Hello,
Several people asked me to put the long-term effort re. PEPs 489 and 573
in words, so I've written a document that I'd like to submit as an
informational PEP and/or a HOWTO.
A rendered version is available at: https://hackmd.io/@encukou/module-state
It's in Markdown: I've gotten so used to MD that translating to ReST
once sounds easier than drafting in ReST.
If you have a HackMD account and would like to co-author or fix typos
directly, I can give you access.
Isolating Extension Modules
===========================
Abstract
--------
Traditionally, state of Python extension modules was kept in C `static`
variables, which have process-wide scope.
This document describes problems of such per-process state, and efforts
to make per-module state, a better default, possible and easy to use.
The document also describes how to switch to per-module state where
possible.
The switch involves allocating space for that state, switching from
static types to heap types, and—perhaps most importantly—accessing
per-module state from code.
About this document
-------------------
This document does not introduce any changes: those should be done in
their own PEPs (or issues, if small enough).
Rather, it covers the motivation behind an effort that spans multiple
releases.
Once support is reasonably complete, the text can be moved to a
[HOWTO](https://docs.python.org/3/howto/index.html) in the documentation.
Meanwhile, in the spirit of documentation-driven development, gaps in
the text show where to focus the effort.
Whenever the document mentions *extension modules*, the advice also
applies to *built-in* modules, such as the C parts of the standard library.
The standard library is expected to switch to per-module state early.
PEPs related to this effort are:
* PEP 384 -- *Defining a Stable ABI*, which added C API for creating
heap types
* PEP 489 -- *Multi-phase extension module initialization*
* PEP 573 -- *Module State Access from C Extension Methods*
This document is concerned with Python's public C API.
Nothing is specific to CPython.
Motivation
----------
An *interpreter* is the context in which Python code runs. It contains
configuration (e.g. the import path) and runtime state (e.g. the set of
imported modules).
Python supports running multiple interpreters in one process.
There are two cases to think about. Users may run interpreters:
* in sequence, with several `Py_InitializeEx`/`Py_FinalizeEx` cycles, and
* in parallel, managing “sub-interpreters” using
`Py_NewInterpreter`/`Py_EndInterpreter`.
Both cases (and combinations of them) would be most useful when
embedding Python within a library.
Libraries generally shouldn't make assumptions about the application
that uses them, which includes assumptions about a process-wide “main
Python interpreter”.
Currently, CPython doesn't handle this use case well.
Many extension modules (and even some stdlib modules) use *per-process*
global state, because C `static` variables are extremely easy to use.
Thus, data that should be specific to an interpreter ends up being
shared between interpreters.
Unless the extension developer is careful, it is very easy to introduce
edge cases that lead to crashes when a module is loaded in more than one
interpreter.
Unfortunately, *per-interpreter* state is not easy to achieve: extension
authors tend to not keep multiple interpreters in mind when developing,
and it is currently cumbersome to test the behavior.
Rationale for Per-module State
------------------------------
Instead of focusing on per-interpreter state, Python's C API is evolving
to better support the more granular *per-module* state.
By default, C-level data will be attached to a *module object*.
Each interpreter will then create its own module object, keeping data
separate.
For testing the isolation, multiple module objects can even be loaded in
a single interpreter.
Per-module state provides an easy way to think about lifetime and
resource ownership: the extension module author will set up when a
module object is created, and clean up when it's freed.
In this regard, a module is just like any other `PyObject *`; there are
no “on interpreter shutdown” hooks to think about (or forget about).
### Easy-to-use Module State as a Goal
It is currently cumbersome or impossible to do everything the C API
offers while keeping modules isolated.
Enabled by PEP 384, changes in PEPs 489 and 573 (and future planned
ones) aim to first make it *possible* to build modules this way, and
then to make it *easy* to write new modules this way and to convert old
ones, so that it can become a natural default.
Even if per-module state becomes the default, there will be use cases
for different levels of encapsulation: per-process, per-interpreter,
per-thread or per-task state.
The goal is to treat these as exceptional cases: extension authors will
need to think more carefully about them.
### Non-goals: Speedups and the GIL
There is some effort to speed up CPython by making the GIL per-interpreter.
While isolating interpreters helps that effort, defaulting to per-module
state will be beneficial even if no speed-up is achieved.
How to make modules safe with multiple interpreters
---------------------------------------------------
There are many ways to correctly support multiple interpreters in
extension modules.
The rest of this text describes the preferred way to write such a
module, or convert an existing module.
Note that support is a work in progress; the API for some features your
module needs might not yet be ready.
A full example module is (XXX currently available in [a fork on
GitHub](https://github.com/encukou/cpython/blob/xxlimited-facelift/Modules/…;
later it should be in the CPython source tree).
