakeup(synchro_entry->owner);
> @@ -870,6 +870,7 @@ apply_synchro_row(uint32_t replica_id, struct xrow_header *row)
>   	if (xrow_decode_synchro(row, &req) != 0)
>   		goto err;
>   
> +	txn_limbo_promote_lock(&txn_limbo);
>   	struct replica_cb_data rcb_data;
>   	struct synchro_entry entry;
>   	/*
> @@ -907,12 +908,15 @@ apply_synchro_row(uint32_t replica_id, struct xrow_header *row)
>   	 * transactions side, including the async ones.
>   	 */
>   	if (journal_write(&entry.base) != 0)
> -		goto err;
> +		goto err_unlock;
>   	if (entry.base.res < 0) {
>   		diag_set_journal_res(entry.base.res);
> -		goto err;
> +		goto err_unlock;
>   	}
> +	txn_limbo_promote_unlock(&txn_limbo);
>   	return 0;
> +err_unlock:
> +	txn_limbo_promote_unlock(&txn_limbo);
>   err:
>   	diag_log();
>   	return -1;
> diff --git a/src/box/box.cc b/src/box/box.cc
> index d211589b5..8b0f9859e 100644
> --- a/src/box/box.cc
> +++ b/src/box/box.cc
> @@ -1566,10 +1566,9 @@ box_clear_synchro_queue(bool demote)
>   		 * (synchronous replication and leader election are in sync, and
>   		 * both chose this node as a leader).
>   		 */
> -		if (!demote && txn_limbo_replica_term(&txn_limbo, instance_id) ==
> +		if (!demote && txn_limbo_term(&txn_limbo, instance_id) ==
>   		    box_raft()->term)
>   			return 0;
> -
>   		break;
>   	default:
>   		unreachable();
> diff --git a/src/box/txn_limbo.c b/src/box/txn_limbo.c
> index 957fe0d1e..d24df3606 100644
> --- a/src/box/txn_limbo.c
> +++ b/src/box/txn_limbo.c
> @@ -40,6 +40,7 @@ struct txn_limbo txn_limbo;
>   static void
>   txn_limbo_promote_create(struct txn_limbo_promote *pmt)
>   {
> +	latch_create(&pmt->latch);
>   	vclock_create(&pmt->terms_map);
>   	pmt->terms_max = 0;
>   }
> @@ -731,12 +732,17 @@ txn_limbo_wait_empty(struct txn_limbo *limbo, double timeout)
>   }
>   
>   void
> -txn_limbo_process(struct txn_limbo *limbo, const struct synchro_request *req)
> +txn_limbo_process_locked(struct txn_limbo *limbo,
> +			 const struct synchro_request *req)
>   {
>   	struct txn_limbo_promote *pmt = &limbo->promote;
>   	uint64_t term = req->term;
>   	uint32_t origin = req->origin_id;
> -	if (txn_limbo_replica_term(limbo, origin) < term) {
> +
> +	panic_on(!txn_limbo_promote_is_locked(limbo),
> +		 "limbo: unlocked processing of a request");
> +
> +	if (txn_limbo_term_locked(limbo, origin) < term) {
>   		vclock_follow(&pmt->terms_map, origin, term);
>   		if (term > pmt->terms_max)
>   			pmt->terms_max = term;
> @@ -794,6 +800,14 @@ txn_limbo_process(struct txn_limbo *limbo, const struct synchro_request *req)
>   	return;
>   }
>   
> +void
> +txn_limbo_process(struct txn_limbo *limbo, const struct synchro_request *req)
> +{
> +	txn_limbo_promote_lock(limbo);
> +	txn_limbo_process_locked(limbo, req);
> +	txn_limbo_promote_unlock(limbo);
> +}
> +
>   void
>   txn_limbo_on_parameters_change(struct txn_limbo *limbo)
>   {
> diff --git a/src/box/txn_limbo.h b/src/box/txn_limbo.h
> index 70a5fbfd5..a2595bcff 100644
> --- a/src/box/txn_limbo.h
> +++ b/src/box/txn_limbo.h
> @@ -31,6 +31,7 @@
>    */
>   #include "small/rlist.h"
>   #include "vclock/vclock.h"
> +#include "latch.h"
>   
>   #include <stdint.h>
