Re: rbd locking and handling broken clients

[Florian Haas <florian@hastexo.com>]

Greg,

My understanding of Ceph code internals is far too limited to comment on
your specific points, but allow me to ask a naive question.

Couldn't you be stealing a lot of ideas from SCSI-3 Persistent
Reservations? If you had server-side (OSD) persistence of information of
the "this device is in use by X" type (where anything other than X would
get an I/O error when attempting to access data), and you had a manual,
authenticated override akin to SCSI PR preemption, plus key
registration/exchange for that authentication, then you would at least
have to have the combination of a misbehaving OSD plus a malicious
client for data corruption. A non-malicious but just broken client
probably won't do.

Clearly I may be totally misguided, as Ceph is fundamentally
decentralized and SCSI isn't, but if PR-ish behavior comes even close to
what you're looking for, grabbing those ideas would look better to me
than designing your own wheel.

Just my $.02, of course.

Cheers,
Florian