### Isolated Module Objects
The key point to keep in mind when developing an extension module is
that several module objects can be created from a single shared library.
For example:
```pycon
>>> import sys
>>> import binascii
>>> old_binascii = binascii
>>> del sys.modules['binascii']
>>> import binascii # create a new module object
>>> old_binascii == binascii
False
```
As a rule of thumb, the two modules should be completely independent.
All objects and state specific to the module should be encapsulated
within the module object, not shared with other module objects, and
cleaned up when the module object is deallocated.
Exceptions are possible (see “Managing global state” below) but they
will need more thought and attention to edge cases than code that
follows this rule of thumb.
While some modules could do with less stringent restrictions, isolated
modules make it easier to set clear expectations (and guidelines) that
work across a variety of use cases.
### Surprising Edge Cases
Note that isolated modules do create some surprising edge cases.
Most notably, each module object will typically not share its classes
and exceptions with other similar modules.
Continuing from the example above, note that `old_binascii.Error` and
`binascii.Error` are separate objects.
In the following code, the exception is *not* caught:
```pycon
>>> old_binascii.Error == binascii.Error
False
>>> try:
... old_binascii.unhexlify(b'qwertyuiop')
... except binascii.Error:
... print('boo')
...
Traceback (most recent call last):
File "<stdin>", line 2, in <module>
binascii.Error: Non-hexadecimal digit found
```
This is expected.
Notice that pure-Python modules behave the same way: it is a part of how
Python works.
The goal is to make extension modules safe at the C level, not to make
hacks (like mutating `sys.modules` or sharing objects across
interpreters) behave intuitively.
### Managing Global State
Sometimes, state of a Python module is not specific to that module, but
to the entire process (or something else “more global” than a module).
For example:
* The `readline` module provides access to *the* terminal.
* A module running on a circuit board wants to control *the* on-board LED.
In these cases, the Python module should provide *access* to the global
state, rather than *own* it.
If possible, write the module so that multiple copies of it can access
the state independently (along with other libraries, whether for Python
or other languages).
If that is not possible, consider explicit locking.
If it is necessary to use process-global state, the simplest way to
avoid issues with multiple interpreters is to explicitly prevent a
module from being loaded more than once per process—see “An Opt-Out
Method” below.
### Managing Per-module state
To use per-module state, use [multi-phase extension module
initialization](https://docs.python.org/3/c-api/module.html#multi-phase-ini…
introduced in PEP 489.
This signals that your module supports multiple interpreters correctly.
Set `PyModuleDef.m_size` to a positive number to request that many bytes
of storage local to the module.
Usually, this will be set to the size of some module-specific `struct`,
which can store all of the module's C-level state.
In particular, it is where you should put pointers to classes (including
exceptions) and settings (e.g. `csv.field_size_limit`) which the C code
needs to function.
> [Note]
> Another option is to store state in the module's `__dict__`, but you
must avoid crashing when users modify `__dict__` from Python code.
> This means error- and type-checking at the C level, which is easy to
get wrong and hard to test sufficiently.
If the module state includes `PyObject` pointers, the module object must
hold references to those objects and implement module-level hooks
`m_traverse`, `m_clear`, `m_free`.
These work like `tp_traverse`, `tp_clear`, `tp_free` of a class.
Adding them will require some work and make the code longer; this is the
price for modules which can be unloaded cleanly.
An example of a module with per-module state is (XXX currently available
in [a fork on
GitHub](https://github.com/encukou/cpython/blob/xxlimited-facelift/Modules/…;
later it should be in the CPython source tree), with module
initialization is at the bottom of the file.
### Opt-Out: Limiting to One Module Object per Process
A non-negative `PyModuleDef.m_size` signals that a module supports
multiple interpreters correctly.
If this is not yet the case for your module, you can explicitly make
your module loadable only once per process.
Raising an exception is better than mysteriously crashing in C code!
For example:
```c
static int loaded = 0;
static int
exec_module(PyObject* module)
{
if (loaded) {
PyErr_SetString(PyExc_ImportError,
"cannot load module more than once per process");
return -1;
}
loaded = 1;
... // rest of initialization
}
```
When your module becomes ready, you can remove this check.
### Module state access from functions
Accessing the state from module-level functions is straightforward.
Functions get the module object as their first argument; for extracting
the state there is `PyModule_GetState`:
```c
static PyObject *
func(PyObject *module, PyObject *args)
{
my_struct *state = (my_struct*)PyModule_GetState(module);
if (state == NULL) {
return NULL;
}
... // rest of logic
}
```
(Note that `PyModule_GetState` may return NULL without seting an
exception if there is no module state, i.e. `PyModuleDef.m_size` was
zero. In your own module, you're in control of `m_size`, so this is easy
to prevent.)
### Heap types
Traditionally, types defined in C code were static, that is, `static
PyTypeObject` structures defined directly in code and initialized using
`PyType_Ready()`.