>   
> @@ -80,6 +81,10 @@ txn_limbo_entry_is_complete(const struct txn_limbo_entry *e)
>    * situation and other errors.
>    */
>   struct txn_limbo_promote {
> +	/**
> +	 * To order access to the promote data.
> +	 */
> +	struct latch latch;
>   	/**
>   	 * Latest terms received with PROMOTE entries from remote instances.
>   	 * Limbo uses them to filter out the transactions coming not from the
> @@ -222,15 +227,52 @@ txn_limbo_last_entry(struct txn_limbo *limbo)
>   				in_queue);
>   }
>   
> +/** Lock promote data. */
> +static inline void
> +txn_limbo_promote_lock(struct txn_limbo *limbo)
> +{
> +	struct txn_limbo_promote *pmt = &limbo->promote;
> +	latch_lock(&pmt->latch);
> +}
> +
> +/** Unlock promote data. */
> +static void
> +txn_limbo_promote_unlock(struct txn_limbo *limbo)
> +{
> +	struct txn_limbo_promote *pmt = &limbo->promote;
> +	latch_unlock(&pmt->latch);
> +}
> +
> +/** Test if promote data is locked. */
> +static inline bool
> +txn_limbo_promote_is_locked(struct txn_limbo *limbo)
> +{
> +	const struct txn_limbo_promote *pmt = &limbo->promote;
> +	return latch_is_locked(&pmt->latch);
> +}
> +
> +/** Fetch replica's term with lock taken. */
> +static inline uint64_t
> +txn_limbo_term_locked(struct txn_limbo *limbo, uint32_t replica_id)
> +{
> +	struct txn_limbo_promote *pmt = &limbo->promote;
> +	panic_on(!txn_limbo_promote_is_locked(limbo),
> +		 "limbo: unlocked term read for replica %u",
> +		 replica_id);
> +	return vclock_get(&pmt->terms_map, replica_id);
> +}
> +
>   /**
>    * Return the latest term as seen in PROMOTE requests from instance with id
>    * @a replica_id.
>    */
>   static inline uint64_t
> -txn_limbo_replica_term(const struct txn_limbo *limbo, uint32_t replica_id)
> +txn_limbo_term(struct txn_limbo *limbo, uint32_t replica_id)
>   {
> -	const struct txn_limbo_promote *pmt = &limbo->promote;
> -	return vclock_get(&pmt->terms_map, replica_id);
> +	txn_limbo_promote_lock(limbo);
> +	uint64_t v = txn_limbo_term_locked(limbo, replica_id);
> +	txn_limbo_promote_unlock(limbo);
> +	return v;
>   }
>   
>   /**
> @@ -238,12 +280,15 @@ txn_limbo_replica_term(const struct txn_limbo *limbo, uint32_t replica_id)
>    * data from it. The check is only valid when elections are enabled.
>    */
>   static inline bool
> -txn_limbo_is_replica_outdated(const struct txn_limbo *limbo,
> +txn_limbo_is_replica_outdated(struct txn_limbo *limbo,
>   			      uint32_t replica_id)
>   {
>   	const struct txn_limbo_promote *pmt = &limbo->promote;
> -	return txn_limbo_replica_term(limbo, replica_id) <
> +	txn_limbo_promote_lock(limbo);
> +	bool res = txn_limbo_term_locked(limbo, replica_id) <
>   	       pmt->terms_max;
> +	txn_limbo_promote_unlock(limbo);
> +	return res;
>   }
>   
>   /**
> @@ -317,6 +362,10 @@ txn_limbo_wait_complete(struct txn_limbo *limbo, struct txn_limbo_entry *entry);
>   void
>   txn_limbo_process(struct txn_limbo *limbo, const struct synchro_request *req);
>   
> +void
> +txn_limbo_process_locked(struct txn_limbo *limbo,
> +			 const struct synchro_request *req);
> +
>   /**
>    * Waiting for confirmation of all "sync" transactions
>    * during confirm timeout or fail.

