8270317: Large Allocation in CipherSuite #4783

cliveverghese · 2021-07-14T17:06:02Z

Benchmark results

I have benchmarked 3 cases.

The current situation.

Benchmark                                                        (cipherSuite)  Mode  Cnt    Score   Error  Units
CipherSuiteBench.benchmarkCipherSuite                   TLS_AES_256_GCM_SHA384  avgt   25  124.783 ? 2.050  ns/op
CipherSuiteBench.benchmarkCipherSuite  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384  avgt   25  125.403 ? 0.554  ns/op
CipherSuiteBench.benchmarkCipherSuite      TLS_DHE_DSS_WITH_AES_128_CBC_SHA256  avgt   25  127.117 ? 0.789  ns/op
CipherSuiteBench.benchmarkCipherSuite         TLS_DHE_RSA_WITH_AES_256_CBC_SHA  avgt   25  127.869 ? 1.112  ns/op

Use static final array instead of calling CipherSuite.values each time.

Benchmark                                                        (cipherSuite)  Mode  Cnt   Score   Error  Units
CipherSuiteBench.benchmarkCipherSuite                   TLS_AES_256_GCM_SHA384  avgt   25  10.146 ? 0.252  ns/op
CipherSuiteBench.benchmarkCipherSuite  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384  avgt   25  30.501 ? 0.207  ns/op
CipherSuiteBench.benchmarkCipherSuite      TLS_DHE_DSS_WITH_AES_128_CBC_SHA256  avgt   25  47.375 ? 0.150  ns/op
CipherSuiteBench.benchmarkCipherSuite         TLS_DHE_RSA_WITH_AES_256_CBC_SHA  avgt   25  55.887 ? 3.786  ns/op

Using Hashmap for lookup instead of iterating through the array each time. (Method in this PR)

Benchmark                                                        (cipherSuite)  Mode  Cnt   Score   Error  Units
CipherSuiteBench.benchmarkCipherSuite                   TLS_AES_256_GCM_SHA384  avgt   25  13.533 ? 0.148  ns/op
CipherSuiteBench.benchmarkCipherSuite  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384  avgt   25  11.269 ? 0.147  ns/op
CipherSuiteBench.benchmarkCipherSuite      TLS_DHE_DSS_WITH_AES_128_CBC_SHA256  avgt   25  11.507 ? 0.107  ns/op
CipherSuiteBench.benchmarkCipherSuite         TLS_DHE_RSA_WITH_AES_256_CBC_SHA  avgt   25  10.932 ? 0.146  ns/op

I have picked 4 cipher suite from the start of the list and are roughly 10 positions apart. I have opted to go with HashMap for name and id lookup as they provide a more consistent times and benchmarks are similar for the first few cipher suits in the enum as well.

Progress

Change must not contain extraneous whitespace
Commit message must refer to an issue
Change must be properly reviewed

Issue

JDK-8270317: Large Allocation in CipherSuite

Reviewers

@djelinski (no known github.com user name / role) ⚠️ Review applies to 158714c
Xue-Lei Andrew Fan (@XueleiFan - Reviewer) ⚠️ Review applies to c0a21c5
Volker Simonis (@simonis - Reviewer) ⚠️ Review applies to 6e75c82

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.java.net/jdk pull/4783/head:pull/4783
$ git checkout pull/4783

Update a local copy of the PR:
$ git checkout pull/4783
$ git pull https://git.openjdk.java.net/jdk pull/4783/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 4783

View PR using the GUI difftool:
$ git pr show -t 4783

Using diff file

Download this PR as a diff file:
https://git.openjdk.java.net/jdk/pull/4783.diff

bridgekeeper · 2021-07-14T17:06:32Z

👋 Welcome back cverghese! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2021-07-14T17:08:20Z

@cliveverghese The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2021-07-14T17:13:30Z

Webrevs

XueleiFan · 2021-07-14T19:30:23Z

Hi Clive Verghese,

The performance improve is impressive to me. Would you mind have an additional benchmark for the throughput (@BenchmarkMode(Mode.Throughput))? I guess the throughput should be good as well.

Thanks!

djelinski

The benchmark you provided looks a bit odd... In variant 1 best and worst cases differ by 3 ns, and in variant 2 they differ by 45 ns. The algorithm is supposed to be the same, so... Where does the difference come from?

src/java.base/share/classes/sun/security/ssl/CipherSuite.java

navyxliu · 2021-07-14T21:18:23Z

src/java.base/share/classes/sun/security/ssl/CipherSuite.java

+            maps_id.put(cs.id, cs);
+            maps_name.put(cs.name, cs);
+            for (String alias : cs.aliases) {
+                maps_name.put(alias, cs);


A minor concern here. HashMap can't have duplicate keys. what if there are duplicated names/aliases?

