Integrate restart-safe NFS cancellation and matching livepatches - #89
Merged
Merged
Conversation
rpc.nfsd accepts one version per option, not a comma-separated list. Passing the default list only enables version 3 explicitly. With current nfs-utils this leaves version 4.0 disabled even when requested. Emit each enable/disable option separately. Apply exclusions first so an aggregate version 4 disable cannot override a selected minor version. Expand aggregate version 4 into all supported minor versions before computing exclusions, and document that selection rule. Cover generated arguments for all versions, aggregate v4, and v4.1-only, and preserve the original selection when serializing configuration. Validation: 84 exportfs examples and genuine Overcommit hooks pass. The NFS development VM passes v3/v4.0/v4.1/v4.2 with repeated options; full staging candidate integration remains separate.
Let normal NFS I/O retain hard-retry semantics while preserving container restartability when the server is unreachable. Use the kernel's terminal namespace cancellation controls only during forced teardown or init exit, not in response to ordinary server delay. Capture authenticated non-host user/network namespace handles before container init runs and retain them per run, independently of PID reuse. Rediscover init after daemon restart. Select shutdown_tree only for the exact run owner; otherwise use per-netns or older per-filesystem fallback. Quiesce the payload without freezing the LXC monitor, cancel before and after freezer completion, and thaw on every exit path. Monitor all init threads through a retained proc directory for PF_EXITING, so init closing its own dirty NFS descriptor cannot block before LXC sends STOPPING. Cancel terminal LXC states before publishing them. Snapshot only the original monitor roster and cache its identity outside the master mutex. Keep per-run identity immutable and refuse recapture after close. Run process/thread discovery and namespace writes inside a bounded worker. Use monotonic deadlines, bounded responses and asynchronous child reaping; do not hold daemon locks across unbounded namespace or proc operations. Document the ownership boundary and pending-write loss: cancellation is terminal teardown, not a successful sync or backup durability guarantee. CIFS/SMB policy is unchanged. Add native CI coverage for NFS3/4.0/4.1/4.2: outage recovery and checksums, shared mounts, forced and graceful-timeout teardown, remote lock waiters, mounts blocked in kernel, processless and newly created namespaces, permissions/admission, daemon restart and both idle and dirty PID1 exit. Stop failure diagnostics preserve daemon logs and blocked-task stacks before restoring connectivity. Include the recovery force-kill fixture in this owner: verify capture, freeze, cancellation, kill and thaw ordering, and thaw on abort failure. Validation: 1062 osctld examples passed. The cancellation code passed all 40 native cases on the normal published-source kernel with builtin ZFS, matching cumulative livepatch and default boot security. The livepatch identity suite passed all five cases. An earlier development run had a forced-stop timeout and a follow-on busy-mount failure; later exact-source runs passed, without attributing an unproven root cause. Full repository CI remains a staging-publication gate. Development: incorporate teardown lifecycle, namespace admission, worker bounds, daemon restart and PID1-exit coverage into one implementation owner; fold the recovery force-kill test repair without product changes.
The fail-fast scheduler stopped the whole suite on an intermediate script failure, before the retry loop could use its configured attempts. This made the native retry self-test fail even though it explicitly allows a second attempt after its intentional first failure. Carry the current attempt into streamed-result processing and stop new admissions only when an unexpected script result exhausts its attempts. Apply the same rule to the aggregate attempt result, including failures without a script result. An exhausted sibling still stops admissions. Guest kernel failures remain immediately terminal and are never retried; already-running tests retain their normal cleanup and result collection. Cover retry success and exhaustion, mixed attempt budgets, kernel failure, and streamed unexpected failure and success. Give executor specs isolated temporary state and document the interaction with fail-fast mode. Keep the existing native self-test, its attempts and all assertions unchanged. Validation: the regression reproduces with the original executor; all 220 test-runner unit examples and genuine pre-commit hooks pass. The native three-script driver/rspec test passes with --stop-on-failure, including the intentional first failure and successful second attempt. Development: fix the independent scheduler regression exposed by full CI; no change to NFS cancellation, kernel artifacts or livepatch behavior.