-- 
Serge Petrenko

Re: [Tarantool-patches] [RFC v5 4/5] limbo: order access to the promote terms

[Cyrill Gorcunov via Tarantool-patches]

On Thu, Jul 15, 2021 at 02:48:48PM +0300, Serge Petrenko wrote:
> 
> I think all panic_on(!cond) invocations may be replaced with assert(cond)
> 
> Even if we use some functions incorrectly, this may be catched by an
> assertion.

You know, initially I thought of using assert as well but then
realized that our test's coverage is far from being perfect
so that if we manage to miss locking, the results are really
awfull - data become inconsistent as far as I understand. So
I would prefer to have panic_on here. But if you still prefer
assert then sure, I'll drop panic_on.

[Tarantool-patches] [RFC v5 5/5] limbo: filter incoming requests

[Cyrill Gorcunov via Tarantool-patches]

FIXME: This is incomplete PoC

Closes #6036

Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
---
 src/box/applier.cc  |  3 +++
 src/box/txn_limbo.c | 52 ++++++++++++++++++++++++++++++++++++---------
 src/box/txn_limbo.h |  9 +++++++-
 3 files changed, 53 insertions(+), 11 deletions(-)

diff --git a/src/box/applier.cc b/src/box/applier.cc
index 838aa372d..c3f3a154a 100644
--- a/src/box/applier.cc
+++ b/src/box/applier.cc
@@ -871,6 +871,9 @@ apply_synchro_row(uint32_t replica_id, struct xrow_header *row)
 		goto err;
 
 	txn_limbo_promote_lock(&txn_limbo);
+	if (txn_limbo_filter_locked(&txn_limbo, &req) != 0)
+		goto err_unlock;
+
 	struct replica_cb_data rcb_data;
 	struct synchro_entry entry;
 	/*
diff --git a/src/box/txn_limbo.c b/src/box/txn_limbo.c
index d24df3606..330ba57b2 100644
--- a/src/box/txn_limbo.c
+++ b/src/box/txn_limbo.c
@@ -731,6 +731,40 @@ txn_limbo_wait_empty(struct txn_limbo *limbo, double timeout)
 	return 0;
 }
 
+int
+txn_limbo_filter_locked(struct txn_limbo *limbo,
+			const struct synchro_request *req)
+{
+	struct txn_limbo_promote *pmt = &limbo->promote;
+	uint32_t replica_id = req->origin_id;
+	uint64_t term = req->term;
+
+	panic_on(!txn_limbo_promote_is_locked(limbo),
+		 "limbo: unlocked filtering of a request");
+
+	/*
+	 * In case of split brain has happened the promote
+	 * request may come in with already seen term.
+	 */
+	uint64_t seen_term = txn_limbo_term_locked(limbo, replica_id);
+	if (seen_term >= term) {
+		if (iproto_type_is_promote_request(req->type) &&
+		    pmt->terms_max > 1) {
+			say_info("RAFT: rejecting %s obsolete request "
+				 "from instance id %u term %llu. "
+				 "Current max term %llu.",
+				 iproto_type_name(req->type),
+				 replica_id, (long long)term,
+				 (long long)pmt->terms_max);
+			diag_set(ClientError, ER_UNSUPPORTED,
+				 "Replication", "obsolete terms");
+			return -1;
+		}
+	}
+
+	return 0;
+}
+
 void
 txn_limbo_process_locked(struct txn_limbo *limbo,
 			 const struct synchro_request *req)
@@ -742,19 +776,14 @@ txn_limbo_process_locked(struct txn_limbo *limbo,
 	panic_on(!txn_limbo_promote_is_locked(limbo),
 		 "limbo: unlocked processing of a request");
 