Even it's not the case now, CipherSuite is subject to change in the future and I think it is a good opportunity to detect key duplication here. Currently, it's silently overwritten. This may introduce inconsistent behavior for nameOf.

this could be potentially stored in immutable collections which might be slightly more compact + they throw when they encounter duplicate keys

change base type to Map

copy ciphers array into Map.Entry array

maps_id = Map.ofEntries(entries) // + handle IAE

similar for the name map but with a list in between.

there might be a JDK internal shortcut to get to new ImmutableCollections.MapN<>(flatArray) right away without the Map.Entry step - I am sure a reviewer will chime in if there is.

Thank you for the feedback. I have updated to use ImmutableMap. However, I had to use copyOf(Map) method instead.

It would not check for duplicate values. Would it make more sense to add a test case to check for duplicates instead?. If so I can add that, else i'll check for duplicate while creating the map.

cliveverghese · 2021-07-15T17:51:18Z

Hi Clive Verghese,

The performance improve is impressive to me. Would you mind have an additional benchmark for the throughput (@BenchmarkMode(Mode.Throughput))? I guess the throughput should be good as well.

Thanks!

Sure, I'll add the Throughput mode and run the benchmarks.

The benchmark you provided looks a bit odd... In variant 1 best and worst cases differ by 3 ns, and in variant 2 they differ by 45 ns. The algorithm is supposed to be the same, so... Where does the difference come from?

I'll rerun the benchmarks with larger iterations and investigate a bit further to understand this difference. Thank you for point it out.

cliveverghese · 2021-07-21T23:51:17Z

Updated Benchmarks in Throughput mode

Current

Benchmark                                                        (cipherSuite)   Mode  Cnt     Score     Error   Units
CipherSuiteBench.benchmarkCipherSuite                   TLS_AES_256_GCM_SHA384  thrpt   25  8050.787 ? 232.335  ops/ms
CipherSuiteBench.benchmarkCipherSuite  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384  thrpt   25  8165.124 ? 283.718  ops/ms
CipherSuiteBench.benchmarkCipherSuite      TLS_DHE_DSS_WITH_AES_128_CBC_SHA256  thrpt   25  7827.758 ? 293.311  ops/ms
CipherSuiteBench.benchmarkCipherSuite         TLS_DHE_RSA_WITH_AES_256_CBC_SHA  thrpt   25  7768.286 ? 181.399  ops/ms

ArrayList

Benchmark                                                        (cipherSuite)   Mode  Cnt    Score   Error   Units
CipherSuiteBench.benchmarkCipherSuite                   TLS_AES_256_GCM_SHA384  thrpt   25  100.626 ? 0.294  ops/us
CipherSuiteBench.benchmarkCipherSuite  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384  thrpt   25   32.793 ? 0.804  ops/us
CipherSuiteBench.benchmarkCipherSuite      TLS_DHE_DSS_WITH_AES_128_CBC_SHA256  thrpt   25   21.162 ? 0.217  ops/us
CipherSuiteBench.benchmarkCipherSuite         TLS_DHE_RSA_WITH_AES_256_CBC_SHA  thrpt   25   18.220 ? 0.903  ops/us

Hashmap

Benchmark                                                        (cipherSuite)   Mode  Cnt   Score   Error   Units
CipherSuiteBench.benchmarkCipherSuite                   TLS_AES_256_GCM_SHA384  thrpt   25  63.836 ? 4.517  ops/us
CipherSuiteBench.benchmarkCipherSuite  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384  thrpt   25  69.983 ? 8.965  ops/us
CipherSuiteBench.benchmarkCipherSuite      TLS_DHE_DSS_WITH_AES_128_CBC_SHA256  thrpt   25  68.091 ? 7.404  ops/us
CipherSuiteBench.benchmarkCipherSuite         TLS_DHE_RSA_WITH_AES_256_CBC_SHA  thrpt   25  52.831 ? 4.317  ops/us

I am currently looking into the JFR profiles to identify why there is a difference in benchmarks with regards the different cipher suits in the current version vs the arraylist.

XueleiFan · 2021-07-22T00:11:56Z

Updated Benchmarks in Throughput mode

Thank you very much for the update.

I am currently looking into the JFR profiles to identify why there is a difference in benchmarks with regards the different cipher suits in the current version vs the arraylist.