Pin the published NFS cancellation kernel while retaining Linux 6.12.95 and the existing ZFS source. Normal NFS I/O uses hard retries; host-owned terminal namespace cancellation supplies bounded container teardown. The kernel includes reviewed NFS, NLM, SUNRPC and transport lifetime fixes. CIFS policy is unchanged. The kernel changes the NFS/SUNRPC ABI without changing the release string. Select a distinct nfs-cancel cumulative livepatch module. Remove only the function replacements and transition state already built into this kernel; retain the remaining cumulative security coverage and the original patch inputs for legacy boot kernels. Retain a deterministic GNU build ID for the new kernel family. Require matching kernel notes and the booted kernel image before managing its livepatch, failing closed across a generation switch without a reboot. Keep existing protection untouched on mismatch and let the exporter assess the booted generation's livepatch requirements. Do not infer compatibility from a shared uname string or delegate to a differently configured loader. Normalize the new variant's builtin-ZFS feature attributes and request the combined CONFIG_ZFS option, not the obsolete standalone SPL option. Keep legacy kernel derivations unchanged. Handle read-only source unpacking and inject builtin ZFS into the livepatch source only when configured. Document the two boot-kernel variants. Freeze legacy lifecycle tests on the original kernel and register native coverage for matching identity, wrong notes, wrong boot image, load/unload/reload and kernel health. Validation: normal published-source kernel and matching cumulative module build successfully. All 356 module import CRCs match the final kernel. Five native identity cases and 40 packaged NFS cancellation cases pass with default boot security. Component unit suites and genuine pre-commit checks pass. The exact frozen candidate passes all 78 tests (268 scripts) with ./test-runner.sh test -f --stop-on-failure -j 2 -t ci, including the complete NFS cancellation and livepatch identity matrices. Development: integrate source-specific livepatch coverage and identity checks; correct builtin feature evaluation, the obsolete SPL request and the private-shell comparison tool path without weakening assertions.
Member
Author
Post-integration scope verificationPR #89 was integrated server-side at The server base
Server-side integration preserved those changes. Of the 48 task-touched Validation applies to the frozen Linux 6.12.95 candidate, not to the newer No local staging reconciliation or additional version selection was done. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replace blanket forced-soft NFS mounts with ordinary hard retries during
normal container operation and host-authenticated, terminal cancellation
during teardown. Keep Linux 6.12.95, the existing ZFS source and OS base 26.05.
No deployment, reboot, release tag or CIFS policy change is included.
Four coherent OS commits cover:
and PID1-exit handling, with native NFS lifecycle coverage;
boot-kernel identity guards, exporter behavior and native identity tests.
Kernel source:
vpsfreecz/linux@563bbb35e8753e1bb34dad19ebeec8962ee3c1cd.It includes 48 independently attributed NFS/NLM/SUNRPC/transport backports
and the namespace cancellation owner. Cancellation is terminal and may fail
pending writes; it is not a successful sync. CIFS remains forced-soft pending
a separately implemented and qualified request-drain mechanism.
Exact-candidate validation
Frozen staging base:
647da320c9d23a3c73535053c2fa4e345cc6ea71.Candidate:
36589f99162c65ff3aaea0b60df92d78ddecb0dc.Accepted source tree:
8f7b4177aead7603b07929591f3f465bd43f53d7.The final integration commit records the already tested index unchanged.
./test-runner.sh test -f --stop-on-failure -j 2 -t ci.All 78 tests / 268 scripts passed on September 9, 2026, in 28602.95 seconds.
The intentional first-attempt driver failure retried successfully; there
were no unexpected terminal outcomes.
an earlier 40/40 packaged qualification. Includes outage/integrity, shared
client isolation, blocked mounts, graceful fallback, locks, processless
descendants, terminal admission, daemon restart and dirty-file PID1 exit.
boot image, load/unload/reload and kernel-health checks.
all 356 module import CRCs match the final kernel. Default boot security
retained, without compiler or CRC-check bypasses.
test-runner 220 examples passed. Genuine Overcommit Nixfmt/RuboCop passed.
Integration
The guarded fast-forward staging offer was rejected because staging moved
during validation. This is the unchanged, published task candidate submitted
through the documented server-side integration fallback. No local staging
refresh, rebase, replay or merge was performed. Preserve the task head and
logical commits; normal post-integration GitHub CI covers the resulting
staging commit. Do not deploy or reboot as part of this integration.