Re: [Qemu-devel] Microcheckpointing: Memory-VCPU / Disk State consistency

[Stefan Hajnoczi]

On Tue, Sep 23, 2014 at 06:36:42PM +0200, Walid Nouri wrote:
> Am 18.09.2014 15:56, schrieb Stefan Hajnoczi:
> >There is the issue of request ordering (using write cache flushes).  The
> >secondary probably needs to perform requests in the same order and
> >interleave cache flushes in the same way as the primary.  Otherwise a
> >power failure on the secondary could leave the disk in an invalid state
> >that is impossible on the primary.  So I'm just pointing out that cache
> >flush operations matter, not just read/write.
> 
> 
> To be honest, my thought was that drive-mirror handles all block device
> specific problems especially the cache flush requests for write ordering. So
> my naive approach was to use an existing functionality as a kind of black
> box transport mechanism and build on top of it. But that seems to be not
> possible for the subtle tricky part of the game.

I think the assumption with drive-mirror is that you throw away the
destination image if something fails.  That's the exact opposite of MC
where we want to fail over to the destination :).

> >There are fancier solutions using either a journal or snapshots that
> >provide data integrity without posing a performance bottleneck during
> >the commit phase.
> >
> >The trick is to apply write requests as they come off the wire on the
> >secondary but use a journal or snapshot mechanism to enforce commit
> >semantics.  That way the commit doesn't have to wait for writing out all
> >the data to disk.
> >
> Wouldn't that mean to send a kind of protocol information with the modified
> Blocks, a barrier or somthing like that?
> Can you please explain a little more what you meant?

Here is one example of a mechanism like this:

QEMU has a block job called drive-backup which copies sectors that are
about to be overwritten to an external file.  Once the data has been
copied into the external file, the sectors in the original image file
can be overwritten safely.

The Secondary runs drive-backup so that writes coming from the Primary
stash rollback data into an external qcow2 file.  When the Primary
wishes to commit we drop the qcow2 rollback file since we no longer need
the ability to roll back - this is cheap and not a lot of I/O needs to
be performed for the commit operation.

If the Secondary needs to take over it can use the rollback qcow2 file
as its disk image and the guest will see the state of the disk at the
last commit point.  The sectors that were modified since commit in the
original image file are covered by the data in the rollback qcow2 file.

There are a bunch of details on making this efficient but in principle
this approach makes both commit and rollback fairly lightweight.

> >The details depend on the code and I don't remember everything well
> >enough.  Anyway, my mental model is:
> >
> >1. The dirty bit is set *after* the primary has completed the write.
> >    See bdrv_aligned_pwritev().  Therefore you cannot use the dirty
> >    bitmap to query in-flight requests, instead you have to look at
> >    bs->tracked_requests.
> >
> >2. The mirror block job periodically scans the dirty bitmap (when there
> >    is no rate-limit set it does this with no artifical delays) and
> >    writes the dirty blocks.
> >
> >Given that cache flush requests probably need to be tracked too, maybe
> >you need MC-specific block driver on the primary to monitor and control
> >I/O requests.
> >
> >But I haven't thought this through and it's non-trivial so we need to
> >break this down more.
> >
> 
> As drive-mirror lacks this functionality a way (without changing the
> drive-mirror code) might be a MC-specific mechanism on the primary. This
> mechanism must respect write ordering requests (like forced cache flush, and
> Force Unit Access request) and send corresponding information for a stream
> of blocks to the secondary.
> 
> From what I have learned i'm assuming most guest OS filesystem/block layer
> follows an ordering interface based on SCSI???? As those kind of requests
> must be flaged in an I/O request by the guest operating system this should
> be possible. Do we have the chance to access those information in a guest
> request?
> 
> If this is possible does this information survives the journey through the
> nbd-server or must there be another communication channel like the QEMUFile
> approach of “block-migration.c”?

There isn't much information beyond the ordering of writes and cache
flushes, even in SCSI.  But that's okay, we just need to honor the
semantics of block devices.

Stefan

pgp6IpM_fUYFO.pgp
Description: PGP signature