I guess the garbage collection plays a role here.

cliveverghese · 2021-07-22T00:44:11Z

I am currently looking into the JFR profiles to identify why there is a difference in benchmarks with regards the different cipher suits in the current version vs the arraylist.

I guess the garbage collection plays a role here.

Yes, from the JFR profiles it looks like this could be from the GC.

XueleiFan · 2021-07-22T00:26:54Z

src/java.base/share/classes/sun/security/ssl/CipherSuite.java

+    private static final Map<Integer, CipherSuite> maps_id;
+    private static final Map<String, CipherSuite> maps_name;
+    private static final CipherSuite[] ciphers = CipherSuite.values();


Generally, Java follows camel-case syntax for names. It would be good to keep the coding style consistent and use instinctive names. I may use names like "cipherSuiteIds", "cipherSuiteNames" and "cipherSuites" for the above three fields.

XueleiFan · 2021-07-22T00:57:17Z

src/java.base/share/classes/sun/security/ssl/CipherSuite.java

-            if (cs.id == id) {
-                return cs.name;
-            }
+        String name = maps_id.get(id).name;


I guess get() may return null. It may be safe to check the return value of get():

CipherSuite cipherSuite = cipherSuiteIds.get(id); if (cipherSuite != null) { return cipherSuite.name; }

XueleiFan · 2021-07-22T05:07:28Z

src/java.base/share/classes/sun/security/ssl/CipherSuite.java

        }

        return "UNKNOWN-CIPHER-SUITE(" + Utilities.byte16HexString(id) + ")";
    }

    static Collection<CipherSuite> allowedCipherSuites() {
        Collection<CipherSuite> cipherSuites = new LinkedList<>();
-        for (CipherSuite cs : CipherSuite.values()) {
+        for (CipherSuite cs : ciphers) {


It may worthy of a static class field for the allowed cipher suites.

XueleiFan · 2021-07-22T05:07:42Z

src/java.base/share/classes/sun/security/ssl/CipherSuite.java

@@ -940,7 +942,7 @@ static String nameOf(int id) {

    static Collection<CipherSuite> defaultCipherSuites() {
        Collection<CipherSuite> cipherSuites = new LinkedList<>();
-        for (CipherSuite cs : CipherSuite.values()) {
+        for (CipherSuite cs : ciphers) {


It may worthy of a static class field for the default cipher suites.

XueleiFan · 2021-07-22T05:11:40Z

src/java.base/share/classes/sun/security/ssl/CipherSuite.java

-            for (CipherSuite cs : CipherSuite.values()) {
+            for (CipherSuite cs : ciphers) {


If there is a static allowed cipher suite list, the logic here could be simplified to use the allowed cipher suite list. Then, the "ciphers" class filed may be not needed any longer.

cliveverghese · 2021-07-22T18:34:17Z

Hi @XueleiFan, Thank you for the feedback. I have update the pull requests addressing your comments.

XueleiFan

Looks good to me. Thank you!

XueleiFan · 2021-07-22T18:50:08Z

src/java.base/share/classes/sun/security/ssl/CipherSuite.java

+        Map<String, CipherSuite> names = new HashMap<>();
+        List<CipherSuite> allowedCS = new ArrayList<>();
+        List<CipherSuite> defaultCS = new ArrayList<>();
+        for(CipherSuite cs : CipherSuite.values()) {


I may add blank lines before and after the for-loop block.

Than you @XueleiFan for approving the PR.

I have added the blank lines before and after the PR.

openjdk · 2021-07-22T18:54:03Z

@cliveverghese This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8270317: Large Allocation in CipherSuite

Reviewed-by: xuelei, simonis

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 145 new commits pushed to the master branch:

7468bbc: 8266988: compiler/jvmci/compilerToVM/IsMatureTest.java fails with Unexpected isMature state for multiple times invoked method: expected false to equal true
286106d: 8271219: [REDO] JDK-8271063 Print injected fields for InstanceKlass
a1c0a6a: 8199594: Add doc describing how (?x) ignores spaces in character classes
4ed548b: 8268261: C2: assert(n != __null) failed: Bad immediate dominator info.
ec71e2d: 8271221: [BACKOUT] JDK-8271063 Print injected fields for InstanceKlass
f4b3ee5: 8270280: security/infra/java/security/cert/CertPathValidator/certification/LetsEncryptCA.java OCSP response error
45abbee: 8243543: jtreg test security/infra/java/security/cert/CertPathValidator/certification/BuypassCA.java fails
c9251db: 8271209: Fix doc comment typos in JavadocTokenizer
96247ae: 8270187: G1: Remove ConcGCThreads constraint
9b27df6: 8271063: Print injected fields for InstanceKlass
... and 135 more: https://git.openjdk.java.net/jdk/compare/9cac94d581f240c10fe8fff2f803109a1ae30637...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

As you do not have Committer status in this project an existing Committer must agree to sponsor your change. Possible candidates are the reviewers of this PR (@XueleiFan, @simonis) but any other Committer may sponsor as well.