Such types are necessarily shared across the process.
Sharing them between module objects requires paying attention to any
state they own or access. To limit the possible issues, static types are
immutable at the Python level: for example, you can't set
`str.myattribute = 123`.
> [Note]
> Sharing truly immutable objects between interpreters is fine, as long
as they don't provide access to mutable objects.
> But, every Python object has a mutable implementation detail: the
reference count.
> Changes to the refcount are guarded by the GIL.
> Thus, code that shares any Python objects across interpreters
implicitly depends on CPython's current, process-wide GIL.
An alternative to static types is *heap-allocated types*, or heap types
for short.
These correspond more closely to classes created by Python’s `class`
statement.
Heap types can be created by filling a `PyType_Spec` structure, a
description or “blueprint” of a class, and calling
`PyType_FromModuleAndSpec()` to construct a new class object.
> [note]
> Other functions, like `PyType_FromSpec()`, can also create heap types,
> but `PyType_FromModuleAndSpec()` associates the module with the
class, granting access
> to the module state to methods.
The class should generally be stored in *both* the module state (for
safe access from C) and the module's `__dict__` (for access from Python
code).
### Module State Access from Classes
If you have a type object defined with `PyType_FromModuleAndSpec()`,
call `PyType_GetModule` to get the associated module, then
`PyModule_GetState` to get the module's state.
These steps can be combined with `PyType_GetModuleState` to save typing
some tedious error-handling boilerplate:
```c
my_struct *state = (my_struct*)PyType_GetModuleState(type);
if (state === NULL) {
return NULL;
}
```
### Module State Access from Regular Methods
Accessing the module-level state from methods of a class is somewhat
more complicated, but possible thanks to changes introduced in PEP 573.
To get the state, you need to first get the *defining class*, and then
get the module state from it.
The largest roadblock is getting *the class a method was defined in*, or
that method's “defining class” for short.
The defining class can have a reference to the module it is part of.
It is important to not confuse the defining class with `Py_TYPE(self)`.
If the method is called on a *subclass* of your type, `Py_TYPE(self)`
will refer to that subclass, which may be defined in different module
than yours.
In the following Python example, the defining class of the method
`Base.get_defining_class` is `Base`, even if `type(self) == Sub`:
```python
class Base:
def get_defining_class(self):
return __class__
class Sub(Base):
pass
```
To get its “defining class”, a method must use the `METH_METHOD |
METH_FASTCALL | METH_KEYWORDS` [calling
convention](https://docs.python.org/3.9/c-api/structures.html?highlight=met…
and the corresponding [PyCMethod
signature](https://docs.python.org/3.9/c-api/structures.html#c.PyCMethod):
```c
PyObject *PyCMethod(
PyObject *self, // object the method was called on
PyTypeObject *defining_class, // defining class
PyObject *const *args, // C array of arguments
Py_ssize_t nargs, // length of "args"
PyObject *kwnames) // NULL, or dict of keyword arguments
```
Once you have the defining class, call `PyType_GetModuleState` to get
the state of its associated module.
For example:
```c
static PyObject *
example_method(PyObject *self,
PyTypeObject *defining_class,
PyObject *const *args,
Py_ssize_t nargs,
PyObject *kwnames)
{
my_struct *state = (my_struct*)PyType_GetModuleState(defining_class);
if (state === NULL) {
return NULL;
}
... // rest of logic
}
PyDoc_STRVAR(example_method_doc, "...");
static PyMethodDef my_methods[] = {
{"example_method",
(PyCFunction)(void(*)(void))example_method,
METH_METHOD|METH_FASTCALL|METH_KEYWORDS,
example_method_doc}
{NULL},
}
```
Open Issues
-----------
Several issues around per-module state and heap types are still open.
Discussions about improving the situation are best held on the [capi-sig
mailing list](https://mail.python.org/mailman3/lists/capi-sig.python.org/).
### Module State Access from Slot Methods, Getters and Setters
Currently (as of Python 3.9), there is no API to access the module state
from:
* slot methods (meaning type slots, such as `tp_new`, `nb_add` or
`tp_iternext`)
* getters and setters defined with `tp_getset`
### Type Checking
Currently (as of Python 3.9), there is no good API to write `Py*_Check`
functions (like `PyUnicode_Check` exists for `str`, a static type) for
heap types.
This check ensures whether instances have a particular C layout.
### Metaclasses
Currently (as of Python 3.9), there is no good API to specify the
*metaclass* of a heap type, that is, the `ob_type` field of the type object.
### Per-Class scope
It is also not possible to attach state to *types*.
While `PyHeapTypeObject` is a variable-size object (`PyVarObject`), but
its variable-size storage is currently consumed by slots.
