Xenstore Recovery?

Xenstore Recovery?

[Michael Vrable]

There has been talk of driver recovery within Xen domains if the backend
goes away unexpectedly.  Has anyone given much thought to how to perform
recovery if a domain's connection to _xenstore_ goes away?

It seems a trickier problem.   There's no existing way to signal a
domain that this has happened--we can't simply have the new xenstore
daemon write data out on the xenstore channels, since there are no clear
message boundaries.  The xenbus code in Linux doesn't look like it's
designed to deal with failures in xenstore.  Also, watches on the store
seem like hard state within xenstore, that domains can't be easily told
to rebuild.

It looks like the suspend/resume code in domains will handle
reconnecting to xenstore, but that only works if the domain is properly
notified ahead of time.

I'm mostly just curious whether this is in the xenstore/xenbus design at
all, a case that is explicitly not handled for complexity reasons, or
something else.

--Michael Vrable