➡️ To flag this PR as ready for integration with the above commit message, type /integrate in a new comment. (Afterwards, your sponsor types /sponsor in a new comment to perform the integration).

djelinski · 2021-07-23T05:52:25Z

src/java.base/share/classes/sun/security/ssl/CipherSuite.java

-                } else {
-                    // values() is ordered, remaining cipher suites are
-                    // not supported.
+            for (CipherSuite cs : allowedCipherSuites) {


We can avoid this loop; look up the cipher by name first (cs = nameOf(name)), then check for supported protocols.
Other than that, LGTM.

Thank you for the feedback. I have updated the loop accordingly.

XueleiFan · 2021-07-23T17:05:58Z

src/java.base/share/classes/sun/security/ssl/CipherSuite.java

-                    break;
-                }
+            CipherSuite cs;
+            if ((cs = cipherSuiteNames.get(name)) != null && !cs.supportedProtocols.isEmpty()) {


Nice update! I appreciate if you could avoid lines longer than 80 characters, since they’re not handled well by many terminals and tools (See Java Code Conventions).

Thank you @XueleiFan, Updated the length of the line.

Thank you for the update. This PR looks good to me, and I have no further comment.

simonis

This change looks good to me except the vary minor fact that the test has no newline at the end of the file. I wonder why jcheck hasn't caught this issue. If I remember right it did it in the old Mercurial version.
I'd appreciate if you could fix that as well before integrating (and no need for a new review from my side). I'll sponsor the change one you integrate.

Thanks for this nice improvement!

cliveverghese · 2021-07-23T22:52:55Z

/integrate

openjdk · 2021-07-23T22:54:04Z

@cliveverghese
Your change (at version b0375b2) is now ready to be sponsored by a Committer.

simonis · 2021-07-24T10:13:26Z

/sponsor

openjdk · 2021-07-24T10:15:05Z

Going to push as commit e627cae.
Since your change was applied there have been 149 commits pushed to the master branch:

0dcfc42: Merge
8adf008: 8269984: [macos] JTabbedPane title looks like disabled
e90ed6c: 8271173: serviceability/jvmti/GetObjectSizeClass.java doesn't check exit code
b4c6229: 8271189: runtime/handshake/HandshakeTimeoutTest.java can be run in driver mode
7468bbc: 8266988: compiler/jvmci/compilerToVM/IsMatureTest.java fails with Unexpected isMature state for multiple times invoked method: expected false to equal true
286106d: 8271219: [REDO] JDK-8271063 Print injected fields for InstanceKlass
a1c0a6a: 8199594: Add doc describing how (?x) ignores spaces in character classes
4ed548b: 8268261: C2: assert(n != __null) failed: Bad immediate dominator info.
ec71e2d: 8271221: [BACKOUT] JDK-8271063 Print injected fields for InstanceKlass
f4b3ee5: 8270280: security/infra/java/security/cert/CertPathValidator/certification/LetsEncryptCA.java OCSP response error
... and 139 more: https://git.openjdk.java.net/jdk/compare/9cac94d581f240c10fe8fff2f803109a1ae30637...master

Your commit was automatically rebased without conflicts.

openjdk · 2021-07-24T10:15:23Z

@simonis @cliveverghese Pushed as commit e627cae.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

8270317: Large Allocation in CipherSuite

f7814af

openjdk bot added the rfr Pull request is ready for review label Jul 14, 2021

openjdk bot added the security security-dev@openjdk.org label Jul 14, 2021

djelinski reviewed Jul 14, 2021

View reviewed changes

src/java.base/share/classes/sun/security/ssl/CipherSuite.java Outdated Show resolved Hide resolved

navyxliu reviewed Jul 14, 2021

View reviewed changes

Move to Immutable map and reduce map lookups

aec4f54

XueleiFan reviewed Jul 22, 2021

View reviewed changes

Add allowed and default lists

c0a21c5

XueleiFan approved these changes Jul 22, 2021

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Jul 22, 2021

Add blank space before and after the for loop

158714c

djelinski approved these changes Jul 23, 2021

View reviewed changes

Remove for loop from validValuesOf

39b78e6

XueleiFan reviewed Jul 23, 2021

View reviewed changes

Fix line length

6e75c82

simonis approved these changes Jul 23, 2021

View reviewed changes

Add new line in end of CipherSuiteBench

b0375b2

openjdk bot added the sponsor Pull request is ready to be sponsored label Jul 23, 2021

openjdk bot closed this Jul 24, 2021

openjdk bot added integrated Pull request has been integrated and removed ready Pull request is ready to be integrated rfr Pull request is ready for review sponsor Pull request is ready to be sponsored labels Jul 24, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