There will also be issues if several classes in an inheritance hierarchy
need state.
Copyright
---------
This document is placed in the public domain or under the
CC0-1.0-Universal license, whichever is more permissive.
..
Local Variables:
mode: indented-text
indent-tabs-mode: nil
sentence-end-double-space: t
fill-column: 70
coding: utf-8
End:
Hello,
Now that PEP 573 (Module State Access from C Extension Methods) is in,
it's time to address the most important part missing from it: module
state access from slot methods (like tp_init or nb_add).
This has long history; see e.g. a thread I started in 2015:
https://mail.python.org/pipermail/import-sig/2015-July/thread.html#1037
Most recently, a possible solution, an MRO walker, was one of the last
things removed from PEP 573 before acceptance, because the proposed
solution was broken: see
https://mail.python.org/archives/list/python-dev@python.org/message/PFBAQWQ…
Here's the removed text:
> Slot methods
> ------------
>
> To allow access to `per-module state`_ from slot methods, an MRO walker
> will be implemented::
>
> PyTypeObject *PyType_DefiningTypeFromSlotFunc(PyTypeObject *type,
> int slot, void *func)
>
> The walker will go through bases of heap-allocated ``type``
> and search for class that defines ``func`` at its ``slot``.
>
> The ``func`` does not need to be inherited by ``type`` (i.e. it may have been
> overridden in a subclass). The only requirement for the walker to find the
> defining class is that the defining class must be heap-allocated.
>
> On failure, exception is set and NULL is returned.
and the last iteration of the implementation is here:
https://github.com/Dormouse759/cpython/blob/41fe314c5124fa9434d56169868dfc0…
A MRO walker is not efficient. The other viable options I'm aware of are:
- putting a pointer in the class object (which would need reliable
class-level storage, see
https://mail.python.org/archives/list/capi-sig@python.org/thread/BWVQLET4L3…
)
- solutions that aren't fully general, like context variables or putting
a pointer in each instance (thorny because constructors/initializers are
themselves slots)
- "__typeslots__" mentioned in
https://mail.python.org/pipermail/import-sig/2015-July/001035.html --
which are, IMO, quite invasive
Given that, I believe that some kind of MRO walker is still the best
immediate solution, mainly because it's easiest to implement. If done
well, it can only use current public API (limiting the maintenance
burden you'd have with something wired into the internals, and allowing
it to be copied to 3rd party code to support older Python versions), and
should be easy to replace with a more performant solution once that
comes out.
And if it's added, more modules could switch to the stable ABI and
eschew process-global state, so we get more exposure and experience with
the remaining problems.
Now, the main problem with "PyType_DefiningTypeFromSlotFunc" is that it
looked slot functions, which can be set from Python code, and doing so
can easily introduce C-level failures.
To solve this, my next thought is instead looking for something only
available in C: the PyModuleDef.
Here's an implementation of such an MRO walker, which I call
"_PyType_GetModuleByDef":
https://github.com/encukou/cpython/blob/98dd889575cf7d1688495983ba791e14894…
My thinking is to start using this in 3.10 as internal API to get a feel
for its strengths and weaknesses.
It should be easy to rewrite the function to only use public API, and
added to another project (like Cython). It should also be easy to make
it public once we're sure it's the way forward.
What are your thoughts?
NOTE: This is copied straight from Python-Ideas mailing list.
CPython at the very least has 2 different type of native states: Interpreter &
Module state.
Unfortunately, the multi-phase initialization has a weakness when it comes to Module
states.
You can't access the module state without a pointer to the module.
PyState_GetModule from a standpoint looks to be the obvious answer to use, but it's
documentation states it's unfit for multi-phase initialization.
I'm proposing an idea here for discussion on a new state system for at least
CPython.
Tier 1: Core state
- This state lives within CPython's core binary and exists the entire
lifetime of the binary.
- The data held within this state is available to the main interpreter and subsequent
sub-interpreters. (Example: sys.executable)
Tier 2-1: Interpreter state (Branches from Core state)
- This state lives within CPython's core binary and is tied to a specific
interpreter.
- The data held within this state is only available to the interpreter it's tied to.
(Example: Modules loaded into memory)
Tier 2-2: Extension state (Branches from Core state)
- This state lives within any CPython's core binary EXCEPT it's size and
structure is defined by the extension CPython has loaded.
- The purpose of this state is to allow an extension to hold data that can't be tied
to a specific module. (Examples can be: Windows WSA, MySQL)
Tier 3-1: Thread state (Branches from Interpreter State)
- This state lives within CPython's core binary and is tied to a specific
Python thread (IE: Threading library threads),
- The data held within this state is only available to the thread it's tied to. (No
known examples available)
Tier 3-2: Module state (Branches from Interpreter State)
- This type of state is already available in CPython, explaining it is not
required.