+	/*
+	 * Update promote tracking since bad requests must
+	 * be filtered out already.
+	 */
 	if (txn_limbo_term_locked(limbo, origin) < term) {
 		vclock_follow(&pmt->terms_map, origin, term);
 		if (term > pmt->terms_max)
 			pmt->terms_max = term;
-	} else if (iproto_type_is_promote_request(req->type) &&
-		   pmt->terms_max > 1) {
-		/* PROMOTE for outdated term. Ignore. */
-		say_info("RAFT: ignoring %s request from instance "
-			 "id %u for term %llu. Greatest term seen "
-			 "before (%llu) is bigger.",
-			 iproto_type_name(req->type), origin, (long long)term,
-			 (long long)pmt->terms_max);
-		return;
 	}
 
 	int64_t lsn = req->lsn;
@@ -800,12 +829,15 @@ txn_limbo_process_locked(struct txn_limbo *limbo,
 	return;
 }
 
-void
+int
 txn_limbo_process(struct txn_limbo *limbo, const struct synchro_request *req)
 {
 	txn_limbo_promote_lock(limbo);
+	if (txn_limbo_filter_locked(limbo, req) != 0)
+		return -1;
 	txn_limbo_process_locked(limbo, req);
 	txn_limbo_promote_unlock(limbo);
+	return 0;
 }
 
 void
diff --git a/src/box/txn_limbo.h b/src/box/txn_limbo.h
index a2595bcff..bfdfef0e0 100644
--- a/src/box/txn_limbo.h
+++ b/src/box/txn_limbo.h
@@ -358,8 +358,15 @@ txn_limbo_ack(struct txn_limbo *limbo, uint32_t replica_id, int64_t lsn);
 int
 txn_limbo_wait_complete(struct txn_limbo *limbo, struct txn_limbo_entry *entry);
 
+/**
+ * Verify if the request is valid for processing.
+ */
+int
+txn_limbo_filter_locked(struct txn_limbo *limbo,
+			const struct synchro_request *req);
+
 /** Execute a synchronous replication request. */
-void
+int
 txn_limbo_process(struct txn_limbo *limbo, const struct synchro_request *req);
 
 void
-- 
2.31.1

Re: [Tarantool-patches] [RFC v5 5/5] limbo: filter incoming requests

[Serge Petrenko via Tarantool-patches]

15.07.2021 00:23, Cyrill Gorcunov пишет:
> FIXME: This is incomplete PoC
>
> Closes #6036
>
> Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
> ---
>   src/box/applier.cc  |  3 +++
>   src/box/txn_limbo.c | 52 ++++++++++++++++++++++++++++++++++++---------
>   src/box/txn_limbo.h |  9 +++++++-
>   3 files changed, 53 insertions(+), 11 deletions(-)
>
> diff --git a/src/box/applier.cc b/src/box/applier.cc
> index 838aa372d..c3f3a154a 100644
> --- a/src/box/applier.cc
> +++ b/src/box/applier.cc
> @@ -871,6 +871,9 @@ apply_synchro_row(uint32_t replica_id, struct xrow_header *row)
>   		goto err;
>   
>   	txn_limbo_promote_lock(&txn_limbo);
> +	if (txn_limbo_filter_locked(&txn_limbo, &req) != 0)
> +		goto err_unlock;
> +
>   	struct replica_cb_data rcb_data;
>   	struct synchro_entry entry;
>   	/*
> diff --git a/src/box/txn_limbo.c b/src/box/txn_limbo.c
> index d24df3606..330ba57b2 100644
> --- a/src/box/txn_limbo.c
> +++ b/src/box/txn_limbo.c
> @@ -731,6 +731,40 @@ txn_limbo_wait_empty(struct txn_limbo *limbo, double timeout)
>   	return 0;
>   }
>   
> +int
> +txn_limbo_filter_locked(struct txn_limbo *limbo,
> +			const struct synchro_request *req)
> +{
> +	struct txn_limbo_promote *pmt = &limbo->promote;
> +	uint32_t replica_id = req->origin_id;
> +	uint64_t term = req->term;
> +
> +	panic_on(!txn_limbo_promote_is_locked(limbo),
> +		 "limbo: unlocked filtering of a request");
> +
> +	/*
> +	 * In case of split brain has happened the promote
> +	 * request may come in with already seen term.
> +	 */
> +	uint64_t seen_term = txn_limbo_term_locked(limbo, replica_id);

You need to filter by "term_max". Any term smaller than "term_max"
is bad.