8270317: Large Allocation in CipherSuite #4783

8270317: Large Allocation in CipherSuite #4783

cliveverghese commented Jul 14, 2021 •

edited by openjdk bot

Loading

bridgekeeper bot commented Jul 14, 2021

openjdk bot commented Jul 14, 2021

mlbridge bot commented Jul 14, 2021 •

edited

Loading

XueleiFan commented Jul 14, 2021

djelinski left a comment

navyxliu Jul 14, 2021

mbien Jul 16, 2021

cliveverghese Jul 21, 2021

cliveverghese commented Jul 15, 2021

cliveverghese commented Jul 21, 2021 •

edited

Loading

XueleiFan commented Jul 22, 2021

cliveverghese commented Jul 22, 2021

XueleiFan Jul 22, 2021

XueleiFan Jul 22, 2021

XueleiFan Jul 22, 2021 •

edited

Loading

XueleiFan Jul 22, 2021 •

edited

Loading

XueleiFan Jul 22, 2021 •

edited

Loading

cliveverghese commented Jul 22, 2021

XueleiFan left a comment

XueleiFan Jul 22, 2021

cliveverghese Jul 22, 2021 •

edited

Loading

openjdk bot commented Jul 22, 2021 •

edited

Loading

djelinski Jul 23, 2021

cliveverghese Jul 23, 2021

XueleiFan Jul 23, 2021

cliveverghese Jul 23, 2021

XueleiFan Jul 23, 2021 •

edited

Loading

simonis left a comment

cliveverghese commented Jul 23, 2021

openjdk bot commented Jul 23, 2021

simonis commented Jul 24, 2021

openjdk bot commented Jul 24, 2021

openjdk bot commented Jul 24, 2021

		for (CipherSuite cs : CipherSuite.values()) {
		for (CipherSuite cs : ciphers) {

8270317: Large Allocation in CipherSuite #4783

8270317: Large Allocation in CipherSuite #4783

Conversation

cliveverghese commented Jul 14, 2021 • edited by openjdk bot Loading

Benchmark results

Progress

Issue

Reviewers

Reviewing

bridgekeeper bot commented Jul 14, 2021

openjdk bot commented Jul 14, 2021

mlbridge bot commented Jul 14, 2021 • edited Loading

Webrevs

XueleiFan commented Jul 14, 2021

djelinski left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cliveverghese commented Jul 15, 2021

cliveverghese commented Jul 21, 2021 • edited Loading

Current

ArrayList

Hashmap

XueleiFan commented Jul 22, 2021

cliveverghese commented Jul 22, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

XueleiFan Jul 22, 2021 • edited Loading

Choose a reason for hiding this comment

XueleiFan Jul 22, 2021 • edited Loading

Choose a reason for hiding this comment

XueleiFan Jul 22, 2021 • edited Loading

Choose a reason for hiding this comment

cliveverghese commented Jul 22, 2021

XueleiFan left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cliveverghese Jul 22, 2021 • edited Loading

Choose a reason for hiding this comment

openjdk bot commented Jul 22, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

XueleiFan Jul 23, 2021 • edited Loading

Choose a reason for hiding this comment

simonis left a comment

Choose a reason for hiding this comment

cliveverghese commented Jul 23, 2021

openjdk bot commented Jul 23, 2021

simonis commented Jul 24, 2021

openjdk bot commented Jul 24, 2021

openjdk bot commented Jul 24, 2021

cliveverghese commented Jul 14, 2021 •

edited by openjdk bot

Loading

mlbridge bot commented Jul 14, 2021 •

edited

Loading

cliveverghese commented Jul 21, 2021 •

edited

Loading

XueleiFan Jul 22, 2021 •

edited

Loading

XueleiFan Jul 22, 2021 •

edited

Loading

XueleiFan Jul 22, 2021 •

edited

Loading

cliveverghese Jul 22, 2021 •

edited

Loading

openjdk bot commented Jul 22, 2021 •

edited

Loading

XueleiFan Jul 23, 2021 •

edited

Loading