Re: [Qemu-devel] backup notifier fail policy

[Stefan Hajnoczi <stefanha@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 2182 bytes --]

On Fri, Sep 30, 2016 at 09:59:16PM +0300, Vladimir Sementsov-Ogievskiy wrote:
> On 30.09.2016 20:11, Vladimir Sementsov-Ogievskiy wrote:
> > Hi all!
> > 
> > Please, can somebody explain me, why we fail guest request in case of io
> > error in write notifier? I think guest consistency is more important
> > than success of unfinished backup. Or, what am I missing?
> > 
> > I'm saying about this code:
> > 
> > static int coroutine_fn backup_before_write_notify(
> >         NotifierWithReturn *notifier,
> >         void *opaque)
> > {
> >     BackupBlockJob *job = container_of(notifier, BackupBlockJob,
> > before_write);
> >     BdrvTrackedRequest *req = opaque;
> >     int64_t sector_num = req->offset >> BDRV_SECTOR_BITS;
> >     int nb_sectors = req->bytes >> BDRV_SECTOR_BITS;
> > 
> >     assert(req->bs == blk_bs(job->common.blk));
> >     assert((req->offset & (BDRV_SECTOR_SIZE - 1)) == 0);
> >     assert((req->bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
> > 
> >     return backup_do_cow(job, sector_num, nb_sectors, NULL, true);
> > }
> > 
> > So, what about something like
> > 
> > ret = backup_do_cow(job, ...
> > if (ret < 0 && job->notif_ret == 0) {
> >    job->notif_ret = ret;
> > }
> > 
> > return 0;
> > 
> > and fail block job if notif_ret < 0 in other places of backup code?
> > 
> 
> And second question about notifiers in backup block job. If block job is
> paused, notifiers still works and can copy data. Is it ok? So, user thinks
> that job is paused, so he can do something with target disk.. But really,
> this 'something' will race with write-notifiers. So, what assumptions may
> user actually have about paused backup job? Is there any agreements? Also,
> on query-block-jobs we will see job.busy = false, when actually
> copy-on-write may be in flight..

I agree that the job should fail and the guest continues running.

The backup job cannot do the usual ENOSPC stop/resume error handling
since we lose snapshot consistency once guest writes are allowed to
proceed.  Backup errors need to be fatal, resuming is usually not
possible.  The user will have to retry the backup operation.

Stefan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 455 bytes --]