> +	if (seen_term >= term) {
> +		if (iproto_type_is_promote_request(req->type) &&
> +		    pmt->terms_max > 1) {
> +			say_info("RAFT: rejecting %s obsolete request "
> +				 "from instance id %u term %llu. "
> +				 "Current max term %llu.",
> +				 iproto_type_name(req->type),
> +				 replica_id, (long long)term,
> +				 (long long)pmt->terms_max);
> +			diag_set(ClientError, ER_UNSUPPORTED,
> +				 "Replication", "obsolete terms");
> +			return -1;
> +		}
> +	}
> +
> +	return 0;
> +}
> +
>   void
>   txn_limbo_process_locked(struct txn_limbo *limbo,
>   			 const struct synchro_request *req)
> @@ -742,19 +776,14 @@ txn_limbo_process_locked(struct txn_limbo *limbo,
>   	panic_on(!txn_limbo_promote_is_locked(limbo),
>   		 "limbo: unlocked processing of a request");
>   
> +	/*
> +	 * Update promote tracking since bad requests must
> +	 * be filtered out already.
> +	 */
>   	if (txn_limbo_term_locked(limbo, origin) < term) {

Filtering was done above,  shouldn't this if(() always evaluate to true now?

>   		vclock_follow(&pmt->terms_map, origin, term);
>   		if (term > pmt->terms_max)
>   			pmt->terms_max = term;
> -	} else if (iproto_type_is_promote_request(req->type) &&
> -		   pmt->terms_max > 1) {
> -		/* PROMOTE for outdated term. Ignore. */
> -		say_info("RAFT: ignoring %s request from instance "
> -			 "id %u for term %llu. Greatest term seen "
> -			 "before (%llu) is bigger.",
> -			 iproto_type_name(req->type), origin, (long long)term,
> -			 (long long)pmt->terms_max);
> -		return;
>   	}
>   
>   	int64_t lsn = req->lsn;
> @@ -800,12 +829,15 @@ txn_limbo_process_locked(struct txn_limbo *limbo,
>   	return;
>   }
>   
> -void
> +int
>   txn_limbo_process(struct txn_limbo *limbo, const struct synchro_request *req)
>   {
>   	txn_limbo_promote_lock(limbo);
> +	if (txn_limbo_filter_locked(limbo, req) != 0)
> +		return -1;
>   	txn_limbo_process_locked(limbo, req);
>   	txn_limbo_promote_unlock(limbo);
> +	return 0;
>   }
>   
>   void
> diff --git a/src/box/txn_limbo.h b/src/box/txn_limbo.h
> index a2595bcff..bfdfef0e0 100644
> --- a/src/box/txn_limbo.h
> +++ b/src/box/txn_limbo.h
> @@ -358,8 +358,15 @@ txn_limbo_ack(struct txn_limbo *limbo, uint32_t replica_id, int64_t lsn);
>   int
>   txn_limbo_wait_complete(struct txn_limbo *limbo, struct txn_limbo_entry *entry);
>   
> +/**
> + * Verify if the request is valid for processing.
> + */
> +int
> +txn_limbo_filter_locked(struct txn_limbo *limbo,
> +			const struct synchro_request *req);
> +
>   /** Execute a synchronous replication request. */
> -void
> +int
>   txn_limbo_process(struct txn_limbo *limbo, const struct synchro_request *req);
>   
>   void

-- 
Serge Petrenko